88809 matches found
CVE-2026-14207 LifterLMS < 10.0.10 - Instructor+ Stored XSS via Featured Pricing Information
The LifterLMS WordPress plugin before 10.0.10 does not strip event-handler attributes from a course pricing field before storing and rendering it, allowing users with a course-editing role to inject JavaScript that executes in the session of an administrator who views the course...
CVE-2026-15054
The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on its public form-submission handlers, allowing unauthenticated users to submit entries to, and fire the configured workflows such as email notifications of forms the site owner has deactivated or...
CVE-2026-15153 WP Hotel Booking < 2.3.2 - Hotel Manager+ SQL Injection via Booking List Search
The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an administrative listing before using it in a SQL query, allowing users holding the WP Hotel Booking WordPress plugin before 2.3.2's booking-management roles to perform SQL injection attacks...
EUVD-2026-50989
The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on its public form-submission handlers, allowing unauthenticated users to submit entries to, and fire the configured workflows such as email notifications of forms the site owner has deactivated or...
CVE-2026-15054 Bit Form < 3.1.2 - Unauthenticated Inactive Form Submission
The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on its public form-submission handlers, allowing unauthenticated users to submit entries to, and fire the configured workflows such as email notifications of forms the site owner has deactivated or...
CVE-2026-15153
The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an administrative listing before using it in a SQL query, allowing users holding the WP Hotel Booking WordPress plugin before 2.3.2's booking-management roles to perform SQL injection attacks...
CVE-2026-15153
The CVE-2026-15153 entry concerns the WP Hotel Booking WordPress plugin (versions prior to 2.3.2). The underlying issue is that a search parameter on an administrative listing is not properly sanitised or escaped before its value is interpolated into a SQL query, enabling SQL injection by users w...
EUVD-2026-50988
The Sync Post With Other Site WordPress plugin before 1.9.3 does not correctly enforce the page-editing capability on a REST route that creates and updates posts, because of an operator-precedence flaw in its authorization check. An authenticated user holding only the post-editing capability such...
CVE-2026-14226
The Easy Appointments WordPress plugin before 3.12.28 does not require a sufficient capability on one of its appointment-listing REST endpoints, restricting it only to a capability that every authenticated user holds, allowing users with subscriber-level access to read all bookings on the site,...
CVE-2026-14923 Sync Post With Other Site < 1.9.3 - Contributor+ Arbitrary Page Creation/Modification
The Sync Post With Other Site WordPress plugin before 1.9.3 does not correctly enforce the page-editing capability on a REST route that creates and updates posts, because of an operator-precedence flaw in its authorization check. An authenticated user holding only the post-editing capability such...
CVE-2026-14923
The CVE-2026-14923 entry applies to the WordPress plugin Sync Post With Other Site, affecting versions before 1.9.3. The issue is an operator-precedence flaw in the REST route’s authorization check, which fails to properly enforce page-editing capability. As a result, an authenticated user with o...
EUVD-2026-50986
The WP Real IP-based Access Control WordPress plugin through 1.3.1 does not perform any capability or nonce checks before storing one of its option values, and does not escape that value on output on its settings page, allowing unauthenticated users to store arbitrary JavaScript that executes in...
CVE-2026-14226 Easy Appointments < 3.12.28 - Subscriber+ Sensitive Information Disclosure via REST Appointments Listing
The Easy Appointments WordPress plugin before 3.12.28 does not require a sufficient capability on one of its appointment-listing REST endpoints, restricting it only to a capability that every authenticated user holds, allowing users with subscriber-level access to read all bookings on the site,...
CVE-2026-14592 WP Real IP-based Access Control <= 1.3.1 - Unauthenticated Stored XSS via acl_ctrl_addr
The WP Real IP-based Access Control WordPress plugin through 1.3.1 does not perform any capability or nonce checks before storing one of its option values, and does not escape that value on output on its settings page, allowing unauthenticated users to store arbitrary JavaScript that executes in...
EUVD-2026-50987
The Remote API WordPress plugin through 0.2 does not authenticate a request before deserializing user-supplied input, allowing unauthenticated attackers to inject arbitrary PHP objects, which can lead to remote code execution when a suitable gadget chain is present through another installed Remot...
CVE-2026-14226
The Easy Appointments WordPress plugin (up to version 3.12.26) exposes an appointment-listing REST endpoint that does not enforce a sufficient capability, restricting access to a capability held by all authenticated users. This allows subscriber-level users to read all bookings on the site, inclu...
EUVD-2026-50985
The Easy Appointments WordPress plugin through 3.12.26 does not require a sufficient capability on one of its appointment-listing REST endpoints, restricting it only to a capability that every authenticated user holds, allowing users with subscriber-level access to read all bookings on the site,...
CVE-2026-14592
The CVE-2026-14592 entry concerns the WP Real IP-based Access Control WordPress plugin (up to version 1.3.1). The root cause is that the plugin does not perform any capability or nonce checks before storing an option value and does not escape that value on output on the settings page, enabling un...
CVE-2026-14602
The CVE-2026-14602 entry concerns the Remote API WordPress plugin (version <= 0.2). The issue is that it does not authenticate a request before deserializing user-supplied input, allowing unauthenticated attackers to inject arbitrary PHP objects. This can lead to remote code execution when a s...
CVE-2026-14223
The Easy Appointments WordPress plugin before 3.12.28 does not verify ownership or capability when returning stored customer details, allowing users with subscriber-level access to read any customer's personal information by iterating an identifier...