The leading open source vulnerability database

Instantly mitigate vulnerabilities in WordPress websites with Patchstack.

See pricing
Rated 4.9
Total52,173
Mitigations17,052
Stats
CVSS0
10
Affected software | Vulnerability
RiskDisclosed
@zereight/mcp-gitlab< 2.1.27
NPM: @zereight/mcp-gitlab: Unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full account takeover
9.8
1 hour ago
WP Mega Menu<= 1.4.2
SQL Injection vulnerability
7.6
4 hours ago
@zereight/mcp-gitlab>= 0.0.1, < 2.1.27
NPM: @zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery
9.6
18 hours ago
@zereight/mcp-gitlab< 2.1.30
NPM: @zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport
9.6
18 hours ago
@zereight/mcp-gitlab< 2.1.30
NPM: @zereight/mcp-gitlab has multiple safety-control bypasses: execute_graphql read-only + allow-list bypass, unauthenticated transports, session-exhaustion DoS
8.1
18 hours ago
Admin Menu Editor Pro2.35-2.36
Backdoor vulnerability
10
21 hours ago
Bookly<= 28.1
Insecure Direct Object Reference to Unauthenticated Sensitive Data Access and Message Injection via 'conversation_id' Parameter vulnerability
7.5
23 hours ago
Bold Page Builder<= 5.9.6
Authenticated (Contributor+) Stored Cross-Site Scripting via 'shortcode_content' Parameter vulnerability
6.5
23 hours ago
WP-Lister Lite for eBay<= 3.8.9
Unauthenticated Stored Cross-Site Scripting via AJAX Cron Handler Request vulnerability
7.1
23 hours ago
JetFormBuilder<= 3.6.2
Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter
9.8
23 hours ago
Advanced Popups<= 1.2.3
Authenticated (Author+) Stored Cross-Site Scripting via 'Notification Button Link' Field vulnerability
5.9
23 hours ago
Ad Inserter<= 2.8.16
Missing Authorization to Unauthenticated Header/Footer Code Disclosure via 'ai-debug-code' Parameter vulnerability
5.3
23 hours ago
Contest Gallery<= 32.0.1
Unauthenticated Arbitrary File Upload via 'baseUrlForFacebook' Parameter vulnerability
8.8
1 day ago
TrueBooker<= 1.2.3
Privilege Escalation vulnerability
9.8
1 day ago
WP Directory Kit<= 1.5.4
Authenticated (Custom+) SQL Injection vulnerability
8.5
1 day ago
Hotel Booking Lite<= 6.2.4
Unauthenticated Stored Cross-Site Scripting vulnerability
7.1
1 day ago
Consulting<= 6.7.16
WordPress Consulting - Business, Finance WordPress Theme theme <= 6.7.16 - Authenticated (Subscriber+) Privilege Escalation vulnerability
9.8
1 day ago
Advanced Custom Fields: Extended PRO<= 0.9.2.6
Unauthenticated Remote Code Execution vulnerability
10
1 day ago
WP Directory Kit<= 1.5.7
Editor+ SQL Injection vulnerability
7.6
1 day ago
WP Directory Kit<= 1.5.7
Contributor+ Non-Public Listing Field Disclosure vulnerability
4.3
1 day ago