The leading open source vulnerability database

Instantly mitigate vulnerabilities in WordPress websites with Patchstack.

See pricing
Rated 4.9
Total50,723
Mitigations16,510
Stats
CVSS0
10
Affected software | Vulnerability
RiskDisclosed
BNE Testimonials< 2.0.8.2
Contributor+ Stored XSS via Slider Shortcode vulnerability
6.5
6 minutes ago
HUSKY< 1.4.1
WordPress HUSKY - Products Filter Professional for WooCommerce plugin < 1.4.1 - Shop Manager+ Local File Inclusion via meta_filter search_view vulnerability
7.2
7 minutes ago
s2Member< 260805
Contributor+ Stored XSS via Shortcode vulnerability
6.5
8 minutes ago
Nested Pages< 3.2.15
Editor+ Stored XSS via Post Title vulnerability
6.5
8 minutes ago
Customer Reviews for WooCommerce< 5.116.0
Subscriber+ Missing Authorization via Multiple Settings AJAX Actions vulnerability
5.4
9 minutes ago
Contact Form Entries< 1.5.5
Authenticated SQL Injection via id Parameter vulnerability
7.6
11 minutes ago
Quiz And Survey Master< 11.2.2
Contributor+ Stored XSS via Polar Question vulnerability
6.5
12 minutes ago
Advanced Excerpt< 4.5
Admin+ Stored XSS via Ellipsis Setting vulnerability
5.9
13 minutes ago
Google Authenticator< 0.56
2FA Secret Overwrite via CSRF vulnerability
5.4
13 minutes ago
WP Cafe Pro< 3.0.15
Local File Inclusion vulnerability
6.6
2 hours ago
SAML Single Sign On – SSO Login4.8.85-5.4.6
Unauthenticated Administrator Account Takeover via SAML Trust Anchor Overwrite vulnerability
8.8
4 hours ago
PublishPress Series<= 2.17.0
Cross Site Scripting (XSS) vulnerability
5.9
13 hours ago
B2BKing<= 5.2.30
Broken Access Control vulnerability
5.4
13 hours ago
Media LIbrary Assistant<= 3.39
Cross Site Scripting (XSS) vulnerability
6.5
13 hours ago
HashBar – WordPress Notification Bar<= 2.0.0
Cross Site Request Forgery (CSRF) vulnerability
8.8
14 hours ago
Draft List<= 2.6.4
Cross Site Scripting (XSS) vulnerability
6.5
14 hours ago
meshcentral< 1.1.60
NPM: MeshCentral has unsanitized data fields
8.3
15 hours ago
magicmirror< 2.37.0
NPM: MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables
4.3
18 hours ago
@geolens/sdk< 1.2.3
NPM: GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data
7.5
18 hours ago
magicmirror< 2.37.0
NPM: MagicMirror: ssrf calendar .js
6.3
18 hours ago