The leading open source vulnerability database

Instantly mitigate vulnerabilities in WordPress websites with Patchstack.

See pricing
Rated 4.9
Total50,795
Mitigations16,542
Stats
CVSS0
10
Affected software | Vulnerability
RiskDisclosed
ChamaWP< 1.0.13
Unauthenticated Arbitrary User Password Reset vulnerability
9.8
4 minutes ago
Clearfy Cache< 2.4.3
Admin+ PHP Object Injection via Settings Import vulnerability
7.2
6 minutes ago
Filter & Grids< 3.12.9
Author+ Stored XSS via SVG Icon Upload vulnerability
5.9
7 minutes ago
Sunshine Photo Cart< 3.6.12
Unauthenticated Private Gallery Comment Disclosure vulnerability
5.3
7 minutes ago
PowerPress Podcasting< 11.16.11
Contributor+ Stored XSS via Podcast Episode Chapters URL vulnerability
6.5
8 minutes ago
Classified Listing< 5.4.4
Contributor+ Unpublished Post Content Disclosure via rtcl_block_css_get_posts vulnerability
4.3
23 minutes ago
Newsletters< 4.16
Unauthenticated PHP Object Injection via Date Form Field vulnerability
9.8
23 minutes ago
Estatik< 4.3.3
Login CSRF vulnerability
4.3
35 minutes ago
Ajax Search Lite< 4.14.5
Unauthenticated PHP Object Injection via Search Statistics REST Endpoint vulnerability
9.8
35 minutes ago
Estatik< 4.3.4
Unauthenticated Arbitrary-Recipient Mail Relay via Signed-Value Mismatch vulnerability
5.8
56 minutes ago
@tinacms/cli< 2.5.2
NPM: Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root
6.5
9 hours ago
next-tinacms-s3< 23.0.4
NPM: Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)
5.4
9 hours ago
next-tinacms-dos< 23.0.4
NPM: Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)
5.4
9 hours ago
next-tinacms-azure< 14.0.4
NPM: Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)
5.4
9 hours ago
next-tinacms-cloudinary< 26.0.4
NPM: Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)
5.4
9 hours ago
@logto/tunnel<= 0.3.8
NPM: logto-tunnel serves files outside --experience-path via path traversal
8.7
11 hours ago
mcp-searxng< 1.12.0
NPM: SearXNG Basic Authentication Credentials Exposed Through MCP Logs and JSON-RPC Error Responses
5.5
12 hours ago
mcp-searxng< 1.2.1
NPM: SearXNG MCP Server: Additional hardened-mode SSRF bypasses
6.3
12 hours ago
mcp-searxng< 1.2.1
NPM: SearXNG MCP Server is Vulnerable to SSRF in web_url_read: the internal-address guard is disabled by default (MCP_HTTP_HARDEN off)
6.5
12 hours ago
@contentful/mcp-server< 1.7.19
NPM: Contentful MCP Server: export_space/import_space tools pass LLM-controlled `host`/`proxy` args to CMA client, redirecting server PAT to attacker-controlled endpoint
7.7
12 hours ago