275629 matches found
CVE-2026-28162 WordPress Events Made Easy plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Events Made Easy = 3.2.5 versions...
CVE-2026-28162
CVE-2026-28162 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Events Made Easy (versions ≤ 3.2.5 ). The vulnerability allows a remote unauthenticated attacker to inject and execute arbitrary script in another user's browser, with a CVSS 3.1 base score of 7....
CVE-2026-28153 WordPress Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More plugin <= 1.7.1 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Notification Master Real-Time WordPress Notifications With Email, SMS, Webhooks & More = 1.7.1 versions...
EUVD-2026-64792
Unauthenticated Broken Access Control in Notification Master Real-Time WordPress Notifications With Email, SMS, Webhooks & More = 1.7.1 versions...
CVE-2026-28153
Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More plugin (versions
CVE-2026-28152 WordPress Tonda Core plugin < 2.6 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Tonda Core 2.6 versions...
CVE-2026-28151 WordPress Tonda theme < 2.6 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Tonda 2.6 versions...
CVE-2026-66671 WordPress Verdure Core plugin <= 1.2 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Verdure Core = 1.2 versions...
CVE-2026-78290 WordPress Magazine Blocks plugin <= 1.8.6 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in Magazine Blocks = 1.8.6 versions...
CVE-2026-78280 WordPress Hash Form plugin <= 1.4.0 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery CSRF in Hash Form = 1.4.0 versions...
CVE-2026-78279 WordPress Fluent Support Pro plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery CSRF in Fluent Support Pro = 2.3.1 versions...
CVE-2026-78277 WordPress FluentCRM Pro plugin <= 3.1.12 - Server Side Request Forgery (SSRF) vulnerability
Subscriber Server Side Request Forgery SSRF in FluentCRM Pro = 3.1.12 versions...
CVE-2026-78278
Fluent Boards Pro is a WordPress plugin affected by a Subscriber-level Insecure Direct Object Reference (IDOR) vulnerability in versions ≤ 2.0.11 . The flaw is reachable over the network with no privileges required and low attack complexity , allowing an unauthenticated attacker to access objects...
CVE-2026-78278 WordPress Fluent Boards Pro plugin <= 2.0.11 - Insecure Direct Object References (IDOR) vulnerability
Subscriber Insecure Direct Object References IDOR in Fluent Boards Pro = 2.0.11 versions...
CVE-2026-78272 WordPress Fluent Support Pro plugin <= 2.3.1 - Broken Access Control vulnerability
Subscriber Broken Access Control in Fluent Support Pro = 2.3.1 versions...
CVE-2026-78270 WordPress FluentCRM Pro plugin <= 3.1.12 - SQL Injection vulnerability
Author SQL Injection in FluentCRM Pro = 3.1.12 versions...
CVE-2026-78269 WordPress Shared Files plugin <= 1.7.69 - Server Side Request Forgery (SSRF) vulnerability
Contributor Server Side Request Forgery SSRF in Shared Files = 1.7.69 versions...
CVE-2026-78258 WordPress Booking and Rental Manager plugin <= 2.7.5 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Booking and Rental Manager = 2.7.5 versions...
CVE-2026-66623
CVE-2026-66623 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Social Media & Share Icons (also known as Ultimate Social Media Icons), affecting versions 2.9.9 and below . The vulnerability was discovered by Bonds and carries a CVSS 3.1 score of 7.1 (HIGH) ,...