2026

The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and in

The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'data' Dynam

The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Open Redirect in all version

The GoPay for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'log_table_filter' paramet

The WP Optimizer plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to and inc

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Media field filter values

The Bread plugin for WordPress is vulnerable to information exposure in versions up to and including 2.9.12. This is due

The WP Composer – The Easiest Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pb

The VW Writer Blog theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability ch

The Ibtana – Ecommerce Product Addons plugin for WordPress is vulnerable to unauthorized post meta modification due to a

The Wow Elements Addons for Elementor plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions

The BlockSpare plugin for WordPress is vulnerable to authorization bypass due to incorrect logic in the permission callb

The Metasync plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check o

The Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization plugin for WordPress

The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Reflected Cross-Site Scr

The Real3D Flipbook Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lightboxtext' shortc

The AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker) plugin for WordPress is vul

The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'order' parameter in all versions up to,

The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'order_by' parameter in all versions up t

The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fb-config' S

The PDF Builder for WooCommerce. Create invoices,packing slips and more plugin for WordPress is vulnerable to authorizat

The WP Customer Reviews plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpcr3_fname' param

The Mailchimp for WooCommerce WordPress plugin before 6.1.1 does not verify that the requesting user holds the required

The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin before 5.4.7 does not verify the aut

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 does not perform object-leve

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3 does not verify that the hos

The WPGraphQL Smart Cache WordPress plugin before 2.3.2 does not require authorisation or validate a caller-supplied que

The Online Scheduling and Appointment Booking System WordPress plugin before 28.2 does not verify that the requester ow

The Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 does not validate the type or extension of files uplo

The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.3 does not sufficiently restrict which PH

The Nimble Page Builder WordPress plugin through 3.3.8 does not perform an authorization check when returning page-build

The Pochipp plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'keyword' parameter in versions

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to auth

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Refere

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Info

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scriptin

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to authorization bypass in all v

The Divi Essential plugin for WordPress is vulnerable to sensitive information exposure in versions up to, and including

The SEO Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.4.7. Thi

The WP2Social Auto Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all v

The WPComplete plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'empty' Shortcode Attribute in all

SiYuan versions through 3.8.4 fail to enforce publish access control in the getDynamicIcon endpoint, allowing read-only

A flaw was found in Netty's `netty-codec-http` component. A remote attacker could exploit this vulnerability by sending

A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote

Open edX Platform enables the authoring and delivery of online learning at any scale. From Aspen.1 until Ulmo and Verawo

Open edX Platform enables the authoring and delivery of online learning at any scale. From Redwood until Ulmo and Verawo

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Pr

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Pr

microsandbox is an easy, fast, local-first microVM runtime and library. Prior to 0.5.10, sdk/rust/lib/runtime/spawn.rs s

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Fr