The leading open source vulnerability database

Instantly mitigate vulnerabilities in WordPress websites with Patchstack.

See pricing
Rated 4.9
Total50,518
Mitigations16,391
Stats
CVSS0
10
Affected software | Vulnerability
RiskDisclosed
@medplum/core<= 5.1.5
NPM: Medplum: Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage
7.1
1 hour ago
deepmerge-ts< 8.0.0
NPM: DeepmergeTS has stack exhaustion when merging recursive object graphs
8.2
1 hour ago
TrueBooker<= 1.2.6
Unauthenticated Account Takeover via Insecure Direct Object Reference in 'truebooker_wp_user_id' Parameter vulnerability
9.8
2 hours ago
Wholesale Market<= 2.2.2
Authenticated (Subscriber+) Privilege Escalation via 'role_required' Parameter vulnerability
8.8
2 hours ago
KiviCare<= 4.5.1
Authenticated (Doctor+) SQL Injection via 'searchTerm' Parameter vulnerability
8.5
3 hours ago
Groundhogg<= 4.5.14
Authenticated (Vendor+) SQL Injection via 'tag_query' Parameter vulnerability
8.5
3 hours ago
Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant<= 5.1
Unauthenticated Stored Cross-Site Scripting via 'action' Parameter vulnerability
7.1
3 hours ago
Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant<= 5.1
Authenticated (Editor+) SQL Injection via Pattern JSON Keys/Values vulnerability
7.6
3 hours ago
Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant<= 5.1
Authenticated (Editor+) SQL Injection via 'key' Parameter vulnerability
7.6
3 hours ago
Form Maker by 10Web<= 1.15.44
Authenticated (Subscriber+) SQL Injection via '{username}' Placeholder in Dynamic-Choice Field WHERE Clause vulnerability
8.5
3 hours ago
Hydra Booking<= 1.2.2
Authenticated (Host+) Stored Cross-Site Scripting via 'first_name' Parameter vulnerability
6.5
3 hours ago
WP Cookie Notice for GDPR, CCPA & ePrivacy Consent<= 4.3.5
Authenticated (Subscriber+) Stored Cross-Site Scripting via 'regionArray' Parameter vulnerability
6.5
3 hours ago
Contest Gallery<= 30.0.7
Authenticated (Author+) Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cg_multiple_files_for_post' -> 'cgRealId' vulnerability
7.6
3 hours ago
Beaver Builder<= 2.10.2.2
Authenticated (Author+) Stored Cross-Site Scripting via Button Module 'button' Parameter vulnerability
5.9
3 hours ago
Image Uploader for Welcart<= 1.4.6
Authenticated (Author+) SQL Injection via Attachment 'post_title' Parameter vulnerability
7.6
3 hours ago
Pinpoint Booking System<= 2.9.9.6.8
Unauthenticated Improper Input Validation to Price Manipulation via 'cart_data' Parameter vulnerability
5.3
4 hours ago
Booking calendar, Appointment Booking System<= 3.2.36
Missing Authorization to Unauthenticated Arbitrary Modification via wpdevart_payment AJAX Action vulnerability
5.3
4 hours ago
Propovoice CRM<= 1.7.8
Authenticated (ndpv_manager+) Privilege Escalation via 'role' Parameter vulnerability
7.2
4 hours ago
MaxUpload<= 1.4.0
Unauthenticated Arbitrary File Upload via 'resumableFilename' Parameter vulnerability
10
4 hours ago
Online Booking & Scheduling Calendar for WordPress by vcita<= 4.6.0
Unauthenticated Stored Cross-Site Scripting via REST API 'business_id' Parameter vulnerability
7.1
4 hours ago