The leading open source vulnerability database

Instantly mitigate vulnerabilities in WordPress websites with Patchstack.

See pricing
Rated 4.9
Total50,628
Mitigations16,424
Stats
CVSS0
10
Affected software | Vulnerability
RiskDisclosed
Kirki<= 6.1.1
Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' Parameter vulnerability
4.9
19 minutes ago
Gallery <= 4.7.9
Authenticated (Editor+) SQL Injection via Gallery Image Order Array Keys vulnerability
8.5
24 minutes ago
Bold Page Builder<= 5.6.8
Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
6.5
26 minutes ago
Forminator<= 1.55.0.2
Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'draft' Parameter vulnerability
5.3
26 minutes ago
WP Compress<= 7.10.09
Cross-Site Request Forgery to Arbitrary Options Deletion vulnerability
4.3
27 minutes ago
WC Vendors Marketplace<= 2.7.0
Authenticated (Shop Manager+) SQL Injection via 'status' Parameter vulnerability
7.6
29 minutes ago
YouTube Showcase<= 4.0.4
Authenticated (Author+) Stored Cross-Site Scripting via Attachment 'post_title' via emd_mb_meta Shortcode vulnerability
5.9
29 minutes ago
WooCommerce POS<= 1.9.14
Authenticated (Shop Manager+) Code Injection via 'thermal' Template Engine vulnerability
7.2
29 minutes ago
User Login History<= 2.1.7
Authenticated (Administrator+) SQL Injection via 'blog_id' Parameter vulnerability
7.6
30 minutes ago
Turnkey bbPress<= 1.7.1
Authenticated (Administrator+) PHP Object Injection vulnerability
7.2
30 minutes ago
Toocheke Companion<= 2.10
Authenticated (Contributor+) Stored Cross-Site Scripting via 'series_bg_color' Post Meta vulnerability
6.5
31 minutes ago
SureDash<= 1.10.3
Authenticated (Contributor+) Stored Cross-Site Scripting via 'draweropenverposition' Block/Shortcode Attribute vulnerability
6.5
33 minutes ago
Smash Balloon Social Post Feed<= 4.9.0
Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute vulnerability
6.5
36 minutes ago
Snippet Shortcodes<= 5.2.0
Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes vulnerability
6.5
36 minutes ago
Slider Hero<= 9.1.7
Authenticated (Administrator+) SQL Injection via 'description' Slide Field (Second-Order via Duplicate) vulnerability
7.6
37 minutes ago
Serious Slider<= 1.4.0
Authenticated (Contributor+) Stored Cross-Site Scripting via 'theme' Shortcode Attribute vulnerability
6.5
37 minutes ago
ShortPixel Adaptive Images<= 3.11.5
Missing Authorization to Authenticated (Subscriber+) Third-Party Plugin Option Modification via 'causer' Parameter vulnerability
4.3
37 minutes ago
Royal Elementor Addons<= 1.7.1064
Authenticated (Contributor+) Server-Side Request Forgery via Form Builder Widget 'webhook_url' Setting vulnerability
6.4
38 minutes ago
Query Wrangler<= 1.5.57
Authenticated (Subscriber+) Remote Code Execution via 'options' Parameter vulnerability
8.8
39 minutes ago
Quiz And Survey Master<= 11.2.1
Authenticated (Contributor+) SQL Injection via 'randon_category' Quiz Option vulnerability
8.5
39 minutes ago