Published vulnerability pages
Website Security Risk Index — Page 48
Current vulnerabilities, affected platforms, and fix guidance for website owners and developers.
Browse by topic
Security risk categories
46 categories with published guidance
Memory Corruption
409Browse published Memory Corruption vulnerabilities, affected products, and practical fix guidance.
Authorization Bypass
373Browse published Authorization Bypass vulnerabilities, affected products, and practical fix guidance.
WordPress
350Browse published WordPress vulnerabilities, affected products, and practical fix guidance.
Information Disclosure
320Browse published Information Disclosure vulnerabilities, affected products, and practical fix guidance.
Remote Code Execution
303Browse published Remote Code Execution vulnerabilities, affected products, and practical fix guidance.
Cross-site Scripting
260Browse published Cross-site Scripting vulnerabilities, affected products, and practical fix guidance.
Network Security
253Browse published Network Security vulnerabilities, affected products, and practical fix guidance.
Input Validation
243Browse published Input Validation vulnerabilities, affected products, and practical fix guidance.
Web Application
239Browse published Web Application vulnerabilities, affected products, and practical fix guidance.
Windows
216Browse published Windows vulnerabilities, affected products, and practical fix guidance.
API Security
215Browse published API Security vulnerabilities, affected products, and practical fix guidance.
Browser
215Browse published Browser vulnerabilities, affected products, and practical fix guidance.
Denial of Service
215Browse published Denial of Service vulnerabilities, affected products, and practical fix guidance.
Microsoft
212Browse published Microsoft vulnerabilities, affected products, and practical fix guidance.
PHP
199Browse published PHP vulnerabilities, affected products, and practical fix guidance.
Path Traversal
167Browse published Path Traversal vulnerabilities, affected products, and practical fix guidance.
Authentication Bypass
118Browse published Authentication Bypass vulnerabilities, affected products, and practical fix guidance.
Arbitrary File Write
116Browse published Arbitrary File Write vulnerabilities, affected products, and practical fix guidance.
Privilege Escalation
113Browse published Privilege Escalation vulnerabilities, affected products, and practical fix guidance.
Linux
94Browse published Linux vulnerabilities, affected products, and practical fix guidance.
DevOps
81Browse published DevOps vulnerabilities, affected products, and practical fix guidance.
SQL Injection
72Browse published SQL Injection vulnerabilities, affected products, and practical fix guidance.
Cryptography
68Browse published Cryptography vulnerabilities, affected products, and practical fix guidance.
SSRF
61Browse published SSRF vulnerabilities, affected products, and practical fix guidance.
Python
59Browse published Python vulnerabilities, affected products, and practical fix guidance.
Java
57Browse published Java vulnerabilities, affected products, and practical fix guidance.
IDOR
56Browse published IDOR vulnerabilities, affected products, and practical fix guidance.
WooCommerce
53Browse published WooCommerce vulnerabilities, affected products, and practical fix guidance.
Unsafe Deserialization
51Browse published Unsafe Deserialization vulnerabilities, affected products, and practical fix guidance.
File Upload
47Browse published File Upload vulnerabilities, affected products, and practical fix guidance.
npm
44Browse published npm vulnerabilities, affected products, and practical fix guidance.
Joomla
41Browse published Joomla vulnerabilities, affected products, and practical fix guidance.
Supply Chain
39Browse published Supply Chain vulnerabilities, affected products, and practical fix guidance.
Cloud Security
36Browse published Cloud Security vulnerabilities, affected products, and practical fix guidance.
CSRF
33Browse published CSRF vulnerabilities, affected products, and practical fix guidance.
Race Condition
31Browse published Race Condition vulnerabilities, affected products, and practical fix guidance.
PDF Editor
28Browse published PDF Editor vulnerabilities, affected products, and practical fix guidance.
Industrial Control
27Browse published Industrial Control vulnerabilities, affected products, and practical fix guidance.
.NET
23Browse published .NET vulnerabilities, affected products, and practical fix guidance.
File Deletion
23Browse published File Deletion vulnerabilities, affected products, and practical fix guidance.
Open Redirect
16Browse published Open Redirect vulnerabilities, affected products, and practical fix guidance.
Node.js
15Browse published Node.js vulnerabilities, affected products, and practical fix guidance.
SAML
13Browse published SAML vulnerabilities, affected products, and practical fix guidance.
Virtualization
13Browse published Virtualization vulnerabilities, affected products, and practical fix guidance.
Drupal
6Browse published Drupal vulnerabilities, affected products, and practical fix guidance.
