NPM: JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported

NPM: JS-YAML: Quadratic CPU consumption in !!omap resolution 3.x and 4.x — CVE-2026-59870 fix not backported vulnerability discovered by ? in WordPress Npm js-yaml versions = 3.0.0, 3.15.1...

NPM: Nx: Zip-Slip in the self-hosted remote cache

NPM: Nx: Zip-Slip in the self-hosted remote cache vulnerability discovered by ? in WordPress Npm nx versions = 20.8.0, 22.7.7...

NPM: Mermaid radar diagrams are vulnerable to DoS

NPM: Mermaid radar diagrams are vulnerable to DoS vulnerability discovered by ? in WordPress Npm mermaid versions = 11.6.0, 11.16.1...

NPM: Mermaid configuration APIs allow prototype pollution

NPM: Mermaid configuration APIs allow prototype pollution vulnerability discovered by ? in WordPress Npm mermaid versions 10.9.8...

NPM: Mermaid allows CSS injection applying to sibling elements of the diagram

NPM: Mermaid allows CSS injection applying to sibling elements of the diagram vulnerability discovered by ? in WordPress Npm mermaid versions 10.9.8...

NPM: Mermaid Architecture diagrams are vulnerable to prototype pollution

NPM: Mermaid Architecture diagrams are vulnerable to prototype pollution vulnerability discovered by ? in WordPress Npm mermaid versions = 11.5.0, 11.16.1...

NPM: Mermaid XY Charts are vulnerable to an infinite loop DoS

NPM: Mermaid XY Charts are vulnerable to an infinite loop DoS vulnerability discovered by ? in WordPress Npm mermaid versions = 10.6.0, 10.9.8...

WordPress Core < 7.0.3 - Reflected XSS to RCE vulnerability

Reflected XSS to RCE vulnerability discovered by pwn.ai in WordPress core versions 7.0.3...

WordPress Simply Schedule Appointments plugin < 1.6.12.6 - Unauthenticated Appointment Data Disclosure and Mass Deletion vulnerability

Unauthenticated Appointment Data Disclosure and Mass Deletion vulnerability discovered by Suleyman Huseynov in WordPress Plugin Simply Schedule Appointments versions 1.6.12.6...

WordPress Simple Restrict plugin < 1.2.9 - Contributor+ Restricted Content Disclosure vulnerability

Contributor+ Restricted Content Disclosure vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Simple Restrict versions 1.2.9...

WordPress AI ChatBot for WooCommerce plugin < 4.8.4 - Unauthenticated Gemini API Key Abuse vulnerability

Unauthenticated Gemini API Key Abuse vulnerability discovered by Pedro Pinho in WordPress Plugin ChatBot for eCommerce WoowBot versions 4.8.4...

WordPress King Addons for Elementor plugin < 51.1.76 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by V1T in WordPress Plugin King Addons for Elementor versions 51.1.76...

WordPress webtoffee-cookie-consent plugin < 3.5.3 - Consent Log Disclosure/Deletion, Page Creation & License Deactivation vulnerability

Consent Log Disclosure/Deletion, Page Creation & License Deactivation vulnerability discovered by Eran Kapeluto in WordPress Plugin webtoffee-cookie-consent versions 3.5.3...

WordPress Advanced Custom Fields: Font Awesome Field plugin <= 6.1.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Advanced Custom Fields: Font Awesome Field versions = 6.1.1...

WordPress theme My Login plugin <= 7.1.14 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Theme My Login versions = 7.1.14...

WordPress Export Import Menus plugin <= 1.9.2 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Export Import Menus versions = 1.9.2...

WordPress Custom CSS and JavaScript plugin <= 2.0.16 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Custom CSS and JavaScript versions = 2.0.16...

WordPress Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin <= 1.56.1 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by daroo in WordPress Plugin Forminator versions = 1.56.1...

