The leading open source vulnerability database

Instantly mitigate vulnerabilities in WordPress websites with Patchstack.

See pricing
Rated 4.9
Total52,166
Mitigations17,052
Stats
CVSS0
10
Affected software | Vulnerability
RiskDisclosed
@zereight/mcp-gitlab>= 0.0.1, < 2.1.27
NPM: @zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery
9.6
51 minutes ago
@zereight/mcp-gitlab< 2.1.30
NPM: @zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport
9.6
54 minutes ago
@zereight/mcp-gitlab< 2.1.30
NPM: @zereight/mcp-gitlab has multiple safety-control bypasses: execute_graphql read-only + allow-list bypass, unauthenticated transports, session-exhaustion DoS
8.1
1 hour ago
Admin Menu Editor Pro2.35-2.36
Backdoor vulnerability
10
4 hours ago
Bookly<= 28.1
Insecure Direct Object Reference to Unauthenticated Sensitive Data Access and Message Injection via 'conversation_id' Parameter vulnerability
7.5
5 hours ago
Bold Page Builder<= 5.9.6
Authenticated (Contributor+) Stored Cross-Site Scripting via 'shortcode_content' Parameter vulnerability
6.5
6 hours ago
WP-Lister Lite for eBay<= 3.8.9
Unauthenticated Stored Cross-Site Scripting via AJAX Cron Handler Request vulnerability
7.1
6 hours ago
JetFormBuilder<= 3.6.2
Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter
9.8
6 hours ago
Advanced Popups<= 1.2.3
Authenticated (Author+) Stored Cross-Site Scripting via 'Notification Button Link' Field vulnerability
5.9
6 hours ago
Ad Inserter<= 2.8.16
Missing Authorization to Unauthenticated Header/Footer Code Disclosure via 'ai-debug-code' Parameter vulnerability
5.3
6 hours ago
Contest Gallery<= 32.0.1
Unauthenticated Arbitrary File Upload via 'baseUrlForFacebook' Parameter vulnerability
8.8
6 hours ago
TrueBooker<= 1.2.3
Privilege Escalation vulnerability
9.8
6 hours ago
Hotel Booking Lite<= 6.2.4
Unauthenticated Stored Cross-Site Scripting vulnerability
7.1
14 hours ago
Consulting<= 6.7.16
WordPress Consulting - Business, Finance WordPress Theme theme <= 6.7.16 - Authenticated (Subscriber+) Privilege Escalation vulnerability
9.8
15 hours ago
Advanced Custom Fields: Extended PRO<= 0.9.2.6
Unauthenticated Remote Code Execution vulnerability
10
15 hours ago
Jobs for WordPress<= 2.8.1
Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
6.5
1 day ago
AI Engine<= 3.7.7
Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Attachment Disclosure via 'mediaId' Parameter vulnerability
6.5
1 day ago
WP Event Solution<= 4.1.23
WordPress Eventin - Event Calendar, Tickets, Registration, Booking & WooCommerce plugin <= 4.1.23 - Authenticated (Subscriber+) Privilege Escalation via map_meta_cap Filter vulnerability
7.5
1 day ago
WP Event Solution<= 4.1.23
Authenticated (Contributor+) Stored Cross-Site Scripting via 'etn_shedule_objective' schedule_slot Parameter vulnerability
6.5
1 day ago
PublishPress Authors<= 4.15.0
Authenticated (Author+) Stored Cross-Site Scripting vulnerability
5.9
1 day ago