The leading open source vulnerability database

Instantly mitigate vulnerabilities in WordPress websites with Patchstack.

See pricing
Rated 4.9
Total55,872
Mitigations18,615
Stats
CVSS0
10
Affected software | Vulnerability
RiskDisclosed
HT Mega<= 3.2.7
Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability
7.1
1 hour ago
Newsmatic<= 1.5.0
Unauthenticated SQL Injection vulnerability
9.3
1 hour ago
Mapster WP Maps<= 2.0.5
Unauthenticated Stored Cross-Site Scripting vulnerability
7.1
1 hour ago
LiteSpeed Cache<= 7.9.1
Unauthenticated Stored Cross-Site Scripting vulnerability
7.1
1 hour ago
NewsmanApp<= 3.7.29
Unauthenticated Stored Cross-Site Scripting vulnerability
7.1
1 hour ago
Meta Box – WordPress Custom Fields Framework<= 5.15.2
Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability
6.5
1 hour ago
Everest Forms<= 3.6.2
Reflected Cross-Site Scripting vulnerability
7.1
1 hour ago
LiteSpeed Cache<= 7.9.1
Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability
6.5
1 hour ago
Greenshift<= 13.2.1
Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability
7.1
2 hours ago
Media LIbrary Assistant<= 3.42
Reflected Cross-Site Scripting vulnerability
7.1
2 hours ago
NEX-Forms<= 9.3.2
Unauthenticated Stored Cross-Site Scripting vulnerability
7.1
2 hours ago
Feedzy<= 5.2.12
Unauthenticated Stored Cross-Site Scripting vulnerability
7.1
2 hours ago
Extension for Leaflet Map<= 5.4
Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability
7.1
2 hours ago
systeminformation< 5.33.16
npm: systeminformation vulnerable to Windows command injection in services() through Unicode quotation marks
7.8
10 hours ago
@backstage/plugin-catalog-backend< 3.9.2
npm: Backstage catalog rules can be bypassed for URL locations using encoded path segments
6.5
10 hours ago
MW WP Form<= 5.1.7
Unauthenticated Sensitive Information Exposure in 'post_id' Parameter vulnerability
5.3
11 hours ago
@waline/vercel<= 1.40.3
npm: Waline login accepts a non-string email as a match-all MongoDB query
6.5
12 hours ago
seroval>= 1.6.0, < 1.6.11
npm: Seroval: Code injection through a typed array's own constructor property
5.3
12 hours ago
seroval< 1.0.0
npm: Seroval: Script injection through RegExp sources in serialized output
4.7
12 hours ago
seroval<= 1.6.7
npm: Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS)
7.5
12 hours ago