405,825 results · Feed
-
Medium 5.4
BuddyForms <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via 'bf_post_type' Parameter via Post-Type Confusion
The BuddyForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bf_post_type (and buddyforms_form_content)' parameter in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes…
-
Medium 5.4
RSS Aggregator by Feedzy <= 5.2.13 - Unauthenticated Stored Cross-Site Scripting via Feed Item Title
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'item_title (parsed from feed <item><title>)' parameter in all versions up to, and inclu…
-
Medium 5.4
AMP for WP <= 1.1.18 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Author Biographical Info
The The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.1.18. This is due to the software allowing users to execute an action that does not properly validate a v…
-
High 8.8
Advanced Members for ACF <= 1.3.0 - Authenticated (Subscriber+) Privilege Escalation via Account Change-Password Form
The Advanced Members for ACF plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.3.0 via the `acf[_amem_local_user_password]` parameter of the `[advanced-members-account-password]` shortcode form submission. This…
-
High 8.1
Live2DWebCanvas <= 2.2.1 - Unauthenticated Arbitrary File Upload via 'modelApi' Parameter
The Live2DWebCanvas plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.2.1 via the download_one_file function. This is due to missing file extension whitelist and MIME type validation in download_one_file() whe…
-
Medium 5.4
Smart Cookie Kit <= 2.3.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Bundled Simple HTML DOM Noise Restoration
The Smart Cookie Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticat…
-
Medium 4.9
AAA Autoload Optimizer <= 1.7.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'option_page' Parameter via 'all' Hook
The AAA Autoload Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'option_page' parameter in all versions up to, and including, 1.7.0 due to insufficient input sanitization and output escaping. This makes it possible for aut…
-
Medium 6.4
All-in-One Video Gallery <= 5.0.0 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'track' Post Meta 'label' Field
The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'custom_fields[].value.label (for key='track')' parameter in all versions up to…
-
Critical 9.8
BuddyForms <= 2.10.5 - Unauthenticated Privilege Escalation to Form-Type Confusion via 'bf_post_type' Parameter
The BuddyForms plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.10.5 via a form-type confusion attack through the `bf_post_type` parameter. This is due to the public frontend submission handler `buddyforms_for…
-
High 7.5
WPSyncSheets For Contact Form 7 <= 1.8.0 - Unauthenticated PHP Object Injection to Remote Code Execution via Untrusted CF7 Submission Field via maybe_unserialize()
The WPSyncSheets For Contact Form 7 – CF7 Google Sheets Connector & Save to Database plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.8.0 via the 'any non-system CF7 field (e.g., your-message)' parameter para…
-
Medium 6.4
WP Customer Area <= 8.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter
The WP Customer Area plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 8.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenti…
-
Medium 6.5
Everest Forms <= 3.6.2 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Entry/Form Disclosure and Deletion via MCP /tools/call JSON-RPC Endpoint
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.6.2 via the get_entry due to missing validation on a user…
-
Critical 9.1CVE-2026-114630 Public exploit
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.8 - Unauthenticated Arbitrary File Deletion via 'ticket_attachment_path' Parameter
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the factory_reset function in all versions up to, and including, 3.3.8 This makes it possible for…
-
High 7.6
Pubjet | پابجت <= 5.4.8 - Authenticated (Subscriber+) Privilege Escalation to 'check-token' AJAX Action
The Pubjet | پابجت plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.4.8. This is due to the `checkToken()` AJAX handler — registered under `wp_ajax_pubjet-check-token` — performing no capability check and no …
-
Medium 4.9
Authenticated remote denial of service through unbounded zlib decompression in storeAnalysisStatistics
When an operator enables store.analysis_statistics_dir, a network client with PRODUCT_STORE permission for a product can call that product's storeAnalysisStatistics Thrift-over-HTTP method. CodeChecker 6.29.0 decodes the attacker-controlled Base64 string and …
-
None 0.0
Stored XSS in the static HTML report export, because json.dumps does not escape the markup character
The HTML report that plist-to-html, CodeChecker parse --export html and CodeChecker cmd diff --output html generate puts the report message, the checker name and the source file path into a script block through json.dumps. json.dumps does not escape the less-…
-
High 8.2
Cowboy HTTP/1.1 Unbounded Buffering of Pipelined Data During Request Handling Enables Memory Exhaustion
Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote attacker to exhaust connection process memory over HTTP/1.1. Once a request has been received in full and its handler is still running, cow…
-
High 8.7
Unbounded decoded HTTP/2 header-list size in cowlib cow_http2_machine enables HPACK amplification memory exhaustion
Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowlib allows an unauthenticated remote peer to exhaust the memory of an HTTP/2 endpoint via HPACK-indexed header fields. cow_http2_machine:headers_decode/4 in src/cow_http2_machi…
-
Low 3.1
In JetBrains YouTrack before 2026.2.19656 users without update permission could change issue visibility
-
Low 3.8
In JetBrains YouTrack before 2026.2.19562 project admins of a related project could delete VCS integrations owned by an…
-
Low 3.5
In JetBrains YouTrack before 2026.2.19562, 2026.1.14137, 2025.3.169041 missing authorization allowed attaching tags to …
-
Low 3.1
In JetBrains YouTrack before 2026.2.19728 the attachment size limit could be bypassed via AI assistant thread conversion
-
Medium 4.7
In JetBrains YouTrack before 2026.2.19562 missing authorization allowed Project Admin to manage VCS hosting server conf…
-
Low 3.8
In JetBrains YouTrack before 2026.2.19562 sprint creation allowed moving issues from inaccessible projects between spri…
-
Medium 5.4
In JetBrains YouTrack before 2026.2.19562 missing authorization in TeamCity integration allowed disclosure of other pro…
-
Medium 5.4
In JetBrains YouTrack before 2026.2.19562 missing authorization allowed users with read-only access to change issue vis…
-
Medium 5.4
In JetBrains YouTrack before 2026.2.19197 article editors could change visibility of restricted child articles
-
High 7.1
In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed workflow script discl…
-
High 7.5
In JetBrains YouTrack before 2026.2.19562 missing authorization in the saved query endpoint allowed disclosure of issue…
-
Medium 6.4
In JetBrains YouTrack before 2026.2.19656 app permission bypass allowed privilege escalation via project tab
-
High 7.7
In JetBrains YouTrack before 2026.2.19562 information disclosure via shared mailbox message history was possible
-
High 7.1
In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 inclusion of untrusted remote code was possible …
-
High 7.8
In JetBrains WebStorm before 2026.3, 2026.2.3 code execution via Grunt and Gulp task loading was possible in untrusted …
-
Medium 6.3
In JetBrains WebStorm before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Angular CLI sch…
-
High 8.4
In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 improper URL validation in the app widget host a…
-
Low 3.7
In JetBrains Ktor before 3.6.1 missing Domain attribute validation in client cookie storage allowed cookie injection
-
Low 3.1
In JetBrains Toolbox App before 3.9 insufficient warning in the login dialog allowed connecting to a malicious server
-
Medium 5.5
In JetBrains Junie CLI before 26.6.29 sensitive environment variables were exposed in session event logs
-
High 8.1
In JetBrains Ktor before 3.6.1 session forgery was possible via tampered encrypted session cookies
-
Medium 4.8
In JetBrains Ktor before 3.6.1 hTTP request smuggling was possible in the CIO engine