The leading open source vulnerability database

Instantly mitigate vulnerabilities in WordPress websites with Patchstack.

See pricing
Rated 4.9
Total55,977
Mitigations18,670
Stats
CVSS0
10
Affected software | Vulnerability
RiskDisclosed
Gravity Forms<= 3.1.2
Unauthenticated Stored Cross-Site Scripting vulnerability
7.1
1 hour ago
Gravity Forms<= 3.1.2
Unauthenticated PHP Object Injection vulnerability
9.8
1 hour ago
Food Store – Online Food Delivery & Pickup<= 1.5.5
Unauthenticated Stored Cross-Site Scripting vulnerability
7.1
1 hour ago
AI Engine<= 3.8.6
Missing Authorization to Administrator Account Takeover vulnerability
7.5
1 hour ago
Forminator<= 1.55.0.2
Unauthenticated Limited File Deletion vulnerability
6.5
3 hours ago
Import Export WordPress Users<= 2.7.5
Authenticated (Subscriber+) Privilege Escalation vulnerability
8.8
3 hours ago
Content Egg<= 12.0.0
Missing Authorization to Authenticated (Author+) Administrator-Authored Post Creation vulnerability
4.3
3 hours ago
Cool Formkit Lite<= 2.7.9
Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting vulnerability
6.5
3 hours ago
Content Egg<= 12.0.0
Missing Authorization to Authenticated (Contributor+) Arbitrary Post Meta Modification vulnerability
4.3
3 hours ago
Events Made Easy<= 3.3.1
Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
6.5
3 hours ago
JoomSport<= 5.7.14
Authenticated (Contributor+) SQL Injection vulnerability
8.5
3 hours ago
decode-uri-component<= 0.5.0
npm: decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs
8.2
4 hours ago
vite6.4.4
npm: Vite: `server.fs.deny` bypassed with queries
6.9
4 hours ago
@eeacms/volto-chatbot<= 2.0.3
npm: @eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxy
8.2
4 hours ago
@cedar-policy/cedar-wasm>= 3.2.0, < 3.4.3
npm: Cedar: JSON template is in scope missing slot-id validation allows link panic and decision divergence
2.1
4 hours ago
@sylphx/pdf-reader-mcp>= 2.2.0, < 3.0.1
npm: @sylphx/pdf-reader-mcp: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY
7.5
4 hours ago
parse-server<= 8.6.83
npm: Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist
2.1
4 hours ago
Kirki<= 6.4.0
Content Injection vulnerability
4.3
5 hours ago
Document Library Lite<= 1.3.0
Sensitive Data Exposure vulnerability
5.3
5 hours ago
The Plus Addons for Elementor Page Builder Lite<= 6.5.3
Cross Site Scripting (XSS) vulnerability
6.5
5 hours ago