The leading open source vulnerability database

Instantly mitigate vulnerabilities in WordPress websites with Patchstack.

See pricing
Rated 4.9
Total57,073
Mitigations19,281
Stats
CVSS0
10
Affected software | Vulnerability
RiskDisclosed
WP Remote Users Sync< 2.2.1
Privilege Escalation to Administrator vulnerability
7.5
9 minutes ago
WP Ultimate CSV Importer< 9.2
Multisite Subsite Admin+ Network-Wide PHP Code Execution vulnerability
7.2
1 hour ago
Essential Real Estate5.3.5-5.3.5
Customer+ Email Relay Allowlist Poisoning vulnerability
4.3
1 hour ago
WP Remote Users Sync< 2.2.1
Subscriber+ Activity Log Deletion vulnerability
4.3
1 hour ago
AppPresser< 5.0.0
Unauthenticated Plugin and Theme Version Disclosure vulnerability
5.3
1 hour ago
Contact Form 7< 6.2.5
Editor+ Sensitive User Data Disclosure vulnerability
4.5
1 hour ago
hono< 4.13.16
npm: Hono: `csrf()` does not check requests sent by hyperlink auditing (`text/ping`)
5.3
8 hours ago
hono>= 4.5.1, <= 4.13.15
npm: Hono: `validator('form')` skips validation for `multipart/form-data` requests with extra parameters
5.3
8 hours ago
hono< 4.13.16
npm: Hono: `mount()` and `app.mount()` can forward a path that bypasses middleware scoped inside the mount prefix
5.3
8 hours ago
hono>= 4.1.4, <= 4.13.15
npm: Hono: RegExpRouter skips wildcard middleware for some route sets and for paths with an encoded line terminator
5.3
8 hours ago
hono>= 3.12.0, <= 4.13.15
npm: Hono: `css` helper does not escape a closing tag split between the template and an interpolated value, allowing HTML injection
3.4
8 hours ago
@grpc/grpc-js-xds< 1.13.2
npm: @grpc/grpc-js: safe_regex incorrectly applies partial string matching for patterns with alternation
4.8
8 hours ago
@grpc/grpc-js-xds>= 1.14.0, < 1.14.2
npm: @grpc/grpc-js: RBAC override configs in VirtualHost and Route resources are not applied
6.9
8 hours ago
@astrojs/solid-js>= 0.2.0, <= 7.1.1
npm: Astro: Reflected XSS via unescaped slot names in @astrojs/solid-js
2.3
9 hours ago
@astrojs/svelte>= 5.7.3, <= 9.1.1
npm: Astro: Reflected XSS via unescaped slot names in @astrojs/svelte
2.3
9 hours ago
basic-ftp<= 6.2.2
npm: basic-ftp: Uncaught exception crashes the Node.js process when a password (or resumed-download path) contains CR/LF
5.9
9 hours ago
basic-ftp<= 6.2.3
npm: basic-ftp: Uncaught TypeError in MLSD directory-listing parser via __proto__ fact name causes DoS in Client.list()
5.3
10 hours ago
@hono/node-server>= 2.0.0, < 2.1.6
npm: @hono/node-server: Unhandled `ECONNRESET` on the socket during an asynchronous WebSocket upgrade crashes the process
5.3
10 hours ago
@hono/node-server< 1.19.18
npm: @hono/node-server: Backslash in the request path is parsed as a path separator, bypassing path-based access control at a reverse proxy
5.3
10 hours ago
Customer Reviews for WooCommerce<= 5.127.0
Unauthenticated Sensitive Information Exposure in 'search' Parameter vulnerability
5.3
10 hours ago