The leading open source vulnerability database

Instantly mitigate vulnerabilities in WordPress websites with Patchstack.

See pricing
Rated 4.9
Total50,604
Mitigations16,423
Stats
CVSS0
10
Affected software | Vulnerability
RiskDisclosed
Query Wrangler<= 1.5.57
Authenticated (Subscriber+) Remote Code Execution via 'options' Parameter vulnerability
8.8
4 minutes ago
Quiz And Survey Master<= 11.2.1
Authenticated (Contributor+) Stored Cross-Site Scripting via 'question_title' Parameter vulnerability
6.5
5 minutes ago
WooCommerce Product Table Lite<= 5.6.0
Unauthenticated CSS Injection via 'laptop_scroll_offset' Parameter vulnerability
5.3
10 minutes ago
Modal Survey<= 2.0.2.2.3
Insecure Direct Object References (IDOR) vulnerability
4.3
1 hour ago
Slider by 10Web<= 1.2.62
CSRF to Arbitrary File Deletion vulnerability
7.4
1 hour ago
Featured Video Plus<= 2.3.3
Cross Site Scripting (XSS) vulnerability
6.5
1 hour ago
WPZOOM Forms – Contact Form Plugin for Gutenberg<= 2.0.4
Cross Site Scripting (XSS) vulnerability
6.5
1 hour ago
Frontend Admin by DynamiApps<= 3.29.10
Cross Site Scripting (XSS) vulnerability
6.5
1 hour ago
Login With Ajax<= 4.5.1
Cross Site Scripting (XSS) vulnerability
6.5
1 hour ago
Video Conferencing with Zoom<= 4.6.8
Cross Site Scripting (XSS) vulnerability
6.5
1 hour ago
Wufoo Shortcode<= 1.55
Cross Site Scripting (XSS) vulnerability
6.5
1 hour ago
Typing Effect<= 1.3.7
Cross Site Scripting (XSS) vulnerability
6.5
1 hour ago
WP Tab Widget<= 1.2.11
Cross Site Scripting (XSS) vulnerability
6.5
1 hour ago
GeoDirectory<= 2.8.172
Cross Site Scripting (XSS) vulnerability
6.5
2 hours ago
Podlove Podcast Publisher<= 4.5.3
Authenticated (Contributor+) PHP Object Injection to Arbitrary File Deletion via 'unfurl_data' Parameter vulnerability
8.8
2 hours ago
PPWP<= 1.9.20
Insecure Direct Object Reference to Authenticated (Contributor+) Password Protected Post Password Update vulnerability
4.3
2 hours ago
ProfilePress<= 4.16.19
Authenticated (Subscriber+) Arbitrary Shortcode Execution via First Name / Last Name Profile Field vulnerability
5.4
2 hours ago
NEX-Forms<= 9.2.4
Authenticated (Admin+) SQL Injection via 'additional_params' Parameter vulnerability
7.6
2 hours ago
Bookly<= 27.7
WordPress Online Scheduling and Appointment Booking System - Bookly plugin <= 27.7 - Authenticated (Staff+) Insecure Direct Object Reference to Sensitive Information Exposure via 'params[id]' Parameter vulnerability
4.3
2 hours ago
Loco Translate<= 2.8.7
Authenticated (Translator+) Stored Cross-Site Scripting via PO File Extracted Comments vulnerability
6.5
2 hours ago