275666 matches found
CVE-2026-74019
CVE-2026-74019 is an unauthenticated Broken Access Control vulnerability in the EPROLO Dropshipping WordPress plugin, affecting versions ≤ 2.4.2 . The vulnerability was discovered by hivesec and allows an unauthenticated attacker to access restricted functionality or data, resulting in high confi...
CVE-2026-74018 WordPress Warehouse Cargo theme <= 2.6.9 - Arbitrary File Upload vulnerability
Subscriber Arbitrary File Upload in Warehouse Cargo = 2.6.9 versions...
EUVD-2026-63318
Subscriber Arbitrary File Upload in Warehouse Cargo = 2.6.9 versions...
CVE-2026-74016 WordPress Smart Cleaning theme <= 4.8.6 - Arbitrary File Upload vulnerability
Subscriber Arbitrary File Upload in Smart Cleaning = 4.8.6 versions...
CVE-2026-74014
A Subscriber (low-privileged WordPress user) in the IT Residence theme
CVE-2026-74014 WordPress IT Residence theme <= 3.2.1 - Arbitrary File Upload vulnerability
Subscriber Arbitrary File Upload in IT Residence = 3.2.1 versions...
CVE-2026-74013 WordPress eShipper Commerce plugin <= 2.16.13 - SQL Injection vulnerability
Subscriber SQL Injection in eShipper Commerce = 2.16.13 versions...
CVE-2026-73998
The WordPress WP w3all phpBB plugin (≤ 3.0.5) has a SQL injection vulnerability exploitable by authenticated subscribers with network access; no patch version or in-the-wild exploitation details are provided in the documents.
CVE-2026-74001 WordPress User Registration & Membership Pro plugin <= 5.4.5 - Account Takeover vulnerability
Unauthenticated Broken Authentication in User Registration & Membership Pro = 5.4.5 versions...
CVE-2026-73998 WordPress WP w3all phpBB plugin <= 3.0.5 - SQL Injection vulnerability
Subscriber SQL Injection in WP w3all phpBB = 3.0.5 versions...
CVE-2026-73993
The WordPress FundEngine plugin (versions
EUVD-2026-63312
Unauthenticated PHP Object Injection in FundEngine = 1.7.9 versions...
CVE-2026-73993 WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in FundEngine = 1.7.9 versions...
CVE-2026-73992 WordPress Query Wrangler plugin <= 1.5.57 - Remote Code Execution (RCE) vulnerability
Subscriber Remote Code Execution RCE in Query Wrangler = 1.5.57 versions...
CVE-2026-73992
The WordPress Query Wrangler plugin (versions ≤ 1.5.57) allows authenticated subscribers to execute arbitrary code remotely, yielding full server compromise (CVSS 9.9 Critical, network-exploitable with low complexity). No in-the-wild exploitation or patch version is documented in the provided sou...
EUVD-2026-63311
Subscriber Remote Code Execution RCE in Query Wrangler = 1.5.57 versions...
CVE-2026-68566
The WordPress BookingPress Appointment Booking Pro plugin (versions ≤ 6.0.2) contains an unauthenticated SQL injection vulnerability exploitable over the network with no credentials required, scoring 9.3 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L). High confidentiality impact is possi...
EUVD-2026-63309
Unauthenticated SQL Injection in BookingPress Appointment Booking Pro = 6.0.2 versions...