WordPress Plugins Garbage Collector (Database Cleanup) plugin <= 0.14 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Plugins Garbage Collector Database Cleanup versions = 0.14...

WordPress Featured Video Plus plugin <= 2.3.3 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Featured Video Plus versions = 2.3.3...

WordPress YOP Poll plugin 7.0.0-7.0.6 - Unauthenticated Vote Restriction Bypass vulnerability

Unauthenticated Vote Restriction Bypass vulnerability discovered by Melina Lentini M3l3n in WordPress Plugin YOP Poll versions 7.0.0-7.0.6...

WordPress TranslatePress – Translate Multilingual sites with AI Translation plugin <= 3.2.6 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Pham Duc Anh in WordPress Plugin TranslatePress versions = 3.2.6...

WordPress Content Egg – Affiliate Product Importer & Price Comparison plugin <= 11.3.0 - Authenticated (Author+) Arbitrary File Deletion vulnerability

Authenticated Author+ Arbitrary File Deletion vulnerability discovered by Athiwat Tiprasaharn Jitlada, Itthidej Aramsri Boeing777 in WordPress Plugin Content Egg versions = 11.3.0...

WordPress SureCart plugin <= 4.6.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by TurboNexic in WordPress Plugin SureCart versions = 4.6.2...

WordPress Football Pool plugin <= 2.13.4 - Authenticated (Subscriber+) Reflected Cross-Site Scripting vulnerability

Authenticated Subscriber+ Reflected Cross-Site Scripting vulnerability discovered by whitesector in WordPress Plugin Football Pool versions = 2.13.4...

WordPress LightSync Pro – Connect & Sync Cloud Assets | Lightroom, Canva, Figma, Dropbox & Shutterstock plugin <= 2.1.6 - Authenticated (Author+) Arbitrary File Upload vulnerability

Authenticated Author+ Arbitrary File Upload vulnerability discovered by Athiwat Tiprasaharn Jitlada, Itthidej Aramsri Boeing777 in WordPress Plugin LightSync Pro versions = 2.1.6...

WordPress Cost Calculator Builder plugin <= 3.6.17 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure vulnerability

Missing Authorization to Authenticated Subscriber+ Sensitive Information Disclosure vulnerability discovered by momopon1415 in WordPress Plugin Cost Calculator Builder versions = 3.6.17...

WordPress Independent Analytics – WordPress Analytics Plugin plugin <= 2.15.0 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by daroo in WordPress Plugin Independent Analytics - Google Analytics Alternative for WordPress versions = 2.15.0...

WordPress TranslatePress – Translate Multilingual sites with AI Translation plugin <= 3.2.5 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by momopon1415 in WordPress Plugin TranslatePress versions = 3.2.5...

WordPress Login & Register Forms plugin < 3.2.5 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by Chamseddine Bouzaiene in WordPress Plugin Login/Signup Popup versions 3.2.5...

WordPress ChamaWP plugin < 1.0.13 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin ChamaWP versions 1.0.13...

WordPress AcyMailing plugin < 10.11.1 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Pedro Pinho in WordPress Plugin AcyMailing SMTP Newsletter versions 10.11.1...

WordPress Mailmunch Forms for Mailchimp plugin <= 3.2.7 - Missing Authorization to Authenticated (Subscriber+) MailMunch Integration Takeover vulnerability

Missing Authorization to Authenticated Subscriber+ MailMunch Integration Takeover vulnerability discovered by t0ann9uy3n in WordPress Plugin MailChimp Forms by MailMunch versions = 3.2.7...

WordPress JoomSport – for Sports: Team & League, Football, Hockey & more plugin <= 5.7.9 - Authenticated (Administrator+) SQL Injection vulnerability

Authenticated Administrator+ SQL Injection vulnerability discovered by Nicolas Decayeux in WordPress Plugin JoomSport versions = 5.7.9...

