273137 matches found
CVE-2026-73354
The WordPress SimplyRETS Real Estate IDX plugin (≤ 3.2.8) allows unauthenticated reflected/stored XSS due to insufficient input sanitization. CVSS 7.1 (HIGH) reflects network exposure requiring user interaction. No in-the-wild exploitation is reported. PatchStack notes a fix is available; upgrade...
CVE-2026-73354 WordPress SimplyRETS Real Estate IDX plugin <= 3.2.8 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in SimplyRETS Real Estate IDX = 3.2.8 versions...
CVE-2026-73347
The WordPress TrueBooker appointment booking plugin (versions ≤ 1.2.6) allows unauthenticated remote attackers to escalate privileges, scoring CVSS 9.8 (CRITICAL). No patch version or exploit details are provided in the documents; users should upgrade once a patched release is available.
EUVD-2026-62381
Unauthenticated Privilege Escalation in TrueBooker = 1.2.6 versions...
CVE-2026-73347 WordPress TrueBooker plugin <= 1.2.6 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in TrueBooker = 1.2.6 versions...
EUVD-2026-62379
Unauthenticated Cross Site Scripting XSS in Global Gallery = 11.1.2 versions...
CVE-2026-73184
The WordPress Global Gallery plugin (versions ≤ 11.1.2) contains an unauthenticated reflected/stored XSS vulnerability exploitable via a crafted URL; no specific vulnerable file or root cause is documented. CVSS 3.1 scores it HIGH (7.1) with network attack vector and no authentication required. P...
CVE-2026-73184 WordPress Global Gallery plugin <= 11.1.2 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Global Gallery = 11.1.2 versions...
EUVD-2026-62380
Unauthenticated SQL Injection in NGG Smart Image Search 4.0.0 versions...
CVE-2026-73185 WordPress NGG Smart Image Search plugin < 4.0.0 - SQL Injection vulnerability
Unauthenticated SQL Injection in NGG Smart Image Search 4.0.0 versions...
CVE-2026-73183 WordPress Maps Marker Pro plugin <= 4.32 - SQL Injection vulnerability
Unauthenticated SQL Injection in Maps Marker Pro = 4.32 versions...
CVE-2026-73182
Unauthenticated reflected XSS affects BBQ Pro plugin (WordPress) up to version 3.9, rated CVSS 7.1 (HIGH). No exploitation or patch details are provided; CISA SSVC assesses partial technical impact. Upgrade to a version newer than 3.9 once available and monitor Patchstack advisories. Exploitation...
CVE-2026-73182 WordPress BBQ Pro plugin <= 3.9 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in BBQ Pro = 3.9 versions...
CVE-2026-66668 WordPress Community by PeepSo plugin <= 9.0.5.2 - SQL Injection vulnerability
Subscriber SQL Injection in Community by PeepSo = 9.0.5.2 versions...
CVE-2026-66613 WordPress JetEngine plugin <= 3.8.14 - Remote Code Execution (RCE) vulnerability
Unauthenticated Remote Code Execution RCE in JetEngine = 3.8.14 versions...
CVE-2026-66596 WordPress Newsletter plugin <= 9.3.3 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Newsletter = 9.3.3 versions...
CVE-2026-32552 WordPress YITH WooCommerce Membership Premium plugin <= 2.33.0 - SQL Injection vulnerability
Subscriber SQL Injection in YITH WooCommerce Membership Premium = 2.33.0 versions...
CVE-2026-61986
CVE-2026-61986 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress Contest Gallery plugin , affecting versions 30.0.5 and earlier . The flaw allows an unauthenticated attacker to inject malicious scripts, with a CVSS 3.1 base score of 7.1 (HIGH) — network vector, low c...