CVEs we hold for Meta
Records whose assigning authority named Meta as the affected vendor. Newest identifiers first, capped at 200.
CVE-2026-92752metasfresh Unauthorized Access via Document Attachments and Comments Endpointsmetasfresh
CVE-2026-9242RegistrationMagic <= 6.0.8.6 - Authenticated (Subscriber+) Authentication Bypass via Forged PayPal IPN Requestmetagauss RegistrationMagic – Custom Registration Forms…
CVE-2026-9011Ditty <= 3.1.65 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via ditty_init AJAX Actionmetaphorcreations Ditty – Responsive News Tickers, Sliders…
CVE-2026-86116Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management APImetabase
CVE-2026-82225WordPress RegistrationMagic plugin <= 6.0.9.8 - Broken Authentication vulnerabilityMetagauss RegistrationMagic
CVE-2026-82221WordPress RegistrationMagic plugin <= 6.0.9.8 - Cross Site Scripting (XSS) vulnerabilityMetagauss RegistrationMagic
CVE-2026-81274WordPress Ditty plugin <= 3.1.67 - Broken Access Control vulnerabilitymetaphorcreations Ditty
CVE-2026-73341WordPress RegistrationMagic plugin <= 6.0.9.7 - PHP Object Injection vulnerabilityMetagauss RegistrationMagic
CVE-2026-6629Metasoft 美特软件 MetaCRM Interface sql.jsp Statement.executeUpdate sql injectionMetasoft 美特软件 MetaCRM
CVE-2026-57759WordPress ProfileGrid plugin <= 5.9.9.7 - CSRF to Account Takeover vulnerabilityMetagauss ProfileGrid
CVE-2026-57697WordPress ProfileGrid plugin <= 5.9.9.6 - Broken Authentication vulnerabilityMetagauss ProfileGrid
CVE-2026-50148Metabase: Remote Code Execution via Snowflake JDBC Driver Arbitrary File Writemetabase
CVE-2026-49764WordPress RegistrationMagic plugin <= 6.0.8.6 - Broken Authentication vulnerabilityMetagauss RegistrationMagic
CVE-2026-47190IPAM controller service account granted unnecessary full access to Secretsmetal3-io ip-address-manager
CVE-2026-4610ProfileGrid <= 5.9.9.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Message Contentmetagauss ProfileGrid – User Profiles, Groups and…
CVE-2026-4609ProfileGrid <= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Group Joiningmetagauss ProfileGrid – User Profiles, Groups and…
CVE-2026-4608ProfileGrid <= 5.9.8.4 - Authenticated (Subscriber+) SQL Injection via 'rid' Parametermetagauss ProfileGrid – User Profiles, Groups and…
CVE-2026-4607ProfileGrid <= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Group Settings Modificationmetagauss ProfileGrid – User Profiles, Groups and…
CVE-2026-4245Post Duplicator <= 3.0.11 - Authorization Bypass to Authenticated (Contributor+) Post Duplicationmetaphorcreations Post Duplicator
CVE-2026-4244Post Duplicator <= 3.0.11 - Missing Authorization to Authenticated (Contributor+) Post Duplication with Arbitrary…metaphorcreations Post Duplicator
CVE-2026-39474WordPress Post Duplicator plugin <= 3.0.10 - PHP Object Injection vulnerabilitymetaphorcreations Post Duplicator
CVE-2026-39467WordPress Responsive Slider by MetaSlider plugin <= 3.106.0 - PHP Object Injection vulnerabilityMetaSlider
CVE-2026-39465WordPress Responsive Slider by MetaSlider plugin <= 3.106.0 - Remote Code Execution (RCE) vulnerabilityMetaSlider
CVE-2026-33725Metabase vulnerable to RCE and Arbitrary File Read via H2 JDBC INIT Injection in EE Serialization Importmetabase
CVE-2026-32498WordPress RegistrationMagic plugin <= 6.0.7.6 - Broken Access Control vulnerabilityMetagauss RegistrationMagic
CVE-2026-32385WordPress RegistrationMagic plugin <= 6.0.7.6 - Broken Access Control vulnerabilityMetagauss RegistrationMagic
