Latest critical vulnerabilities
CVSS 9.0 and up.
- themerex wine houseWordPress Wine House theme <= 3.20 - PHP Object Injection vulnerability9.8 Critical
- themerex tipsyWordPress Tipsy theme <= 1.6 - PHP Object Injection vulnerability9.8 Critical
- themerex stargazeWordPress Stargaze theme <= 1.10 - PHP Object Injection vulnerability9.8 Critical
- themerex splendourWordPress Splendour theme <= 1.23 - PHP Object Injection vulnerability9.8 Critical
- designinvento directorypressWordPress DirectoryPress plugin <= 3.6.27 - Local File Inclusion vulnerability9.8 Critical
- stylemix ulistingWordPress uListing plugin <= 2.2.0 - SQL Injection vulnerability9.3 Critical
- tailored media toolsWordPress Tailored Tools plugin <= 3.0.3 - Arbitrary File Upload vulnerability9.0 Critical
- codebard help deskWordPress CodeBard Help Desk plugin <= 1.1.2 - Arbitrary File Upload vulnerability9.9 Critical
- select-themes tonda membershipWordPress Tonda Membership plugin <= 1.0.1 - Privilege Escalation vulnerability9.8 Critical
- ancorathemes cleanskinWordPress CleanSkin theme <= 1.5.0 - PHP Object Injection vulnerability9.8 Critical
- sarah giles dynamic user directoryWordPress Dynamic User Directory plugin <= 2.4 - PHP Object Injection vulnerability9.8 Critical
- pluggabl booster for woocommerceWordPress Booster for WooCommerce plugin <= 8.4.0 - PHP Object Injection vulnerability9.8 Critical
- payever - woocommerce gatewayWordPress Payever - WooCommerce Gateway plugin <= 4.8.2 - PHP Object Injection vulnerability9.8 Critical
- royal plugins sitevault – backup, restore, migration & cloningWordPress SiteVault – Backup, Restore, Migration & Cloning plugin <= 1.5.18 - Remote Code Execution (RCE) vulnerability10.0 Critical
- elextensions elex woocommerce advanced bulk edit products, prices & attributesWordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.5.3 - SQL Injection vulnerability9.3 Critical
- sergey aiwuWordPress AIWU plugin <= 1.5.9 - Privilege Escalation vulnerability9.8 Critical
- floci-io flociFloci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates9.3 Critical
- miniorange otp verificationWordPress miniorange otp verification plugin <= 5.5.7 - Privilege Escalation vulnerability9.8 Critical
- rtcamp rtmedia for wordpress, buddypress and bbpressWordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.13 - Arbitrary File Deletion vulnerability9.8 Critical
- tickeraWordPress Tickera plugin <= 3.6.0.6 - SQL Injection vulnerability9.3 Critical
- villatheme affi – affiliate marketing for woocommerceWordPress AFFI – Affiliate Marketing for WooCommerce plugin <= 1.0.10 - PHP Object Injection vulnerability9.8 Critical
- ferdikoomen openapi-typescript-codegenopenapi-typescript-codegen through 0.31.0 Code Injection via Handlebars Templates9.3 Critical
- chenhg5 cc-connectcc-connect through 1.5.0 Missing Authentication via MAX Webhook Sender Spoofing9.2 Critical
libextutils-typemaps-default-perlDebian,perl-ExtUtils-Typemaps-DefaultMageia,perl-Math-ClipperopenSUSE +2 moreExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument9.1 Criticalzipcrates.ioZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target9.1 Critical- apache software foundation datasketchesApache DataSketches: datasketches-cpp: Out-of-bounds read in compact Theta sketch deserialization allows denial of service via a crafted sketch9.1 Critical
- apache software foundation datasketchesApache DataSketches: datasketches-cpp: Out-of-bounds read and write in the CPC sketch deserialization allows memory corruption via a crafted sketch9.8 Critical
- apache software foundation datasketchesApache DataSketches: datasketches-cpp: HLL CouponList Deserialization Buffer Overflow allows memory corruption via a crafted sketch9.8 Critical
- whyun wpcom memberWPCOM Member <= 1.7.27 - Unauthenticated Authentication Bypass via 'uuid' and 'code' Parameters on Social-Login Callback9.8 Critical
- themerex group bookloversWordPress Booklovers theme <= 2.13.0 - PHP Object Injection vulnerability9.8 Critical
- axiomthemes balanceWordPress Balance theme <= 1.12.0 - PHP Object Injection vulnerability9.8 Critical
- themerex group cameliaWordPress Camelia theme <= 1.2.15 - PHP Object Injection vulnerability9.8 Critical
- axiomthemes convexWordPress Convex theme <= 1.16.0 - PHP Object Injection vulnerability9.8 Critical
- axiomthemes dwellWordPress Dwell theme <= 1.16.0 - PHP Object Injection vulnerability9.8 Critical
- themerex group gutentypeWordPress Gutentype theme <= 2.1.12 - PHP Object Injection vulnerability9.8 Critical
- themerex group edemaWordPress Edema theme <= 1.2.2.2 - PHP Object Injection vulnerability9.8 Critical
- axiomthemes greenyWordPress Greeny theme <= 2.10.0 - PHP Object Injection vulnerability9.8 Critical
- themerex group hogwordsWordPress Hogwords theme <= 1.2.7 - PHP Object Injection vulnerability9.8 Critical
- axiomthemes hygiaWordPress Hygia theme <= 1.21.0 - PHP Object Injection vulnerability9.8 Critical
- axiomthemes ipharmWordPress IPharm theme <= 1.2.4 - PHP Object Injection vulnerability9.8 Critical
- themerex group let's playWordPress Let's Play theme <= 1.1.15 - PHP Object Injection vulnerability9.8 Critical
- themerex group partisoWordPress Partiso theme <= 1.1.13 - PHP Object Injection vulnerability9.8 Critical
- axiomthemes rosalindaWordPress Rosalinda theme <= 1.2.4 - PHP Object Injection vulnerability9.8 Critical
- themerex group smart casaWordPress Smart Casa theme <= 1.0.12 - PHP Object Injection vulnerability9.8 Critical
- axiomthemes smashWordPress Smash theme <= 1.12.0 - PHP Object Injection vulnerability9.8 Critical
- themerex group tantraWordPress Tantra theme <= 2.9.0 - PHP Object Injection vulnerability9.8 Critical
- themerex group travesiaWordPress Travesia theme <= 1.1.16 - PHP Object Injection vulnerability9.8 Critical
- axiomthemes vetoWordPress Veto theme <= 1.6.0 - PHP Object Injection vulnerability9.8 Critical
- themeisle ppom – product addons & custom fields for woocommercePPOM <= 34.0.10 - Unauthenticated Arbitrary File Deletion via 'ppom[fields][<data_name>][n][org]' Parameter9.1 Critical
- themefusion avada (fusion) builderAvada (Fusion) Builder <= 7.16.1 - Unauthenticated Arbitrary WordPress Action Invocation via '{action_hook}' Dynamic-Data Token in Form Field9.1 Critical
- Show moreLoading…