The leading open source vulnerability database

Instantly mitigate vulnerabilities in WordPress websites with Patchstack.

See pricing
Rated 4.9
Total51,710
Mitigations16,885
Stats
CVSS0
10
Affected software | Vulnerability
RiskDisclosed
Abandoned Cart Pro for WooCommerce<= 10.7.1
Missing Authorization to Authenticated (Subscriber+) Privilege Escalation vulnerability
8.8
9 minutes ago
Gravity Forms<= 2.10.5
Unauthenticated Stored Cross-Site Scripting via Post Body Field Value vulnerability
7.1
9 minutes ago
W3 Total Cache<= 2.10.5
Unauthenticated Stored Cross-Site Scripting via LazyLoad Background Mutator vulnerability
7.1
10 minutes ago
Ninja Forms<= 3.15.1
Unauthenticated Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key vulnerability
7.1
11 minutes ago
Spam protection, AntiSpam, FireWall by CleanTalk<= 6.86
Unauthenticated Stored Cross-Site Scripting via Comment Content aria-label Placeholder vulnerability
7.1
15 minutes ago
Divi<= 4.27.6
Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Slider 'image_src' Shortcode Parameter vulnerability
6.5
19 minutes ago
Divi<= 4.27.6
Authenticated (Contributor+) Server-Side Request Forgery via 'image_src' Parameter vulnerability
4.9
20 minutes ago
Hummingbird<= 3.21.0
WordPress Hummingbird - Speed Optimization, Caching, Minify, Compress & CDN plugin <= 3.21.0 - Unauthenticated Remote Code Execution via Cookie Name in Page Cache Debug Log vulnerability
9
23 minutes ago
DearFlip<= 2.4.30
Authenticated (Contributor+) Stored Cross-Site Scripting via '.dvcss' Element Class Attribute vulnerability
6.5
25 minutes ago
Theme My Login<= 7.1.15
Authenticated (Subscriber+) Missing Authorization to Unauthorized Multisite Subsite Creation via 'gimmeanotherblog' Signup Stage vulnerability
4.3
25 minutes ago
MStore API<= 4.20.0
Unauthenticated Authentication Bypass via 'id_token' Parameter JWT Forgery vulnerability
9.8
26 minutes ago
DearFlip<= 2.4.30
Authenticated (Contributor+) Stored Cross-Site Scripting via '.df-element' Element Inner HTML vulnerability
6.5
26 minutes ago
WP Social Chat<= 8.6.2
Authenticated (Contributor+) Stored Cross-Site Scripting via 'consent_message' JSON Attribute in .qlwapp data-box vulnerability
6.5
26 minutes ago
Welcart e-Commerce<= 2.12.1
Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callback vulnerability
8.6
27 minutes ago
Events Manager<= 7.3.3
WordPress Events Manager - Calendar, Bookings, Tickets, and more! plugin <= 7.3.3 - Unauthenticated Stored Cross-Site Scripting via Event Attributes vulnerability
5.9
38 minutes ago
deepseek-tui>= 0.8.6, < 0.8.41
NPM: CodeWhale: Project config `allow_shell` override enables arbitrary shell command execution via cloned repository
7.8
1 hour ago
codewhale>= 0.8.41, < 0.8.64
NPM: CodeWhale: Project config `allow_shell` override enables arbitrary shell command execution via cloned repository
7.8
1 hour ago
deepseek-tui>= 0.8.33, < 0.8.41
NPM: CodeWhale: rlm_eval auto-approves arbitrary Python execution, bypassing the user's approval policy (RCE)
7.8
1 hour ago
codewhale>= 0.8.41, < 0.8.64
NPM: CodeWhale: rlm_eval auto-approves arbitrary Python execution, bypassing the user's approval policy (RCE)
7.8
1 hour ago
deepseek-tui>= 0.3.27, < 0.8.41
NPM: CodeWhale: Argument Injection in `git_blame` Tool Allows Arbitrary File Read Without Approval
7.4
1 hour ago