Unix Domain Sockets
5Browse published Unix Domain Sockets vulnerabilities, affected products, and practical fix guidance.
Published security risks
Showing 1693–1728 of 2230 published risks.
Cookie Banner for GDPR / CCPA <= 4.3.5 - Authenticated (Administrator+) SQL Injection via 's' Parameter
The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 4.3.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Updated Jul 13, 2026
CURCY <= 2.2.14 - Unauthenticated Arbitrary Shortcode Execution via 'exchange' Parameter
The The CURCY – Multi Currency for WooCommerce – Smoothly on WooCommerce 9.x plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.2.14. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Updated Jul 13, 2026
Request a Quote Form Plugin <= 2.5.5 - Unauthenticated Code Injection via 'path' Parameter
The Request a Quote plugin for WordPress is vulnerable to Code Injection in versions up to, and including, 2.5.5 via the emd_delete_file AJAX action. This is due to the emd_delete_file() handler deriving a PHP function name from the attacker-controlled $_POST['path'] parameter and invoking it dynamically via the variable-function call $sess_name(), and the handler being registered for wp_ajax_nopriv with its only protection being a nonce that the plugin prints into the public quote-form page via wp_localize_script. This makes it possible for unauthenticated attackers to invoke arbitrary zero-argument PHP functions on the server, such as phpinfo(), potentially exposing sensitive server configuration and credentials, or executing other destructive built-in PHP functions.
Updated Jul 13, 2026
Printcart Web to Print Product Designer for WooCommerce <= 2.5.2 - Unauthenticated Arbitrary File Deletion
The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 2.5.2 This is due to insufficient path validation in the store_design_data() function, which constructs a filesystem path from the user-supplied 'nbd_item_key' POST parameter sanitized only with sanitize_text_field() — which does not strip path traversal sequences — and then passes that path directly to Nbdesigner_IO::delete_folder() and PHP's rename(). The nonce protecting the nbd_save_customer_design AJAX action is freely obtainable by unauthenticated users via the nbd_check_use_logged_in endpoint. This makes it possible for unauthenticated attackers to delete arbitrary files on the affected site's server which may make remote code execution possible.
Updated Jul 13, 2026
Leedo <= 3.0.0 - Authenticated (Contributor+) Local File Inclusion
The Leedo theme for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 3.0.0. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other "safe" file types can be uploaded and included.
Updated Jul 13, 2026
Permalink Manager for WooCommerce <= 1.0.8.2 - Cross-Site Request Forgery
The Permalink Manager for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.8.2. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Updated Jul 13, 2026
MeetingHub – Webinar & Meeting Plugin for Zoom, Google Meet, Webex, Microsoft Teams, & Jitsi Meet <= 1.25.10 - Missing Authorization
The MeetingHub – Webinar & Meeting Plugin for Zoom, Google Meet, Webex, Microsoft Teams, & Jitsi Meet plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.25.10. This makes it possible for unauthenticated attackers to perform an unauthorized action.
Updated Jul 13, 2026
Shopify <= 1.0.0 - Authenticated (Contributor+) Local File Inclusion
The Shopify plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.0.0. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other "safe" file types can be uploaded and included.
Updated Jul 13, 2026
Houzez Property Feed <= 2.5.46 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
The Houzez Property Feed plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 2.5.46 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the prepare_items() method of the Houzez_Property_Feed_Admin_Logs_Export_Table (and Houzez_Property_Feed_Admin_Logs_Import_Table) class. The user-controlled $_GET['orderby'] and $_GET['order'] values are filtered only with sanitize_text_field() and then concatenated into the SQL format string before $wpdb->prepare() is called — prepare() only parameterizes the appended LIMIT/OFFSET clause and cannot retroactively secure the already-tainted ORDER BY clause. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Updated Jul 13, 2026
Flow <= 1.8 - Authenticated (Contributor+) Local File Inclusion
The Flow theme for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.8. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other "safe" file types can be uploaded and included.
