The leading open source vulnerability database

Instantly mitigate vulnerabilities in WordPress websites with Patchstack.

See pricing
Rated 4.9
Total50,692
Mitigations16,481
Stats
CVSS0
10
Affected software | Vulnerability
RiskDisclosed
SAML Single Sign On – SSO Login4.8.85-5.4.6
Unauthenticated Administrator Account Takeover via SAML Trust Anchor Overwrite vulnerability
8.8
20 minutes ago
PublishPress Series<= 2.17.0
Cross Site Scripting (XSS) vulnerability
5.9
9 hours ago
B2BKing<= 5.2.30
Broken Access Control vulnerability
5.4
9 hours ago
Media LIbrary Assistant<= 3.39
Cross Site Scripting (XSS) vulnerability
6.5
9 hours ago
HashBar – WordPress Notification Bar<= 2.0.0
Cross Site Request Forgery (CSRF) vulnerability
8.8
9 hours ago
Draft List<= 2.6.4
Cross Site Scripting (XSS) vulnerability
6.5
9 hours ago
meshcentral< 1.1.60
NPM: MeshCentral has unsanitized data fields
8.3
11 hours ago
magicmirror< 2.37.0
NPM: MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables
4.3
13 hours ago
@geolens/sdk< 1.2.3
NPM: GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data
7.5
13 hours ago
magicmirror< 2.37.0
NPM: MagicMirror: ssrf calendar .js
6.3
14 hours ago
magicmirror< 2.37.0
NPM: MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery
6.3
14 hours ago
magicmirror< 2.37.0
NPM: MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actions
2.3
14 hours ago
WP Travel Engine<= 6.8.4
Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'booking_id' Parameter vulnerability
7.5
14 hours ago
StoreEngine<= 2.1.1
Authenticated (Vendor+) Arbitrary File Read via Path Traversal in Downloadable File URL vulnerability
6.5
14 hours ago
ProSolution WP Client< 2.0.9
Subscriber+ SSRF via proSol_url_validate vulnerability
6.4
14 hours ago
WPC Admin Columns< 2.3.4
Subscriber+ Arbitrary User/Post/Term Meta Disclosure vulnerability
6.5
14 hours ago
WP Photo Album Plus< 9.2.07.002
Unauthenticated Arbitrary ZIP File Deletion via delmyzip Path Traversal vulnerability
5.3
14 hours ago
WP Photo Album Plus< 9.2.07.002
Reflected XSS via lbstart vulnerability
7.1
14 hours ago
WP Travel Engine< 6.8.5
Unauthenticated Booking Details Disclosure and Modification via wte_add_trip_to_cart vulnerability
6.5
14 hours ago
KiviCare< 4.5.2
Doctor/Receptionist+ SQL Injection via settings/listing REST Endpoint vulnerability
8.5
14 hours ago