CVE-2026-27464Metabase: Server-Side Template Injection via Notifications Endpoint Leads to RCEmetabase
CVE-2026-27355WordPress Ditty plugin <= 3.1.66 - Broken Access Control vulnerabilitymetaphorcreations Ditty
CVE-2026-25417WordPress ProfileGrid plugin <= 5.9.8.1 - Cross Site Scripting (XSS) vulnerabilityMetagauss ProfileGrid
CVE-2026-25389WordPress EventPrime plugin <= 4.2.8.3 - Sensitive Data Exposure vulnerabilityMetagauss EventPrime
CVE-2026-25312WordPress EventPrime plugin <= 4.2.8.3 - Payment Bypass vulnerabilityMetagauss EventPrime
CVE-2026-2494ProfileGrid <= 5.9.8.2 - Cross-Site Request Forgery to Group Membership Request Approval/Denialmetagauss ProfileGrid – User Profiles, Groups and…
CVE-2026-2488ProfileGrid <= 5.9.8.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Message Deletionmetagauss ProfileGrid – User Profiles, Groups and…
CVE-2026-24380WordPress EventPrime plugin <= 4.2.8.0 - Broken Access Control vulnerabilityMetagauss EventPrime
CVE-2026-24378WordPress EventPrime plugin <= 4.2.8.0 - PHP Object Injection vulnerabilityMetagauss EventPrime
CVE-2026-24374WordPress RegistrationMagic plugin <= 6.0.6.9 - Cross Site Request Forgery (CSRF) vulnerabilityMetagauss RegistrationMagic
CVE-2026-24373WordPress RegistrationMagic plugin <= 6.0.7.1 - Account Takeover vulnerabilityMetagauss RegistrationMagic
CVE-2026-2301Post Duplicator <= 3.0.8 - Missing Authorization to Authenticated (Contributor+) Protected Post Meta Insertion via…metaphorcreations Post Duplicator
CVE-2026-18400Slider, Gallery, and Carousel by MetaSlider <= 3.111.0 - Authenticated (Author+) Stored Cross-Site Scripting via…MetaSlider – Image Slider, Video Slider
CVE-2026-1657EventPrime <= 4.2.8.4 - Missing Authorization to Unauthenticated Image Upload via 'ep_upload_file_media' AJAX Endpointmetagauss EventPrime – Events Calendar, Bookings and Tickets
CVE-2026-1655EventPrime <= 4.2.8.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Event Modification via…metagauss EventPrime – Events Calendar, Bookings and Tickets
CVE-2026-15514Metasoft 美特软件 MetaCRM PHPRPC Remote Call rpc.jsp RPCService.query sql injectionMetasoft 美特软件 MetaCRM
CVE-2026-15248Meta Box < 5.13.1 - Contributor+ Arbitrary Attachment Deletion via IDORUnknown Meta Box
CVE-2026-14488Meta Box AIO <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via…Meta Box AIO
CVE-2026-13441EventPrime <= 4.3.4.2 - Unauthenticated Stored Cross-Site Scripting via 'new_event_type_background_color' Parametermetagauss EventPrime – Events Calendar, Bookings and Tickets
CVE-2026-1271ProfileGrid <= 5.9.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Profile and…metagauss ProfileGrid – User Profiles, Groups and…
CVE-2026-12158RegistrationMagic <= 6.0.9.1 - Cross-Site Request Forgery to Privilege Escalation via 'rmc_assign_user_role_action'…metagauss RegistrationMagic – Custom Registration Forms…
CVE-2026-12073ProfileGrid - User Profiles, Groups and Communities <= 5.9.9.5 - Unauthenticated Privilege Escalation via Email…metagauss ProfileGrid – User Profiles, Groups and…
CVE-2026-11359Memberships and User Profiles for WooCommerce <= 3.4 - Missing Authorization to Authenticated (Subscriber+) ProfileGrid…metagauss Memberships and User Profiles for WooCommerce –…
CVE-2026-1054RegistrationMagic <= 6.0.7.4 - Missing Authorization to Unauthenticated Arbitrary Settings Modificationmetagauss RegistrationMagic – Custom Registration Forms…
CVE-2025-6977ProfileGrid – User Profiles, Groups and Communities <= 5.9.5.4 - Reflected Cross-Site Scripting via…metagauss ProfileGrid – User Profiles, Groups and…