Updated Jul 13, 2026
Reviews Widgets for Google, Yelp & TripAdvisor <= 2.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'page_id' Shortcode Attribute
The Reviews Widgets for Google, Yelp & TripAdvisor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page_id' shortcode attribute of the [fbrev] shortcode in versions up to and including 2.7.3. This is due to insufficient input sanitization and output escaping in the Feed_Shortcode::fbrev() method, which passes the raw shortcode attribute through Feed_Old::get_feed() into the View::render() method, where it is echoed directly into the data-id HTML attribute without esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Updated Jul 13, 2026
Ninja Forms - File Uploads <= 3.3.29 - Unauthenticated Arbitrary File Read via File Upload Field 'files[].data.file_path' Parameter
The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Arbitrary File Read via the attach_files() function in versions up to, and including, 3.3.29. This is due to the get_files_for_attachment() function accepting a raw attacker-controlled 'files' array when the process() method returns early due to a client-supplied saveProgress flag, bypassing all upload validation, path normalization, and database record creation steps, and allowing an attacker-supplied file_path value to reach wp_mail() as an email attachment with only a file_exists() check. This makes it possible for unauthenticated attackers to read arbitrary files on the affected site's server.
Updated Jul 13, 2026
CrawlWP SEO – Instant Search Engine Indexing & SEO Performance Monitor <= 3.0.16 - Cross-Site Request Forgery
The CrawlWP SEO – Instant Search Engine Indexing & SEO Performance Monitor plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.16. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Updated Jul 13, 2026
Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via kirki_post_apis_nopriv AJAX Action
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.0.11 via the get_single_symbol. This makes it possible for unauthenticated attackers to extract the full builder metadata and rendered HTML of any kirki_symbol post — including unpublished drafts — by supplying a sequential WordPress post ID.
Updated Jul 13, 2026
WP Import Export Lite <= 3.9.30 - Authenticated (Administrator+) Server-Side Request Forgery via 'file_url' Parameter
The WP Import Export Lite plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to and including 3.9.30 via the wpie_import_upload_file_from_url AJAX action. The plugin's URL downloader first calls wp_safe_remote_get() (which correctly blocks private/reserved IP ranges), but when that call returns a WP_Error — the exact outcome for any blocked internal host — the Download::download_file() method falls back to GuzzleHttp\Client::request() with the original attacker-supplied URL and no SSRF protection (and with TLS verification disabled). This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services such as the cloud metadata endpoint at 169.
Updated Jul 13, 2026
CWS SVGicons <= 1.5.5 - Authenticated (Contributor+) SQL Injection
The CWS SVGicons plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.5.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Updated Jul 13, 2026
FormLayer <= 1.0.6 - Unauthenticated Information Exposure
The FormLayer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.6. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.
Updated Jul 13, 2026
Universal Clocks <= 1.2.0 - Missing Authorization
The Universal Clocks plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.2.0. This makes it possible for unauthenticated attackers to perform an unauthorized action.
Updated Jul 13, 2026
Struktur - Creative Agency WordPress Theme <= 2.5.1 - Authenticated (Contributor+) Local File Inclusion
The Struktur - Creative Agency WordPress Theme theme for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.5.1. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other "safe" file types can be uploaded and included.
Updated Jul 13, 2026
Aalto <= 1.8 - Authenticated (Contributor+) Local File Inclusion
The Aalto theme for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.8. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other "safe" file types can be uploaded and included.
Updated Jul 13, 2026
EduMall - Professional LMS Education Center WordPress Theme <= 4.5.1 - Missing Authorization
The EduMall - Professional LMS Education Center WordPress Theme theme for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 4.5.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.
Updated Jul 13, 2026
JoomSport <= 5.7.8 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Group Creation/Modification via season_groupedit AJAX action
The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.7.8. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create arbitrary season groups or modify existing group names, participants, and round-type options. Exploitation requires obtaining the joomsportajaxnonce, which is exposed on frontend pages that render a JoomSport shortcode.
Updated Jul 13, 2026
WP Inventory Manager <= 2.4.0 - Authenticated (Contributor+) SQL Injection
The WP Inventory Manager plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.4.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Updated Jul 13, 2026
Image Optimizer <= 1.7.4 - Authenticated (Author+) Arbitrary File Deletion via Post Meta Field Injection
The Image Optimizer plugin for WordPress is vulnerable to arbitrary file deletion in versions up to and including 1.7.4. This is due to insufficient path validation in the Image_Backup::remove() function where backup file paths stored in post meta are used directly in file deletion operations without verifying they are within the uploads directory. The plugin stores backup file paths in the image_optimizer_metadata post meta field and trusts these paths completely when deleting backups on the delete_attachment hook. An authenticated attacker with Author-level access can edit the image_optimizer_metadata post meta on their own attachments via WordPress's Custom Fields interface, injecting arbitrary absolute file paths into the backups array. When the attacker subsequently deletes the attachment, the plugin calls File_System::delete() on each path without validation. This makes it possible for authenticated attackers, with Author-level access and above, to delete arbitrary files on the server within the web server's filesystem permissions, potentially leading to denial of service, data loss, or security degradation.
