2022

npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a worksp

Naver Cloud Explorer Beta allows the attacker to execute arbitrary code as System privilege via malicious DLL injection.

The Mobile browser color select plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and

The Google Tag Manager for WordPress (GTM4WP) plugin is vulnerable to Stored Cross-Site Scripting due to insufficient es

The Keep Backup Daily plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘t’ parameter in vers

The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to insufficient escaping and param

The Sticky Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ popup_title' parameter in v

The WPMK Ajax Finder WordPress plugin is vulnerable to Cross-Site Request Forgery via the createplugin_atf_admin_setting

Vulnerable versions of the JupiterX Core (<= 2.0.6) plugin register an AJAX action jupiterx_conditional_manager which ca

Vulnerable versions of the Jupiter Theme (<= 6.10.1) allow arbitrary plugin deletion by any authenticated user, includin

Vulnerable versions of the Jupiter (<= 6.10.1) and JupiterX (<= 2.0.6) Themes allow logged-in users, including subscribe

Jupiter Theme <= 6.10.1 and JupiterX Core Plugin <= 2.0.7 allow any authenticated attacker, including a subscriber or cu

The Mitsol Social Post Feed WordPress plugin before 1.11 does not escape some of its settings before outputting them bac

A cross-site scripting (XSS) vulnerability in /staff/setup/email-addresses of Helpdeskz v2.0.2 allows attackers to execu

A cross-site scripting (XSS) vulnerability in /staff/tools/custom-fields of Helpdeskz v2.0.2 allows attackers to execute

Open Forms is an application for creating and publishing smart forms. Open Forms supports file uploads as one of the for

SQL Injection in GitHub repository francoisjacquet/rosariosis prior to 9.0.

Cross-site Scripting (XSS) - Reflected in GitHub repository neorazorx/facturascripts prior to 2022.06.

Cross-site Scripting (XSS) - Stored in GitHub repository neorazorx/facturascripts prior to 2022.06.

The Download Manager Plugin for WordPress is vulnerable to reflected Cross-Site Scripting in versions up to, and includi

The ToolBar to Share plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including,

The Copify plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.0. Thi

The Zephyr Project Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘project’ parame

The WP Admin Style WordPress plugin through 0.1.2 does not sanitise and escape some of its settings, which could allow h

The Export any WordPress data to XML/CSV WordPress plugin before 1.3.5 does not sanitize the cpt POST parameter when exp

The Private Files WordPress plugin through 0.40 is missing CSRF check when disabling the protection, which could allow a

The Quick Subscribe WordPress plugin through 1.7.1 does not have CSRF check in place when updating its settings, which c

The One Click Plugin Updater WordPress plugin through 2.4.14 does not have CSRF check in place when updating its setting

The New User Email Set Up WordPress plugin through 0.5.2 does not have CSRF check in place when updating its settings, w

Due to missing checks the Change Uploaded File Permissions WordPress plugin through 4.0.0 is vulnerable to CSRF attacks.

The Sideblog WordPress plugin through 6.0 does not have CSRF check in place when updating its settings, which could allo

The postTabs WordPress plugin through 2.10.6 does not have CSRF check in place when updating its settings, which could a

The LaTeX for WordPress plugin through 3.4.10 does not have CSRF check in place when updating its settings, which could

The Auto Delete Posts WordPress plugin through 1.3.0 does not have CSRF check in place when updating its settings, which

The Filr WordPress plugin before 1.2.2.1 does not have authorisation check in two of its AJAX actions, allowing them to

The WP Athletics WordPress plugin through 1.1.7 does not sanitise and escape a parameter before outputting back in an ad

The Google Places Reviews WordPress plugin before 2.0.0 does not properly escape its Google API key setting, which is re

The Hot Linked Image Cacher WordPress plugin through 1.16 is vulnerable to CSRF. This can be used to store / cache image

The WP-chgFontSize WordPress plugin through 1.8 does not have CSRF check in place when updating its settings, which coul

Due to missing checks the Static Page eXtended WordPress plugin through 2.1 is vulnerable to CSRF attacks which allows c

The iQ Block Country WordPress plugin before 1.2.20 does not properly checks HTTP headers in order to validate the origi

The Peter’s Collaboration E-mails WordPress plugin through 2.2.0 is vulnerable to CSRF due to missing nonce checks. This

The RB Internal Links WordPress plugin through 2.0.16 does not have CSRF check in place when updating its settings, whic

The Genki Pre-Publish Reminder WordPress plugin through 1.4.1 does not have CSRF check in place when updating its settin

The Newsletter WordPress plugin before 7.4.5 does not sanitize and escape the $_SERVER['REQUEST_URI'] before echoing it

The Simple Membership WordPress plugin before 4.1.1 does not properly sanitise and escape parameters before outputting t

The Appointment Hour Booking WordPress plugin before 1.3.56 does not sanitise and escape a settings of its Calendar fiel

The Google Tag Manager for WordPress plugin for WordPress is vulnerable to reflected Cross-Site Scripting via the s para

The Useful Banner Manager WordPress plugin through 1.6.1 does not perform CSRF checks on POST requests to its admin page

Vulnerable versions of the JupiterX Theme (<=2.0.6) allow any logged-in user, including subscriber-level users, to acces