CVE-2025-69358WordPress EventPrime plugin <= 4.2.6.0 - Broken Access Control vulnerabilityMetagauss EventPrime
CVE-2025-6586Download Plugin <= 2.2.8 - Authenticated (Administrator+) Arbitrary File Uploadmetagauss Download Plugin
CVE-2025-63007WordPress EventPrime plugin <= 4.2.4.1 - Sensitive Data Exposure vulnerabilityMetagauss EventPrime
CVE-2025-63006WordPress EventPrime plugin <= 4.2.4.1 - Broken Access Control vulnerabilityMetagauss EventPrime
CVE-2025-60105WordPress Ditty Plugin <= 3.1.58 - Cross Site Scripting (XSS) Vulnerabilitymetaphorcreations Ditty
CVE-2025-5337Slider, Gallery, and Carousel by MetaSlider <= 3.98.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site…MetaSlider – Image Slider, Video Slider
CVE-2025-52719WordPress ProfileGrid plugin <= 5.9.5.2 - Full Path Disclosure (FPD) VulnerabilityMetagauss ProfileGrid
CVE-2025-49877WordPress ProfileGrid plugin <= 5.9.5.2 - Server Side Request Forgery (SSRF) VulnerabilityMetagauss ProfileGrid
CVE-2025-49876WordPress ProfileGrid plugin <= 5.9.5.2 - SQL Injection vulnerabilityMetagauss ProfileGrid
CVE-2025-4957WordPress ProfileGrid plugin <= 5.9.5.7 - Reflected Cross Site Scripting (XSS) vulnerabilityMetagauss ProfileGrid
CVE-2025-49033WordPress ProfileGrid plugin <= 5.9.5.3 - SQL Injection vulnerabilityMetagauss ProfileGrid
CVE-2025-48140WordPress MetalpriceAPI plugin <= 1.1.4 - Remote Code Execution (RCE) VulnerabilityMetalpriceAPI
CVE-2025-48079WordPress ProfileGrid plugin <= 5.9.5.1 - Broken Access Control VulnerabilityMetagauss ProfileGrid
CVE-2025-47478WordPress ProfileGrid plugin <= 5.9.5.0 - SQL Injection VulnerabilityMetagauss ProfileGrid
CVE-2025-46478WordPress Dropdown Content plugin <= 1.0.2 - Cross Site Scripting (XSS) Vulnerabilitymetaloha Dropdown Content
CVE-2025-39586WordPress ProfileGrid plugin <= 5.9.4.8 - SQL Injection VulnerabilityMetagauss ProfileGrid
CVE-2025-30371Metabase vulnerable to circumvention of local link access protection in GeoJson endpointmetabase
CVE-2025-29781Bare Metal Operator (BMO) can expose any secret from other namespaces via BMCEventSubscription CRDmetal3-io baremetal-operator
CVE-2025-2836RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.4.3 - Authenticated…metagauss RegistrationMagic – Custom Registration Forms…
CVE-2025-27141Metabase Enterprise Edition allows cached questions to leak data to impersonated usersmetabase
CVE-2025-26999WordPress ProfileGrid Plugin <= 5.9.4.3 - PHP Object Injection vulnerabilityMetagauss ProfileGrid
CVE-2025-26763WordPress Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider Plugin <= 3.94.0 - PHP Object…MetaSlider
CVE-2025-25110WordPress Event Kikfyre plugin <= 2.1.8 - Broken Access Control vulnerabilityMetagauss Event Kikfyre
CVE-2025-24736WordPress Post Duplicator plugin <= 2.35 - Broken Access Control vulnerabilitymetaphorcreations Post Duplicator
CVE-2025-24686WordPress RegistrationMagic Plugin <= 6.0.3.3 - Reflected Cross Site Scripting (XSS) vulnerabilityMetagauss RegistrationMagic
CVE-2025-24533WordPress MetaSlider plugin <= 3.92.0 - Cross Site Request Forgery (CSRF) vulnerabilityMetaSlider
CVE-2025-23816WordPress Metaphor Widgets plugin <= 2.4 - Stored Cross Site Scripting (XSS) vulnerabilitymetaphorcreations Metaphor Widgets
CVE-2025-15403RegistrationMagic <= 6.0.7.1 - Unauthenticated Privilege Escalation via admin_ordermetagauss RegistrationMagic – Custom Registration Forms…
CVE-2025-14675Meta Box <= 5.11.1 - Authenticated (Contributor+) Arbitrary File Deletionmetabox Meta Box
