The leading open source vulnerability database

Instantly mitigate vulnerabilities in WordPress websites with Patchstack.

See pricing
Rated 4.9
Total51,155
Mitigations16,673
Stats
CVSS0
10
Affected software | Vulnerability
RiskDisclosed
ManageWP Worker< 4.9.37
Unauthenticated Authentication Bypass vulnerability
9.8
41 minutes ago
FiboSearch< 1.34.1
Unauthenticated Password-Protected Product Information Disclosure vulnerability
7.5
48 minutes ago
Limit Login Attempts Reloaded< 3.3.5
Username Denylist Bypass vulnerability
3.7
49 minutes ago
All-in-One WP Migration<= 7.109
Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution vulnerability
8.8
53 minutes ago
ShopEngine<= 4.9.4
Authenticated (Shop Manager+) Privilege Escalation to WXR Import 'plugin <wp_option>' Nodes vulnerability
7.2
54 minutes ago
Metform<= 4.1.8
Authenticated (Contributor+) Stored Cross-Site Scripting via 'mf_form_id' Widget Setting vulnerability
6.5
1 hour ago
eCommerce Product Catalog<= 3.5.10
Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute vulnerability
6.5
1 hour ago
@platejs/media>= 53.0.0, < 53.1.4
NPM: Plate: Media embed provider metadata can bypass URL sanitization and execute iframe JavaScript
8.7
1 hour ago
browse-mcp<= 0.8.1
NPM: browse-mcp has an arbitrary file write via unconfined download and state paths
8.6
1 hour ago
Newsletters<= 4.17
Authenticated (Author+) Arbitrary Modification via 'newsletters_mailinglistsroles' POST Parameter vulnerability
4.3
1 hour ago
Media Sweep – WordPress Media Cleaner<= 1.1.3
Authenticated (Administrator+) SQL Injection via 'fields' Parameter vulnerability
7.6
1 hour ago
My Agile Privacy<= 3.3.6
Missing Authorization to Unauthenticated Plugin Settings Modification via map_missing_cookie_shield / map_check_consent_mode_status AJAX Actions vulnerability
5.3
1 hour ago
urllib<= 2.44.0
NPM: urllib's cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakage
7.5
1 hour ago
pickem< 1.0.7
NPM: pickem vulnerable to terminal escape-sequence injection via unsanitized item text
8.6
1 hour ago
Drag and Drop Multiple File Upload for WooCommerce< 1.1.8
Unauthenticated File Deletion via Nonce Oracle vulnerability
6.5
4 hours ago
Insert or Embed Articulate Content into WordPress<= 4.3000000027
Editor+ Arbitrary File Upload vulnerability
9.1
4 hours ago
MStore API< 4.21.0
Subscriber+ Order and Customer PII Disclosure via IDOR vulnerability
4.3
4 hours ago
GEO my WordPress< 4.5.5.3
Subscriber+ Arbitrary Geolocation Record Modification and Deletion via IDOR vulnerability
4.3
4 hours ago
Simply Schedule Appointments< 1.6.12.11
Contributor+ Sensitive Data Disclosure via Admin Shortcode vulnerability
4.3
4 hours ago
LatePoint< 5.6.8
Unauthenticated Booking Object Mass Assignment via Public Booking Funnel vulnerability
5.3
4 hours ago