Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
695766 source statements · aliases may refer to the same vulnerabilityMalicious code in @s4yhiitestpoc/r2-https (npm)
osv ·
npm: @s4yhiitestpoc/r2-https
Malicious code in another-very-long-name (npm)
osv ·
npm: another-very-long-name
mm/huge_memory: initialise workingset state before folio split
cve-program ·
Vendor product: Linux · Vendor product: Linux
Advanced Classifieds & Directory Pro <= 3.4.4 - Authenticated (Custom+) Stored Cross-Site Scripting via 'phone' Parameter
cve-program ·
Vendor product: Advanced Classifieds & Directory Pro
Table Field Add-on for ACF and SCF <= 1.4.1-RC2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Table Field Value
cve-program ·
Vendor product: Table Field Add-on for ACF and SCF
Data Tables Generator by Supsystic <= 1.15.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Table Cell 'data' Value via updateRows Action
cve-program ·
Vendor product: Data Tables Generator by Supsystic
GeoDirectory <= 2.8.188 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Contact Email Custom Field
cve-program ·
Vendor product: GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
Fluent Forms <= 6.2.14 - Reflected Cross-Site Scripting via '{get.*}' Editor SmartCode Parameter
cve-program ·
Vendor product: Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
Download Manager <= 3.3.71 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'regurl' Shortcode Attribute
cve-program ·
Vendor product: Download Manager
FV Flowplayer Video Player <= 7.5.54.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Unquoted popup Shortcode Attribute
cve-program ·
Vendor product: FV Flowplayer Video Player
Filter Everything — WordPress & WooCommerce Filters <= 1.9.6 - Reflected Cross-Site Scripting via Elementor Posts Widget Pagination URL
cve-program ·
Vendor product: Filter Everything — WordPress & WooCommerce Filters
RSS Aggregator by Feedzy <= 5.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Feedzy Loop Block Feed URL / RSS <title>
cve-program ·
Vendor product: RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator
Anti-Spam by CleanTalk <= 6.88 - Unauthenticated Stored Cross-Site Scripting via Comment Content via ContactsEncoder Greedy Regex
cve-program ·
Vendor product: Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA
Form Maker by 10Web <= 1.15.48 - Reflected Cross-Site Scripting via 'inputs' Parameter Array Key
cve-program ·
Vendor product: Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
Download Manager <= 3.3.58 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_packages Shortcode
cve-program ·
Vendor product: Download Manager
Table Field Add-on for ACF and SCF <= 1.3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via Table Cell Content
cve-program ·
Vendor product: Table Field Add-on for ACF and SCF
MP3 Audio Player <= 5.14.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
cve-program ·
Vendor product: MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar
GamiPress <= 7.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'video_id' Parameter
cve-program ·
Vendor product: GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI
Real Estate Manager <= 7.3 - Unauthenticated Stored Cross-Site Scripting via 'first_name' Parameter
cve-program ·
Vendor product: Real Estate Manager – Property Listing and Agent Management
Church Admin <= 5.1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'email' Parameter
cve-program ·
Vendor product: Church Admin
Getwid <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-image-points'
cve-program ·
Vendor product: Getwid – Gutenberg Blocks
Embed Any Document <= 2.7.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'embeddoc' Shortcode
cve-program ·
Vendor product: Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files
Presto Player <= 4.5.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content via <presto-player> Tag
cve-program ·
Vendor product: Presto Player
Kadence Blocks <= 3.7.12 - Authenticated (Author+) Stored Cross-Site Scripting via Block Font Family Attribute
cve-program ·
Vendor product: Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
GiveWP <= 4.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via givewp_campaign_grid Shortcode Attributes
