99496 matches found
CVE-2026-62089
CVE-2026-62089 is a Missing Authorization (Broken Access Control) vulnerability in the WordPress plugin Master Addons for Elementor by Pixar Labs, affecting versions from n/a through 3.2.2 . The flaw allows Privilege Abuse , enabling a low-privilege authenticated user to exploit the missing autho...
WordPress Master Addons for Elementor plugin <= 3.2.2 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by TurboNexic in WordPress Plugin Master Addons for Elementor versions = 3.2.2...
CVE-2026-62139 WordPress Site Kit by Google plugin <= 1.186.0 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery CSRF in Site Kit by Google = 1.186.0 versions...
CVE-2026-62138 WordPress Visual Composer Website Builder plugin <= 45.16.1 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in Visual Composer Website Builder = 45.16.1 versions...
CVE-2026-62138
A Contributor-level Cross Site Scripting (XSS) vulnerability affects the Visual Composer Website Builder WordPress plugin in versions ≤ 45.16.1 . The flaw, discovered by sungbyeongchan, allows an attacker with Contributor privileges to inject malicious scripts via user interaction. The CVSS 3.1 s...
CVE-2026-62137
An unauthenticated Sensitive Data Exposure vulnerability affects the WordPress bbPress plugin in versions 2.6.14 and earlier , as discovered by Ananda Dhakal via Patchstack . The flaw allows a remote attacker with no prior access to expose sensitive data, carrying a CVSS 3.1 score of 5.3 (Medium)...
CVE-2026-62135 WordPress Booktics plugin <= 1.0.24 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Booktics = 1.0.24 versions...
CVE-2026-62134
An Insecure Direct Object References (IDOR) vulnerability was identified in the WordPress Starter Templates plugin (versions ≤ 4.7.5 ). The flaw allows a contributor-level authenticated user to manipulate objects they should not have access to, resulting in a low integrity impact (CVSS 4.3, MEDIU...
CVE-2026-62134 WordPress Starter Templates plugin <= 4.7.5 - Insecure Direct Object References (IDOR) vulnerability
Contributor Insecure Direct Object References IDOR in Starter Templates = 4.7.5 versions...
CVE-2026-62133
WordPress plugin RTMKit (part of the Rometheme for Elementor plugin) contains a Cross-Site Request Forgery (CSRF) vulnerability in versions 2.1.5 and earlier . The vulnerability can be triggered by a user with Subscriber level privileges and was discovered by MYUNGYONG LEE . The CVSS 3.1 base sco...
CVE-2026-62132 WordPress Masteriyo - LMS plugin <= 3.4.0 - Broken Access Control vulnerability
Subscriber Broken Access Control in Masteriyo - LMS = 3.4.0 versions...
EUVD-2026-76205
Subscriber Broken Access Control in Masteriyo - LMS = 3.4.0 versions...
CVE-2026-62114 WordPress Passster plugin <= 4.3.13 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Passster = 4.3.13 versions...
CVE-2026-62114 WordPress Passster plugin <= 4.3.13 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Passster = 4.3.13 versions...
CVE-2026-62132 WordPress Masteriyo - LMS plugin <= 3.4.0 - Broken Access Control vulnerability
Subscriber Broken Access Control in Masteriyo - LMS = 3.4.0 versions...
CVE-2026-62132
CVE-2026-62132 is a Broken Access Control vulnerability affecting the Masteriyo – LMS WordPress plugin in versions ≤ 3.4.0 . The flaw allows users with the Subscriber role to bypass access controls, resulting in a low integrity impact (CVSS 3.1 score: 5.3 MEDIUM ). The vulnerability was discovere...
CVE-2026-62113 WordPress Slim SEO plugin <= 4.10.0 - Insecure Direct Object References (IDOR) vulnerability
Contributor Insecure Direct Object References IDOR in Slim SEO = 4.10.0 versions...
EUVD-2026-76207
Contributor Insecure Direct Object References IDOR in Slim SEO = 4.10.0 versions...