EUVD-2026-54882

The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated attackers to bind their own key, hijack an administrator sessio...

CVE-2026-18473

Affected product: WP Directory Kit WordPress plugin prior to 1.5.5. Vulnerable component: parameter handling in field_search where input is unsafely used in a SQL statement. Root cause: insufficient sanitisation/escaping leading to SQL injection. Impact: unauthenticated attackers can exploit the ...

EUVD-2026-54876

The Create WordPress plugin before 2.5.4 does not perform an authorization check before rendering content over one of its public REST API routes, and that route additionally publishes the requested content as a side effect, allowing unauthenticated attackers to read unpublished content and to mak...

EUVD-2026-54880

The WP Directory Kit WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

EUVD-2026-54879

The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not properly validate a user-controlled path before using it in a file inclusion, allowing unauthenticated attackers to include...

CVE-2026-18603

The CVE concerns the PiWeb Cancel order / Refund request plugin for WooCommerce (WordPress) prior to version 1.3.4.34. The issue is a lack of authorization/ownership checks when adding contents of a previous order to the cart, enabling unauthenticated users to disclose other customers’ order cont...

CVE-2026-18464

The CVE‑2026‑18464 entry concerns the WP MAPS PRO WordPress plugin prior to 6.1.3. A capability check is missing in an AJAX action that is accessible to unauthenticated users, and the dispatched operation is not restricted. This allows unauthenticated attackers to trigger uncontrolled recursion, ...

CVE-2026-18465

The CVE refers to the WP MAPS PRO WordPress plugin (pre-6.1.3) where an AJAX action, reachable without authentication, lacks a capability check and improperly validates a user-controlled path before a file inclusion. This enables unauthenticated attackers to include and execute arbitrary existing...

CVE-2026-18037

The CVE concerns the Create WordPress plugin (before 2.5.4). A public REST API route does not perform an authorization check, and renders content while also publishing it as a side effect, allowing unauthenticated disclosure of unpublished content and public publication of that content. Affected:...

CVE-2026-18357

The CVE-2026-18357 affects the WPC Order Tip for WooCommerce WordPress plugin prior to version 3.3.1. The vulnerability arises because a reporting feature does not perform authorization or nonce checks, allowing unauthenticated access to sensitive customer order data such as billing names, order ...

EUVD-2026-54878

The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not restrict the operation it dispatches, allowing unauthenticated attackers to trigger uncontrolled recursion that exhausts...

EUVD-2026-54893

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public REST endpoint actions, allowing unauthenticated users to delete the generated album export ZIP archives it stores...

EUVD-2026-54891

The Create WordPress plugin before 2.5.4 does not perform an authorization check before returning content over one of its REST API routes, and that route additionally publishes the requested content as a side effect, allowing unauthenticated attackers to read unpublished content and to make it...

EUVD-2026-54895

The WP Data Access WordPress plugin before 5.5.79 does not validate the column names it accepts on one of its unauthenticated AJAX actions, and the nonce guarding that action does not cover them, allowing unauthenticated attackers to read arbitrary columns of the database table the affected...

CVE-2026-17044

The CVE concerns the Iptanus File Upload WordPress plugin, affected if using versions before 5.1.8. The underlying issue is improper sanitisation/escaping of a parameter prior to its use in a SQL statement, enabling an SQL injection by unauthenticated users. This is confirmed across the NVD/NVD-d...

CVE-2026-16992

The CVE-2026-16992 entry concerns the Create WordPress plugin (before 2.5.4). A REST API route does not perform an authorization check and, as a side effect, returns the requested content, enabling unauthenticated attackers to read unpublished content and to publish it publicly. The available sou...

EUVD-2026-54259

CTI-Transmute contains a stored cross-site scripting vulnerability caused by insufficient neutralization of Vue template expression delimiters in server-rendered user-controlled data. An unauthenticated attacker can create a public conversion whose name or description contains a malicious Vue...

Exploit for CVE-2026-64638

XSS2Shell — CVE-2026-64638 PoC WordPress Pre-Auth XSS → RCE e...

Emerson Dixell XWEB-500 - Arbitrary File Write

Emerson Dixell XWEB-500 contains an arbitrary file write caused by unauthenticated access to /cgi-bin/logoextraupload.cgi, /cgi-bin/calsave.cgi, and /cgi-bin/loutils.cgi, letting attackers write any file on the system, exploit requires no authentication. id: CVE-2021-45420 info: name: Emerson...

Sassy Social Share <= 3.3.3 - Cross-Site Scripting

The Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'urls' parameter called via the 'heateorssssharingcount' AJAX action in versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for...