WordPress Page and Post Restriction plugin <= 1.4.1 - Unauthenticated Missing Authorization to Sensitive Information Exposure vulnerability

Unauthenticated Missing Authorization to Sensitive Information Exposure vulnerability discovered by Mitchell in WordPress Plugin Page Restriction WordPress WP versions = 1.4.1...

WordPress TableOn – WordPress Posts Table Filterable  plugin <= 1.0.5.1 - Unauthenticated Blind SQL Injection vulnerability

Unauthenticated Blind SQL Injection vulnerability discovered by Athiwat Tiprasaharn Jitlada, Itthidej Aramsri Boeing777, Waris Damkham in WordPress Plugin TableOn versions = 1.0.5.1...

WordPress wiseCampaign – WooCommerce Conversions Made Easy plugin <= 1.1.14 - Missing Authorization to Unauthenticated Plugin Configuration Modification vulnerability

Missing Authorization to Unauthenticated Plugin Configuration Modification vulnerability discovered by Legion Hunter in WordPress Plugin wiseCampaign versions = 1.1.14...

WordPress User Access Manager plugin <= 2.3.12 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by Nox Axter in WordPress Plugin User Access Manager versions = 2.3.12...

WordPress Authora : Easy login with mobile number plugin < 1.7.7 - Easy Login with Mobile Number < 1.7.7 - Unauthenticated Account Takeover vulnerability

WordPress Authora : Easy login with mobile number plugin 1.7.7 - Easy Login with Mobile Number 1.7.7 - Unauthenticated Account Takeover vulnerability discovered by 0xBassia in WordPress Plugin Authora : Easy login with mobile number versions 1.7.7...

WordPress Webinfos plugin <= 1.2 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin Webinfos versions = 1.2...

WordPress Huge IT Login plugin <= 1.0.4 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin Login Social versions = 1.0.4...

WordPress POUCO Import Users plugin <= 1.0.0 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin POUCO Import Users versions = 1.0.0...

WordPress Lenxel WP theme <= 1.0.31 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by moonge in WordPress Theme Lenxel WP versions = 1.0.31...

WordPress Support Genix plugin < 1.4.48 - Unauthenticated Arbitrary File Read vulnerability

Unauthenticated Arbitrary File Read vulnerability discovered by Artus KG in WordPress Plugin Support Genix versions 1.4.48...

WordPress File Manager plugin 6.0-6.9 - 6.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read and Deletion vulnerability

WordPress File Manager plugin 6.0-6.9 - 6.9 - Missing Authorization to Authenticated Subscriber+ Arbitrary File Read and Deletion vulnerability discovered by daroo in WordPress Plugin Bit File Manager versions 6.0-6.9...

WordPress WPMU DEV Dashboard plugin <= 5.0.0 - Authentication Bypass to Arbitrary plugin Installation (Remote Code Execution) vulnerability

Authentication Bypass to Arbitrary plugin Installation Remote Code Execution vulnerability discovered by Austin Ginder in WordPress Plugin WPMU DEV Dashboard versions = 5.0.0...

WordPress Membership Plugin – Kadence Memberships plugin <= 4.0.0 - Unauthenticated Password Reset Link Poisoning to Account Takeover vulnerability

Unauthenticated Password Reset Link Poisoning to Account Takeover vulnerability discovered by scort in WordPress Plugin Restrict Content versions = 4.0.0...

WordPress FluentSMTP plugin <= 2.2.95 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Fraudless in WordPress Plugin FluentSMTP versions = 2.2.95...

WordPress Smart Popup by Supsystic plugin <= 1.12.0 - Unauthenticated Privilege Escalation to Administrator vulnerability

Unauthenticated Privilege Escalation to Administrator vulnerability discovered by daroo in WordPress Plugin Popup by Supsystic versions = 1.12.0...

NPM: Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation

NPM: Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation vulnerability discovered by ? in WordPress Npm nuxt versions = 3.1.0, 3.21.10...