The leading open source vulnerability database

Instantly mitigate vulnerabilities in WordPress websites with Patchstack.

See pricing
Rated 4.9
Total50,654
Mitigations16,445
Stats
CVSS0
10
Affected software | Vulnerability
RiskDisclosed
Nexter Blocks< 5.0.2
Author+ Stored XSS via SVG Upload vulnerability
5.9
8 minutes ago
GeoDirectory< 2.8.110
Editor+ Stored XSS via Place Categories vulnerability
6.5
9 minutes ago
ARForms Form Builder<= 1.8.5
WordPress Contact Form, Survey, Quiz & Popup Form Builder - ARForms plugin <= 1.8.5 - Unauthenticated PHP Object Injection vulnerability
9.8
1 hour ago
Kirki<= 6.1.1
Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'context' Parameter vulnerability
4.3
1 hour ago
Kirki<= 6.1.1
Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' Parameter vulnerability
4.9
2 hours ago
Gallery <= 4.7.9
Authenticated (Editor+) SQL Injection via Gallery Image Order Array Keys vulnerability
8.5
2 hours ago
Bold Page Builder<= 5.6.8
Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
6.5
2 hours ago
Forminator<= 1.55.0.2
Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'draft' Parameter vulnerability
5.3
2 hours ago
WP Compress<= 7.10.09
Cross-Site Request Forgery to Arbitrary Options Deletion vulnerability
4.3
2 hours ago
WC Vendors Marketplace<= 2.7.0
Authenticated (Shop Manager+) SQL Injection via 'status' Parameter vulnerability
7.6
2 hours ago
YouTube Showcase<= 4.0.4
Authenticated (Author+) Stored Cross-Site Scripting via Attachment 'post_title' via emd_mb_meta Shortcode vulnerability
5.9
2 hours ago
WooCommerce POS<= 1.9.14
Authenticated (Shop Manager+) Code Injection via 'thermal' Template Engine vulnerability
7.2
2 hours ago
User Login History<= 2.1.7
Authenticated (Administrator+) SQL Injection via 'blog_id' Parameter vulnerability
7.6
2 hours ago
Turnkey bbPress<= 1.7.1
Authenticated (Administrator+) PHP Object Injection vulnerability
7.2
2 hours ago
Toocheke Companion<= 2.10
Authenticated (Contributor+) Stored Cross-Site Scripting via 'series_bg_color' Post Meta vulnerability
6.5
2 hours ago
SureDash<= 1.10.3
Authenticated (Contributor+) Stored Cross-Site Scripting via 'draweropenverposition' Block/Shortcode Attribute vulnerability
6.5
2 hours ago
Smash Balloon Social Post Feed<= 4.9.0
Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute vulnerability
6.5
2 hours ago
Snippet Shortcodes<= 5.2.0
Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes vulnerability
6.5
2 hours ago
Slider Hero<= 9.1.7
Authenticated (Administrator+) SQL Injection via 'description' Slide Field (Second-Order via Duplicate) vulnerability
7.6
2 hours ago
Serious Slider<= 1.4.0
Authenticated (Contributor+) Stored Cross-Site Scripting via 'theme' Shortcode Attribute vulnerability
6.5
2 hours ago