88177 matches found
WordPress Ultra Addons for Contact Form 7 plugin <= 3.5.43 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Webbernaut in WordPress Plugin Ultimate Addons for Contact Form 7 versions = 3.5.43...
CVE-2026-3430
The Creative Mail WordPress plugin from 1.6.5 to 1.6.9 does not sanitize and escape a parameter before using in an SQL statement, leading to an unauthenticated SQL injection when the abandoned cart email is managed by creative mail...
CVE-2026-66663
Unauthenticated Cross Site Scripting XSS in WP Data Access = 5.5.79 versions...
CVE-2026-65553
Unauthenticated Remote Code Execution RCE in Spider Analyser WordPress搜索引擎蜘蛛分析插件 = 2.1.3 versions...
CVE-2026-65509
Unauthenticated Cross Site Scripting XSS in wpDataTables = 7.5.1 versions...
CVE-2026-65520
Unauthenticated SQL Injection in WP OAuth Server = 6.2.0 versions...
CVE-2026-61982
Unauthenticated Cross Site Scripting XSS in SiteGuard WP Plugin = 1.8.6 versions...
CVE-2026-32469
Unauthenticated Bypass Vulnerability in CAPTCHA 4WP = 7.6.0 versions...
CVE-2026-15246
The RealHomes Memberships WordPress plugin before 3.1.0 does not verify that a membership payment actually completed, nor check a nonce or the user's capability, before granting a paid membership package, allowing any authenticated user such as a Subscriber to obtain paid membership packages...
EUVD-2026-54088
The Creative Mail WordPress plugin from 1.6.5 to 1.6.9 does not sanitize and escape a parameter before using in an SQL statement, leading to an unauthenticated SQL injection when the abandoned cart email is managed by creative mail...
CVE-2026-3430 Creative Mail 1.6.5 - 1.6.9 - Unauthenticated SQLi
The Creative Mail WordPress plugin from 1.6.5 to 1.6.9 does not sanitize and escape a parameter before using in an SQL statement, leading to an unauthenticated SQL injection when the abandoned cart email is managed by creative mail...
CVE-2026-3430
CVE-2026-3430 affects the Creative Mail WordPress plugin versions 1.6.5–1.6.9. The issue is an unauthenticated SQL injection caused by not sanitizing/escaping a parameter before use in an SQL statement when handling abandoned cart emails. CVSS 3.1 metrics (from WPScan) indicate NETWORK attack vec...
CVE-2026-66711
CVE-2026-66711 concerns a Cross Site Scripting (XSS) vulnerability in the WordPress plugin WooCommerce Multilingual & Multicurrency, affecting versions up to and including 5.5.6. The connected documents confirm the affected product and the XSS vulnerability type but do not provide technical explo...
CVE-2026-66709 WordPress CTX Feed plugin <= 6.6.42 - Remote Code Execution (RCE) vulnerability
Shop manager Remote Code Execution RCE in CTX Feed = 6.6.42 versions...
CVE-2026-66710 WordPress e2pdf plugin <= 1.32.40 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in e2pdf = 1.32.40 versions...
CVE-2026-66708 WordPress Total Upkeep plugin <= 1.17.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Total Upkeep = 1.17.2 versions...
CVE-2026-66707 WordPress Facebook for WooCommerce plugin <= 3.7.5 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Facebook for WooCommerce = 3.7.5 versions...
CVE-2026-66707
CVE-2026-66707 describes an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Facebook for WooCommerce up to version 3.7.5. The CVE is documented across multiple sources (NVD, CVE List, EUVD, Patchstack). The vulnerability affects the plugin’s handling of input that...