CVE-2025-14507EventPrime - Events Calendar, Bookings and Tickets <= 4.2.7.0 - Unauthenticated Sensitive Information Exposure via REST…metagauss EventPrime – Events Calendar, Bookings and Tickets
CVE-2025-14444RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.9 - Unauthenticated…metagauss RegistrationMagic – Custom Registration Forms…
CVE-2025-1408ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.4 - Missing Authorinzation to Authenticated (Subscriber+)…metagauss ProfileGrid – User Profiles, Groups and…
CVE-2025-13610RegistrationMagic <= 6.0.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'RM_Forms' Shortcodemetagauss RegistrationMagic – Custom Registration Forms…
CVE-2025-13416ProfileGrid – User Profiles, Groups and Communities <= 5.9.7.2 - Missing Authorization to Authenticated (Subscriber+)…metagauss ProfileGrid – User Profiles, Groups and…
CVE-2025-12498EventPrime – Events Calendar, Bookings and Tickets <= 4.2.0.0 - Missing Authorization to Authenticated (Subscriber+)…metagauss EventPrime – Events Calendar, Bookings and Tickets
CVE-2025-11204RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.2 - Authenticated…metagauss RegistrationMagic – Custom Registration Forms…
CVE-2025-0724ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.5 - Authenticated (Subscriber+) PHP Object Injectionmetagauss ProfileGrid – User Profiles, Groups and…
CVE-2025-0723ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.7 - Authenticated (Subscriber+) SQL Injectionmetagauss ProfileGrid – User Profiles, Groups and…
CVE-2024-9865EventPrime – Modern Events Calendar, Bookings and Tickets <= 4.0.4.7 - Unauthenticated Stored Cross-Site Scripting via…metagauss EventPrime – Events Calendar, Bookings and Tickets
CVE-2024-9864EventPrime – Modern Events Calendar, Bookings and Tickets <= 4.0.4.7 - Unauthenticated Stored Cross-Site Scriptingmetagauss EventPrime – Events Calendar, Bookings and Tickets
CVE-2024-9829Download Plugin <= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) User Metadata and Comment Downloadmetagauss Download Plugin
CVE-2024-8861ProfileGrid – User Profiles, Groups and Communities <= 5.9.3.2 - Authenticated (Contributor+) Stored Cross-Site…metagauss ProfileGrid – User Profiles, Groups and…
CVE-2024-8369EventPrime <= 4.0.4.3 - Missing Authorization to Unauthenticated Private or Password-Protected Events Disclosuremetagauss EventPrime – Events Calendar, Bookings and Tickets
CVE-2024-6411ProfileGrid – User Profiles, Groups and Communities <= 5.8.9 - Authenticated (Subscriber+) Authorization Bypass to…metagauss ProfileGrid – User Profiles, Groups and…
CVE-2024-6410ProfileGrid <= 5.8.9 - Authenticated (Subscriber+) Insecure Direct Object Referencemetagauss ProfileGrid – User Profiles, Groups and…
CVE-2024-5453ProfileGrid <= 5.8.6 - Missing Authorizationmetagauss ProfileGrid – User Profiles, Groups and…
CVE-2024-49273WordPress ProfileGrid plugin <= 5.9.3 - Cross Site Request Forgery (CSRF) vulnerabilityMetagauss ProfileGrid
CVE-2024-47648WordPress EventPrime plugin <= 4.0.4.5 - Open Redirection vulnerabilityMetagauss EventPrime
CVE-2024-43803BMO can expose particularly named secrets from other namespaces via BMH CRDmetal3-io baremetal-operator
CVE-2024-43317WordPress RegistrationMagic plugin <= 6.0.1.0 - Cross Site Scripting (XSS) vulnerabilityMetagauss User Registration Team RegistrationMagic
CVE-2024-43235WordPress Meta Box plugin <= 5.9.10 - Broken Access Control vulnerabilityMetaBox.io Meta Box – WordPress Custom Fields Framework
