The leading open source vulnerability database

Instantly mitigate vulnerabilities in WordPress websites with Patchstack.

See pricing
Rated 4.9
Total51,452
Mitigations16,817
Stats
CVSS0
10
Affected software | Vulnerability
RiskDisclosed
Gravity Forms<= 3.0.2
Unauthenticated Arbitrary File Upload via State/Chunk Hash Confusion vulnerability
9
1 minute ago
WPBakery Page Builder<= 8.7.4
Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter vulnerability
6.5
1 minute ago
Welcart e-Commerce<= 2.12.1
Unauthenticated Stored Cross-Site Scripting via 'custom_order' Parameter vulnerability
7.1
2 minutes ago
Nokri<= 1.6.6
WordPress Nokri - Job Board WordPress Theme plugin <= 1.6.6 - Unauthenticated Privilege Escalation via 'token' Parameter vulnerability
9.8
8 minutes ago
Simple Membership<= 4.8.1
Unauthenticated Authentication Bypass to Administrator Account Takeover via Multisite Identity Binding vulnerability
9.8
9 minutes ago
FS Poster<= 8.0.1
Authenticated (Subscriber+) Remote Code Execution via FFmpeg Path Setting vulnerability
8.8
10 minutes ago
WP Recipe Maker Premium<= 10.5.0
Authenticated (Contributor+) Stored Cross-Site Scripting via 'wprm-call-to-action' Shortcode vulnerability
6.5
27 minutes ago
Page Builder: Live Composer<= 2.1.19
Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_testimonials_output Shortcode vulnerability
6.5
28 minutes ago
Page Builder: Live Composer<= 2.1.19
Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_projects_output Shortcode vulnerability
6.5
29 minutes ago
decode-uri-component<= 0.4.2
NPM: decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input
6.6
9 hours ago
engine.io>= 6.5.0, < 6.6.7
NPM: Socket.IO: Engine.IO WebTransport SID DoS
7.5
9 hours ago
@hono/oauth-providers< 0.8.6
NPM: @hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking
5.4
10 hours ago
WCFM Marketplace<= 3.8.2
Cross Site Scripting (XSS) vulnerability
6.5
12 hours ago
Breakdance<= 2.8.1
Unauthenticated Broken Access Control in Design Library Import vulnerability
6.5
13 hours ago
Profile Builder<= 4.0.0
Unauthenticated Stored Cross-Site Scripting via 'email' Parameter vulnerability
7.1
13 hours ago
Charitable<= 1.8.12.1
Authenticated (Contributor+) SQL Injection via 'order' Shortcode Attribute vulnerability
8.5
13 hours ago
Blocksy Companion<= 2.1.51
Authenticated (Author+) Stored Cross-Site Scripting via 'tagName' Block Attribute (blocksy/dynamic-data) vulnerability
5.9
13 hours ago
BetterDocs<= 4.8.1
Authenticated (Contributor+) Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content vulnerability
6.5
13 hours ago
Frontend Admin by DynamiApps<= 3.29.12
Unauthenticated Arbitrary File Deletion via Path Traversal via custom_directory_name Merge Tag vulnerability
8.6
14 hours ago
Support Genix<= 1.4.52
Authenticated (Subscriber+) Authentication Bypass to Administrator Account Takeover via 'p' Parameter Forged Guest Token vulnerability
8.8
14 hours ago