cve-program ·
Vendor product: GiveWP – Donation Plugin and Fundraising Platform
Podlove Podcast Publisher <= 4.5.6 - Unauthenticated Stored Cross-Site Scripting via Auphonic Webhook
cve-program ·
Vendor product: Podlove Podcast Publisher
Data Tables Generator by Supsystic <= 1.12.03 - Authenticated (Contributor+) Stored Cross-Site Scripting via Table 'id' HTML Attribute
cve-program ·
Vendor product: Data Tables Generator by Supsystic
Simple Newsletter Plugin <= 4.3.10 - Unauthenticated Stored Cross-Site Scripting via Subscriber Custom Field via Manage Preferences Form + Campaign Preview noptin_key Pivot
cve-program ·
Vendor product: Noptin – Newsletter, New Post Notifications & Email Automation
JetFormBuilder <= 3.6.6 - Reflected DOM-Based Cross-Site Scripting via 'query_var' Dynamic Preset via data-jfb-macro / JFB_FIELD:: Macro Renderer
cve-program ·
Vendor product: JetFormBuilder — Dynamic Blocks Form Builder
Brizy <= 2.8.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'brizy-compiled-sections' Post Meta
cve-program ·
Vendor product: Brizy – Page Builder
Graphene <= 2.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Fields
cve-program ·
Vendor product: Graphene
Easy Digital Downloads <= 3.6.9 - Unauthenticated Stored Cross-Site Scripting via PayPal IPN Parameters
cve-program ·
Vendor product: Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
Download Manager <= 3.3.57 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via 'REFERRER' Parameter
cve-program ·
Vendor product: Download Manager
Quiz and Survey Master (QSM) <= 11.2.6 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'qsm_hidden_questions' Parameter
cve-program ·
Vendor product: Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
User Frontend <= 4.3.12 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpuf_payment_method' Parameter
cve-program ·
Vendor product: User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
Post Grid Gutenberg Blocks <= 5.1.0 - Unauthenticated Stored Cross-Site Scripting via display_name User Field
cve-program ·
Vendor product: Post Grid Gutenberg Blocks – PostX
VikBooking Hotel Booking Engine & PMS <= 1.8.15 - Unauthenticated Stored Cross-Site Scripting via 'attachments[name]' Parameter
cve-program ·
Vendor product: VikBooking Hotel Booking Engine & PMS
Payment Plugins for Stripe WooCommerce <= 4.0.17 - Reflected DOM-Based Cross-Site Scripting via '#response' URL Fragment
cve-program ·
Vendor product: Payment Plugins for Stripe WooCommerce
Responsive Lightbox & Gallery <= 2.7.9 - Authenticated (Editor+) Stored Cross-Site Scripting via Comment Content 'title' Attribute
cve-program ·
Vendor product: Responsive Lightbox & Gallery
Photo Reviews for WooCommerce <= 1.2.30 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'wcpr_image_upload_id' Parameter
cve-program ·
Vendor product: Photo Reviews for WooCommerce
Favicon Rotator <= 1.2.11 - Reflected Cross-Site Scripting via 'fvrt_' prefix
cve-program ·
Vendor product: Favicon Rotator
Frontend Admin by DynamiApps <= 3.28.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content
cve-program ·
Vendor product: Frontend Admin by DynamiApps
LazyLoad Plugin <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content
cve-program ·
Vendor product: LazyLoad Plugin – Lazy Load Images, Videos, and Iframes
10Web Booster <= 2.34.8 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name
cve-program ·
Vendor product: 10Web Booster – Website speed optimization, Cache & Page Speed optimizer
WP Meteor Website Speed Optimization Addon <= 3.4.18 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name
cve-program ·
Vendor product: WP Meteor Website Speed Optimization Addon
Simple Membership <= 4.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Country Field
cve-program ·
Vendor product: Simple Membership
WP Photo Album Plus <= 9.3.03.002 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Session History
cve-program ·
Vendor product: WP Photo Album Plus
FunnelKit <= 3.16.0.5 - Unauthenticated Stored Cross-Site Scripting via Order Fields (shipping/billing)
cve-program ·
Vendor product: FunnelKit – Funnel Builder for WooCommerce Checkout
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.