Updated Jul 13, 2026
Email Subscribers & Newsletters <= 5.9.27 - Missing Authorization to Authenticated (Contributor+) Settings Modification via ig_es_handle_request AJAX Action
The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.9.27. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to overwrite plugin mail settings (from name and from email address), create audience lists, insert arbitrary contacts into those lists, create and overwrite newsletter broadcasts and post notifications, add workflows, and queue and dispatch mass email to arbitrary recipients.
Updated Jul 13, 2026
Insert Pages <= 3.11.4 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Field Keys (Meta Key Names)
The Insert Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post custom field keys (meta key names) in all versions up to, and including, 3.11.4. This is due to insufficient output escaping in the the_meta() function: while the custom field VALUE is sanitized with wp_kses_post(), the custom field KEY ($key) is interpolated into the rendered HTML (lines 1786-1791) and echoed (line 1806) without any escaping when an inserted page is rendered with the [insert page='ID' display='all'] shortcode. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Updated Jul 13, 2026
My Calendar <= 3.7.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'vcal' Parameter
The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.14 via the 'vcal' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to enumerate occurrence IDs and access the full iCalendar export of non-public, draft, trashed, and personal calendar events, disclosing sensitive event metadata including titles, descriptions, dates, locations, organizer and host details, permalinks, and related calendar metadata.
Updated Jul 13, 2026
GenerateBlocks <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Headline Block 'linkMetaFieldType' Dynamic Link Attribute
The GenerateBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Headline Block 'linkMetaFieldType' Dynamic Link Attribute in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A contributor-level attacker can store a JavaScript payload in their own profile description (allowlisted by get_safe_user_meta_keys()) and prepend 'javascript:' via the linkMetaFieldType attribute, creating a fully attacker-controlled href that executes when any user, including an administrator, clicks the rendered headline link.
Updated Jul 13, 2026
Kit (formerly ConvertKit) for WooCommerce <= 2.1.5 - Unauthenticated Information Exposure
The Kit (formerly ConvertKit) for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.5. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.
Updated Jul 13, 2026
Booked - Appointment Booking for WordPress <= 3.0.0 - Missing Authorization
The Booked - Appointment Booking for WordPress plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 3.0.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.
Updated Jul 13, 2026
Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Arbitrary Email Content Injection (Mail Relay / Phishing) via 'emailBody' and 'emailSubject' Parameters
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.11. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to send arbitrary HTML-injected emails — including phishing messages embedding a real, valid WordPress password-reset URL for the targeted user — to any registered user via the site's own mail server, abusing its SPF/DKIM reputation. The attacker-controlled emailSubject parameter is passed to wp_mail() with only sanitize_text_field() applied, while emailBody 'text' items are concatenated raw into the HTML email body with no escaping, and 'chip' items can include the genuine WordPress password-reset link for the targeted account.
Updated Jul 13, 2026
Tonda <= 2.5 - Authenticated (Contributor+) Local File Inclusion
The Tonda theme for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.5. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other "safe" file types can be uploaded and included.
Updated Jul 13, 2026
Simple URLs – Link Cloaking, Product Displays, and Affiliate Link Management <= 151 - Authenticated (Author+) Stored Cross-Site Scripting
The Simple URLs – Link Cloaking, Product Displays, and Affiliate Link Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 151 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Updated Jul 13, 2026
Advanced Shipment Tracking for WooCommerce <= 4.0 - Authenticated (Shop manager+) SQL Injection
The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 4.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with shop manager-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Updated Jul 13, 2026
Zakra <= 4.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta REST API
The Zakra theme for WordPress is vulnerable to Stored Cross-Site Scripting via post meta values in all versions up to, and including, 4.2.0. This is due to the theme registering three post meta fields (zakra_menu_item_color, zakra_menu_item_hover_color, and zakra_menu_item_active_color) with 'show_in_rest' => true and 'auth_callback' => '__return_true', but without any sanitize_callback parameter in the register_post_meta() calls. While the classic editor save path applies sanitize_hex_color() sanitization, the REST API path completely bypasses this protection. The unsanitized meta values are then retrieved via get_post_meta() and concatenated directly into CSS strings that are output through wp_add_inline_style() without any escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the injected page.
Updated Jul 13, 2026
Booked - Appointment Booking for WordPress <= 3.0.0 - Cross-Site Request Forgery
The Booked - Appointment Booking for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.0. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Updated Jul 13, 2026