CVE-2024-3954Ditty – Responsive News Tickers, Sliders, and Lists <= 3.1.38 - Authenticated (Contributor+) PHP Object Injectionmetaphorcreations Ditty – Responsive News Tickers, Sliders…
CVE-2024-3606ProfileGrid – User Profiles, Memberships, Groups and Communities <= 5.8.3 - Missing Authorizationmetagauss ProfileGrid – User Profiles, Groups and…
CVE-2024-33947WordPress RegistrationMagic plugin <= 5.3.2.0 - Cross Site Scripting (XSS) vulnerabilityMetagauss RegistrationMagic
CVE-2024-3285Slider, Gallery, and Carousel by MetaSlider – Responsive WordPress Slideshows <= 3.70.0 - Authenticated (Contributor+)…MetaSlider – Image Slider, Video Slider
CVE-2024-32808WordPress ProfileGrid plugin <= 5.7.9 - Insecure Direct Object Reference (IDOR) vulnerabilityMetagauss ProfileGrid
CVE-2024-32774WordPress ProfileGrid plugin <= 5.8.2 - Group Members Limit Bypass vulnerabilityMetagauss ProfileGrid
CVE-2024-32772WordPress ProfileGrid plugin <= 5.7.9 - Insecure Direct Object References (IDOR) vulnerabilityMetagauss ProfileGrid
CVE-2024-32569WordPress Ditty plugin <= 3.1.31 - Cross Site Scripting (XSS) vulnerabilityMetaphor Creations Ditty
CVE-2024-31362WordPress ProfileGrid – User Profiles, Memberships, Groups and Communities plugin <= 5.7.8 - Cross Site Request Forgery…Metagauss ProfileGrid
CVE-2024-31291WordPress ProfileGrid plugin <= 5.7.6 - IDOR on Friend Request vulnerabilityMetagauss ProfileGrid
CVE-2024-31275WordPress EventPrime plugin <= 3.3.4 - Booking Price Manipulation vulnerabilityMetagauss EventPrime
CVE-2024-30513WordPress ProfileGrid plugin <= 5.7.2 - Insecure Direct Object References (IDOR) vulnerabilityMetagauss ProfileGrid
CVE-2024-30491WordPress ProfileGrid – User Profiles, Memberships, Groups and Communities plugin <= 5.7.8 - SQL Injection vulnerabilityMetagauss ProfileGrid
CVE-2024-30490WordPress ProfileGrid plugin <= 5.7.8 - SQL Injection vulnerabilityMetagauss ProfileGrid
CVE-2024-30241WordPress ProfileGrid – User Profiles, Memberships, Groups and Communities plugin <= 5.7.1 - Contributor+ SQL Injection…Metagauss ProfileGrid
CVE-2024-29776WordPress EventPrime plugin <= 3.3.9 - Cross Site Scripting (XSS) vulnerabilityMetagauss EventPrime
CVE-2024-2951WordPress RegistrationMagic plugin <= 5.3.0.0 - Cross Site Request Forgery (CSRF) vulnerabilityMetagauss RegistrationMagic
CVE-2024-29113WordPress RegistrationMagic plugin <= 5.2.5.9 - Reflected Cross Site Scripting (XSS) vulnerabilityMetagauss RegistrationMagic
CVE-2024-27284cassandra-rs non-idiomatic use of iterators leads to use after freeMetaswitch cassandra-rs
CVE-2024-25935WordPress RegistrationMagic plugin <= 5.2.5.9 - Broken Access Control vulnerabilityMetagauss RegistrationMagic
CVE-2024-24832WordPress EventPrime plugin <= 3.3.9 - Broken Access Control vulnerabilityMetagauss EventPrime
CVE-2024-1991RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 5.3.0.0 - Authenticated…metagauss RegistrationMagic – Custom Registration Forms…
CVE-2024-1990RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 5.3.1.0 - Authenticated…metagauss RegistrationMagic – Custom Registration Forms…
CVE-2024-13741ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.2 - Authenticated (Subscriber+) Limited Server-Side…metagauss ProfileGrid – User Profiles, Groups and…
CVE-2024-13740ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.2 - Insecure Direct Object Reference to Authenticated…metagauss ProfileGrid – User Profiles, Groups and…
CVE-2024-13526EventPrime – Events Calendar, Bookings and Tickets <= 4.0.7.3 - Missing Authorization to Authenticated (Subscriber+)…metagauss EventPrime – Events Calendar, Bookings and Tickets
