2026

The ReactPress – Create React App for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via th

The Product Designer App plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including,

A flaw was found in Moodle. The XML grade import feature lacks proper Cross-Site Request Forgery (CSRF) token validation

A flaw was found in Moodle. User list filters do not properly enforce visibility restrictions on user profile fields. An

A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attac

A flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the application does no

A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recal

A flaw was found in Moodle. An incorrect capability check in the artificial intelligence (AI) editor placement's image g

A flaw was found in Moodle. The manual enrolment management page did not properly check whether the manual enrolment plu

A flaw was found in Moodle. Insufficient output escaping in templates used to display forum posts enables a stored cross

A flaw was found in Moodle. An authenticated attacker can supply an improperly validated audience class name to the Repo

A flaw was found in Moodle. An incorrect capability check in the grade web service allows an authenticated student to ac

A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitize

A flaw was found in Moodle. Incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking l

Improper Verification of Source of a Communication Channel in the ADS discovery of the Go implementation of Apache PLC4X

Integer Overflow, Improper Validation of Array Index, Uncontrolled Recursion and Memory Allocation with Excessive Size V

Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits, and Uncontrolled Recursion in the J

EasyFlow .NET developed by Digiwin has a Reflected Cross-site Scripting vulnerability. Unauthenticated remote attackers

EasyFlow .NET developed by Digiwin has a Missing Authentication vulnerability. Unauthenticated remote attackers can obta

EasyFlow .NET developed by Digiwin has an Arbitrary File Read vulnerability. Authenticated remote attackers can exploit

EasyFlow .NET developed by Digiwin has an SQL Injection vulnerability. Authenticated remote attackers can inject arbitra

EasyFlow .NET developed by Digiwin has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can ex

EasyFlow .NET developed by Digiwin has an Arbitrary File Upload vulnerability. Privileged remote attackers can upload an

The Viable URL Media Uploader plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in

When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, w

A stored cross-site scripting vulnerability via custom content descriptions exists in baserCMS. If this vulnerability is

A cross-site scripting vulnerability via script validation bypass exists in baserCMS. If this vulnerability is exploited

A missing authentication for critical function vulnerability exists in baserCMS. If this vulnerability is exploited, a r

A stored cross-site scripting vulnerability via appended strings in email form fields exists in baserCMS. If this vulner

Pgpool-II contains an incorrect implementation of an authentication algorithm, which may allow an unauthenticated attack

Pgpool-II inserts sensitive information into log file, which may allow an authenticated attacker to obtain the cluster i

A NULL pointer dereference vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnor

A stack-based buffer overflow vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause ab

An out-of-bounds write vulnerability exists in Pgpool-II, which may allow an authenticated attacker to cause abnormal pr

An improper certificate validation vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to byp

An out-of-bounds write vulnerability exists in Pgpool-II , which may allow an authenticated attacker to cause abnormal p

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `title` attribute of the

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to time-based blind SQL Inje

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'background_image' param

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'caption' parameter of t

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' parameter of th

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'images' parameter of th

The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'data_fields_list' parameter in

The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-href' parameter in al

The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored Cro

Improper Verification of Cryptographic Signature and Improper Certificate Validation in the OPC UA driver of Apache PLC4

Improper Validation of Unsafe Equivalence in Input vulnerability in Liquid Web / StellarWP GiveWP allows Authentication

The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and i

The Broken Link Notifier WordPress plugin before 2.0.0.1 does not re-validate the destination of redirects when checking

The Course Booking System WordPress plugin before 7.0.9 does not restrict access to its booking export, allowing unauthe