99624 matches found
CVE-2026-81798 WordPress Easy Appointments plugin <= 4.0.2.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Easy Appointments allows DOM-Based XSS. This issue affects Easy Appointments: from n/a through 4.0.2.1...
CVE-2026-84818 WordPress Open User Map plugin <= 1.4.50 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Open User Map = 1.4.50 versions...
CVE-2026-84817 WordPress JetFormBuilder plugin <= 3.6.5.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in JetFormBuilder = 3.6.5.1 versions...
CVE-2026-84817
CVE-2026-84817 is an unauthenticated Cross-Site Scripting (XSS) vulnerability affecting the WordPress JetFormBuilder plugin in versions 3.6.5.1 and earlier . The flaw is reachable over the network with low complexity and no prior authentication, though user interaction is required. The CVSS 3.1 s...
CVE-2026-81802 WordPress WpEvently plugin <= 5.6.0 - Insecure Direct Object References (IDOR) vulnerability
Unauthenticated Insecure Direct Object References IDOR in WpEvently = 5.6.0 versions...
CVE-2026-81802 WordPress WpEvently plugin <= 5.6.0 - Insecure Direct Object References (IDOR) vulnerability
Unauthenticated Insecure Direct Object References IDOR in WpEvently = 5.6.0 versions...
CVE-2026-81802
WpEvently (WordPress plugin, also listed as Mage EventPress) versions ≤ 5.6.0 contain an unauthenticated Insecure Direct Object Reference (IDOR) vulnerability. The CVSS 3.1 score is 6.5 (Medium) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, indicating a network-exploitable issue requiring...
CVE-2026-84820 WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.17 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Unlimited Elements For Elementor Free Widgets, Addons, Templates = 2.0.17 versions...
CVE-2026-84820
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin versions
WordPress Beaver Builder Page Builder – Drag and Drop Website Builder plugin <= 2.10.3.1 - Unauthenticated Arbitrary Shortcode Execution vulnerability
Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Kishan Vyas in WordPress Plugin Beaver Builder versions = 2.10.3.1...
WordPress WPML Multilingual CMS plugin <= 4.9.5 - Incorrect Authorization to Authenticated (Subscriber+) SQL Injection vulnerability
Incorrect Authorization to Authenticated Subscriber+ SQL Injection vulnerability discovered by h0xilo in WordPress Plugin Multilingual CMS versions = 4.9.5...
WordPress Event Tickets and Registration plugin <= 5.27.4 - Missing Authorization to Unauthenticated Stripe Credentials Update vulnerability
Missing Authorization to Unauthenticated Stripe Credentials Update vulnerability discovered by h0xilo in WordPress Plugin Event Tickets versions = 5.27.4...
PT-2026-87028
The WPML Multilingual CMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘elementIds’ parameter in all versions up to, and including, 4.9.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes ...
WordPress Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin <= 4.1.22 - Missing Authorization to Unauthenticated Arbitrary Order Creation and Status Manipulation vulnerability
Missing Authorization to Unauthenticated Arbitrary Order Creation and Status Manipulation vulnerability discovered by Wordfence PRISM in WordPress Plugin WP Event Solution versions = 4.1.22...
PT-2026-87033
The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 3.3.205 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Custom-level...
PT-2026-87029
The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.10.3.1. This is due to the software allowing users to execute an action that does not properly validate a value before...
PT-2026-87031
The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Stripe OAuth return endpoint in all versions up to, and including, 5.27.4. This makes it possible for unauthenticated attackers to overwrite the site...
PT-2026-87027
The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.18 via deserialization of untrusted input . This makes it possible for authenticated attackers, with contributor-level access and above, to injec...
WordPress Graphina – Charts and Graphs For Elementor plugin <= 3.1.11 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability
Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by Athiwat Tiprasaharn Jitlada, Itthidej Aramsri Boeing777 in WordPress Plugin Graphina versions = 3.1.11...