A critical flaw (CVSS 9.8) in the Hunk Companion plugin let unauthenticated attackers install and activate any plugin…
A critical unauthenticated Local File Inclusion flaw (CVE-2025-1661, CVSS 9.8) in the popular HUSKY - Products Filter Professional…
A missing capability check in W3 Total Cache (all versions up to 2.8.1) let any logged-in user —…
CVE-2024-28890 is a critical (CVSS 9.8) unauthenticated arbitrary file upload vulnerability in the Forminator form builder plugin, installed…
A critical flaw in the Everest Forms WordPress plugin (100,000+ installs) let unauthenticated attackers upload, read, and delete…
CVE-2024-11205 is a missing authorization flaw in WPForms, the form builder active on over 6 million WordPress sites.…
A critical missing-authorization flaw (CVE-2025-11833, CVSS 9.8) in the Post SMTP plugin lets unauthenticated attackers read logged emails…
A critical flaw (CVSS 9.9) in the WPML multilingual plugin let authenticated Contributor-level users run arbitrary code through…
A critical SQL injection flaw in the popular WP-Automatic plugin let unauthenticated attackers run arbitrary database queries, forge…
CVE-2025-3102 is a high-severity authentication bypass in the OttoKit (formerly SureTriggers) automation plugin, installed on 100,000+ WordPress sites.…
