The leading open source vulnerability database

Instantly mitigate vulnerabilities in WordPress websites with Patchstack.

See pricing
Rated 4.9
Total50,494
Mitigations16,372
Stats
CVSS0
10
Affected software | Vulnerability
RiskDisclosed
Contest Gallery<= 30.0.7
Authenticated (Author+) Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cg_multiple_files_for_post' -> 'cgRealId' vulnerability
7.6
8 minutes ago
Beaver Builder<= 2.10.2.2
Authenticated (Author+) Stored Cross-Site Scripting via Button Module 'button' Parameter vulnerability
5.9
8 minutes ago
Image Uploader for Welcart<= 1.4.6
Authenticated (Author+) SQL Injection via Attachment 'post_title' Parameter vulnerability
7.6
10 minutes ago
Pinpoint Booking System<= 2.9.9.6.8
Unauthenticated Improper Input Validation to Price Manipulation via 'cart_data' Parameter vulnerability
5.3
11 minutes ago
Booking calendar, Appointment Booking System<= 3.2.36
Missing Authorization to Unauthenticated Arbitrary Modification via wpdevart_payment AJAX Action vulnerability
5.3
13 minutes ago
Propovoice CRM<= 1.7.8
Authenticated (ndpv_manager+) Privilege Escalation via 'role' Parameter vulnerability
7.2
16 minutes ago
MaxUpload<= 1.4.0
Unauthenticated Arbitrary File Upload via 'resumableFilename' Parameter vulnerability
10
22 minutes ago
Online Booking & Scheduling Calendar for WordPress by vcita<= 4.6.0
Unauthenticated Stored Cross-Site Scripting via REST API 'business_id' Parameter vulnerability
7.1
40 minutes ago
Profile Builder<= 3.16.4
Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter vulnerability
9.8
2 hours ago
Object Sync for Salesforce<= 2.2.13
Unauthenticated SQL Injection vulnerability
9.3
2 hours ago
6Storage Rentals<= 2.27.0
Unauthenticated Account Takeover via 'email' Parameter vulnerability
9.8
2 hours ago
bLoyal<= 3.1.611.78
Authenticated (Subscriber+) Privilege Escalation via Unprotected AJAX API URL Settings vulnerability
8.8
3 hours ago
RapiSafe – Secure Multi File Upload for Contact Form 7<= 1.0.4
Unauthenticated Arbitrary File Deletion via 'rsmfcf7_session' and 'file_name' Parameters vulnerability
8.6
3 hours ago
User Session Synchronizer<= 1.4.0
Unauthenticated Authentication Bypass to Account Takeover via 'ussync-key', 'ussync-token', and 'ussync-ref' Parameters vulnerability
9.8
3 hours ago
Frontend Admin by DynamiApps< 3.29.9
Unauthenticated Stored Cross-Site Scripting vulnerability
7.1
3 hours ago
Kirki< 6.0.13
Unauthenticated SQL Injection vulnerability
9.3
3 hours ago
miniOrange's Google Authenticator< 6.2.6
2FA Bypass vulnerability
8.1
4 hours ago
Pods3.3-3.3.9
Unauthenticated Privilege Escalation vulnerability
9.8
2 days ago
@ooples/token-optimizer-mcp< 5.1.0
NPM: Token Optimizer MCP: Unauthenticated Path Traversal in Dashboard Session Log API Endpoints
5.3
2 days ago
@ooples/token-optimizer-mcp< 5.1.0
NPM: Token Optimizer MCP: OS command injection in smart_user via username in get-user-info
8.4
2 days ago