2026

The European VAT Compliance Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Heateor Support Fa

The ThirstyAffiliates WordPress plugin before 3.12.1 does not check the status or type of the object requested by its l

The Patreon WordPress plugin before 1.10.0 does not verify a nonce when connecting the site to a Patreon account, allowi

The Patreon WordPress plugin before 1.10.0 does not validate a user-supplied redirect destination before redirecting, al

The Patreon WordPress plugin before 1.10.0 does not perform an authorization check on some of its functionality, allowin

The BSK PDF Manager WordPress plugin through 3.8.1 does not properly sanitise and escape a parameter before using it in

The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not restrict which PHP classes may be instant

The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not perform a capability check on one of its

The WP User Manager WordPress plugin before 2.9.20 does not roll back the WordPress account it creates during payment-g

The WP Data Access WordPress plugin before 5.5.88 does not have authorisation and CSRF checks in one of its actions, al

The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value before build

The Ukr-To-Lat WordPress plugin through 1.3.5 does not sanitize and escape a term name before using it in a SQL query, a

The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) WordPre

The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom U

The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom U

The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Refere

The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'visible' Shortcode Attribute

The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and i

The Themify Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'popup_width_unit' parameter

The xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN plugin for WordPress is vulnerable to Stored Cross-

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up t

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all ver

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up t

The Welcart e-Commerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wp_usces_order_old (JSON fie

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to authoriza

The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via d

The EU VAT Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vat_numb

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to S

The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'toke

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to A

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cr

The Fastcache by Host.it plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Ob

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to PHP Object Injecti

An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability exists in the we

An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability in the SCPI FILE

An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. An OS command injection vulnerability exists in

Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.

A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repea

A flaw was found in parted. A heap-based buffer overflow exists in libparted's file system resizing logic when handling

A flaw was found in parted. A heap-based buffer overflow can occur when processing a specially crafted FAT32 filesystem

A flaw was found in libarchive. An attacker can cause a Denial of Service (DoS) or potential information disclosure due

A flaw was found in Nautilus. When a removable drive or disk image is unmounted or ejected, Nautilus prompts the user to

Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed

Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank field under allow_whitespace in strip_t

Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in c

Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field prece

Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-on