275629 matches found
CVE-2026-66648 WordPress Jawn theme <= 1.4.2 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Jawn = 1.4.2 versions...
CVE-2026-66610 WordPress Urna theme <= 2.6.2 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Urna = 2.6.2 versions...
CVE-2026-66587
WP Cafe Pro is a WordPress plugin affected by an unauthenticated Local File Inclusion (LFI) vulnerability in versions prior to 3.0.15 . Discovered by Ananda Dhakal via Patchstack, the flaw requires no authentication or user interaction and is scored CVSS 9.8 (Critical) with full confidentiality, ...
CVE-2026-66585 WordPress WP Cafe Pro plugin < 3.0.15 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in WP Cafe Pro 3.0.15 versions...
CVE-2026-66587 WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in WP Cafe Pro 3.0.15 versions...
EUVD-2026-64804
Unauthenticated Privilege Escalation in Affiliate Pro - Affiliate Program for WooCommerce & WordPress = 8.9.1 versions...
CVE-2026-32558 WordPress Affiliate Pro - Affiliate Program for WooCommerce & WordPress plugin <= 8.9.1 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Affiliate Pro - Affiliate Program for WooCommerce & WordPress = 8.9.1 versions...
CVE-2026-32558
Affiliate Pro – Affiliate Program for WooCommerce & WordPress , a WordPress plugin, is affected by an unauthenticated privilege escalation vulnerability in versions 8.9.1 and below . An attacker over the network can escalate privileges without prior authentication or user interaction, resulting i...
CVE-2026-32551 WordPress Woo Essential plugin <= 4.3.0 - SQL Injection vulnerability
Unauthenticated SQL Injection in Woo Essential = 4.3.0 versions...
CVE-2026-32478 WordPress WP Project Manager Pro plugin <= 4.0.1 - SQL Injection vulnerability
Subscriber SQL Injection in WP Project Manager Pro = 4.0.1 versions...
EUVD-2026-64802
Subscriber SQL Injection in WP Project Manager Pro = 4.0.1 versions...
CVE-2026-32478
CVE-2026-32478 is a Subscriber-level SQL Injection vulnerability in the WP Project Manager Pro WordPress plugin (versions ≤ 4.0.1 ), discovered by researcher dutafi . The flaw allows a user with the low-privilege Subscriber role to execute arbitrary SQL queries, resulting in high confidentiality ...
CVE-2026-32476 WordPress Brave Conversion Engine (PRO) plugin <= 0.8.6 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Brave Conversion Engine PRO = 0.8.6 versions...
CVE-2026-32471 WordPress ProLancer Element plugin <= 1.4.8 - SQL Injection vulnerability
Subscriber SQL Injection in ProLancer Element = 1.4.8 versions...
CVE-2026-28171 WordPress WooCommerce File Approval plugin <= 10.7 - Arbitrary File Deletion vulnerability
Unauthenticated Arbitrary File Deletion in WooCommerce File Approval = 10.7 versions...
CVE-2026-28190 WordPress ProLancer Element plugin <= 1.4.8 - Broken Access Control vulnerability
Subscriber Broken Access Control in ProLancer Element = 1.4.8 versions...
CVE-2026-28167 WordPress Super Forms plugin <= 6.3.315 - Arbitrary File Download vulnerability
Unauthenticated Arbitrary File Download in Super Forms = 6.3.315 versions...
EUVD-2026-64795
Unauthenticated Cross Site Scripting XSS in Tourmaster = 5.4.9 versions...