CVE-2024-1321EventPrime – Events Calendar, Bookings and Tickets <= 3.4.2 - Unauthenticated Booking Payment Bypassmetagauss EventPrime – Events Calendar, Bookings and Tickets
CVE-2024-1320EventPrime – Events Calendar, Bookings and Tickets <= 3.4.3 - Unauthenticated Stored Cross-Site Scriptingmetagauss EventPrime – Events Calendar, Bookings and Tickets
CVE-2024-12472Post Duplicator <= 2.36 - Authenticated (Contributor+) Protected Post Disclosuremetaphorcreations Post Duplicator
CVE-2024-1204Meta Box < 5.9.4 - Contributor+ Arbitrary Posts' Custom Field DisclosureUnknown Meta Box
CVE-2024-12024EventPrime – Events Calendar, Bookings and Tickets <= 4.0.7.3 - Unauthenticated Stored Cross-Site Scripting via Ticket…metagauss EventPrime – Events Calendar, Bookings and Tickets
CVE-2024-1127EventPrime – Events Calendar, Bookings and Tickets <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+)…metagauss EventPrime – Events Calendar, Bookings and Tickets
CVE-2024-1126EventPrime – Events Calendar, Bookings and Tickets <= 3.4.2 - Missing Authorization to Authenticated (Subscriber+)…metagauss EventPrime – Events Calendar, Bookings and Tickets
CVE-2024-1125EventPrime – Events Calendar, Bookings and Tickets <= 3.4.3 - Missing Authorization to Authenticated (Subscriber+)…metagauss EventPrime – Events Calendar, Bookings and Tickets
CVE-2024-1124EventPrime – Events Calendar, Bookings and Tickets <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+)…metagauss EventPrime – Events Calendar, Bookings and Tickets
CVE-2024-1123EventPrime – Events Calendar, Bookings and Tickets <= 3.4.2 - Missing Authorization to Arbitrary Post Overwritemetagauss EventPrime – Events Calendar, Bookings and Tickets
CVE-2024-10900ProfileGrid – User Profiles, Groups and Communities <= 5.9.3.6 - Missing Authorization to Authenticated (Subscriber+)…metagauss ProfileGrid – User Profiles, Groups and…
CVE-2024-10508RegistrationMagic – User Registration Plugin with Custom Registration Forms <= 6.0.2.6 - Unauthenticated Privilege…metagauss RegistrationMagic – Custom Registration Forms…
CVE-2023-6526Meta Box – WordPress Custom Fields Framework <= 5.9.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingmetabox Meta Box
CVE-2023-52117WordPress ProfileGrid plugin <= 5.6.6 - Broken Access Control vulnerabilityMetagauss ProfileGrid
CVE-2023-51544WordPress RegistrationMagic plugin <= 5.2.5.0 - Form Submission Limit Bypass vulnerabilityMetagauss RegistrationMagic
CVE-2023-51543WordPress RegistrationMagic plugin <= 5.2.5.0 - IP Limit Bypass vulnerabilityMetagauss RegistrationMagic
CVE-2023-51509WordPress RegistrationMagic Plugin <= 5.2.4.1 is vulnerable to Cross Site Scripting (XSS)Metagauss RegistrationMagic – Custom Registration Forms…
CVE-2023-49835WordPress Post Duplicator plugin <= 2.31 - Broken Access Control vulnerabilityMetaphor Creations Post Duplicator
CVE-2023-49831WordPress RegistrationMagic plugin <= 5.2.3.0 - Broken Access Control vulnerabilityMetagauss RegistrationMagic
CVE-2023-47764WordPress Ditty plugin <= 3.1.24 - Broken Access Control vulnerabilitymetaphorcreations Ditty
CVE-2023-37470Metabase vulnerable to remote code execution via POST /api/setup/validate API endpointmetabase
CVE-2023-3714ProfileGrid <= 5.5.2 - Missing Authorization to Arbitrary Group Option Modification and Privilege Escalationmetagauss ProfileGrid – User Profiles, Groups and…
200 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.
Everything on this page is free. Public data. Withholding it protects nothing.