The leading open source vulnerability database

Instantly mitigate vulnerabilities in WordPress websites with Patchstack.

See pricing
Rated 4.9
Total50,661
Mitigations16,445
Stats
CVSS0
10
Affected software | Vulnerability
RiskDisclosed
SVG Support< 2.5.17
Author+ Stored XSS via .svgz Sanitization Bypass vulnerability
5.9
2 hours ago
WP Event SOlution< 4.1.20
Editor+ Local File Inclusion via speaker_template Setting vulnerability
7.2
2 hours ago
Nexter Blocks< 5.0.2
Author+ Stored XSS via SVG Upload vulnerability
5.9
2 hours ago
GeoDirectory< 2.8.110
Editor+ Stored XSS via Place Categories vulnerability
6.5
2 hours ago
ARForms Form Builder<= 1.8.5
WordPress Contact Form, Survey, Quiz & Popup Form Builder - ARForms plugin <= 1.8.5 - Unauthenticated PHP Object Injection vulnerability
9.8
3 hours ago
Kirki<= 6.1.1
Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'context' Parameter vulnerability
4.3
4 hours ago
Kirki<= 6.1.1
Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' Parameter vulnerability
4.9
4 hours ago
Gallery <= 4.7.9
Authenticated (Editor+) SQL Injection via Gallery Image Order Array Keys vulnerability
8.5
4 hours ago
Bold Page Builder<= 5.6.8
Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
6.5
4 hours ago
Forminator<= 1.55.0.2
Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'draft' Parameter vulnerability
5.3
4 hours ago
WP Compress<= 7.10.09
Cross-Site Request Forgery to Arbitrary Options Deletion vulnerability
4.3
4 hours ago
WC Vendors Marketplace<= 2.7.0
Authenticated (Shop Manager+) SQL Injection via 'status' Parameter vulnerability
7.6
4 hours ago
YouTube Showcase<= 4.0.4
Authenticated (Author+) Stored Cross-Site Scripting via Attachment 'post_title' via emd_mb_meta Shortcode vulnerability
5.9
4 hours ago
WooCommerce POS<= 1.9.14
Authenticated (Shop Manager+) Code Injection via 'thermal' Template Engine vulnerability
7.2
4 hours ago
User Login History<= 2.1.7
Authenticated (Administrator+) SQL Injection via 'blog_id' Parameter vulnerability
7.6
4 hours ago
Turnkey bbPress<= 1.7.1
Authenticated (Administrator+) PHP Object Injection vulnerability
7.2
4 hours ago
Toocheke Companion<= 2.10
Authenticated (Contributor+) Stored Cross-Site Scripting via 'series_bg_color' Post Meta vulnerability
6.5
4 hours ago
SureDash<= 1.10.3
Authenticated (Contributor+) Stored Cross-Site Scripting via 'draweropenverposition' Block/Shortcode Attribute vulnerability
6.5
5 hours ago
Smash Balloon Social Post Feed<= 4.9.0
Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute vulnerability
6.5
5 hours ago
Snippet Shortcodes<= 5.2.0
Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes vulnerability
6.5
5 hours ago