The leading open source vulnerability database

Instantly mitigate vulnerabilities in WordPress websites with Patchstack.

See pricing
Rated 4.9
Total51,114
Mitigations16,672
Stats
CVSS0
10
Affected software | Vulnerability
RiskDisclosed
Limit Login Attempts Reloaded< 3.3.5
Username Denylist Bypass vulnerability
3.7
5 minutes ago
All-in-One WP Migration<= 7.109
Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution vulnerability
8.8
9 minutes ago
ShopEngine<= 4.9.4
Authenticated (Shop Manager+) Privilege Escalation to WXR Import 'plugin <wp_option>' Nodes vulnerability
7.2
10 minutes ago
Metform<= 4.1.8
Authenticated (Contributor+) Stored Cross-Site Scripting via 'mf_form_id' Widget Setting vulnerability
6.5
26 minutes ago
eCommerce Product Catalog<= 3.5.10
Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute vulnerability
6.5
27 minutes ago
@platejs/media>= 53.0.0, < 53.1.4
NPM: Plate: Media embed provider metadata can bypass URL sanitization and execute iframe JavaScript
8.7
31 minutes ago
browse-mcp<= 0.8.1
NPM: browse-mcp has an arbitrary file write via unconfined download and state paths
8.6
32 minutes ago
Newsletters<= 4.17
Authenticated (Author+) Arbitrary Modification via 'newsletters_mailinglistsroles' POST Parameter vulnerability
4.3
32 minutes ago
Media Sweep – WordPress Media Cleaner<= 1.1.3
Authenticated (Administrator+) SQL Injection via 'fields' Parameter vulnerability
7.6
33 minutes ago
My Agile Privacy<= 3.3.6
Missing Authorization to Unauthenticated Plugin Settings Modification via map_missing_cookie_shield / map_check_consent_mode_status AJAX Actions vulnerability
5.3
33 minutes ago
urllib<= 2.44.0
NPM: urllib's cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakage
7.5
41 minutes ago
pickem< 1.0.7
NPM: pickem vulnerable to terminal escape-sequence injection via unsanitized item text
8.6
1 hour ago
Drag and Drop Multiple File Upload for WooCommerce< 1.1.8
Unauthenticated File Deletion via Nonce Oracle vulnerability
6.5
3 hours ago
Insert or Embed Articulate Content into WordPress<= 4.3000000027
Editor+ Arbitrary File Upload vulnerability
9.1
3 hours ago
MStore API< 4.21.0
Subscriber+ Order and Customer PII Disclosure via IDOR vulnerability
4.3
4 hours ago
GEO my WordPress< 4.5.5.3
Subscriber+ Arbitrary Geolocation Record Modification and Deletion via IDOR vulnerability
4.3
4 hours ago
Simply Schedule Appointments< 1.6.12.11
Contributor+ Sensitive Data Disclosure via Admin Shortcode vulnerability
4.3
4 hours ago
LatePoint< 5.6.8
Unauthenticated Booking Object Mass Assignment via Public Booking Funnel vulnerability
5.3
4 hours ago
RealHomes Memberships< 3.1.0
Subscriber+ Membership Payment Bypass vulnerability
4.3
4 hours ago
Hotel Booking Lite< 6.2.3
Subscriber+ Customer Data Modification via IDOR vulnerability
5.4
4 hours ago