276991 matches found
CVE-2026-14524
The ProSolution WP Client plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the proSolfileDeleteProcess function in all versions up to, and including, 2.0.8. This makes it possible for unauthenticated attackers to delete arbitrary files on t...
CVE-2026-15002
The Platnosci Online Blue Media Autopay plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.0.0 via the 'bmwoocommercecsseditorcontent' POST parameter. This is due to the CssEditor::handlesave method being wired to the WordPress 'init' hook by...
CVE-2026-12477
The Gravity Booster – Styles & Layouts for Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...
CVE-2026-11780
The Quiz and Survey Master QSM – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'questiontitle' parameter in all versions up to, and including, 11.2.1 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2025-10005
The PPWP – Password Protect WordPress | 1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.20 via the ppwfreesetpassword AJAX action due to missing validation on a user controlled key. This makes it...
CVE-2026-15002
The Platnosci Online Blue Media Autopay plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.0.0 via the 'bmwoocommercecsseditorcontent' POST parameter. This is due to the CssEditor::handlesave method being wired to the WordPress 'init' hook by...
CVE-2026-15726 Serious Slider <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'theme' Shortcode Attribute
The Serious Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'theme' Shortcode Attribute in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...
CVE-2026-15726
The Serious Slider WordPress plugin is vulnerable to Stored Cross‑Site Scripting via the theme shortcode attribute in all versions up to and including 1.4.0, caused by insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject a...
EUVD-2026-59869
The Kubio AI Page Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...
CVE-2026-16779 Kubio AI Page Builder <= 2.8.5 - Missing Authorization to Authenticated (Contributor+) Front-Page/Menu/Template Configuration Reversion via kubio_restore_front_page AJAX Action
The Kubio AI Page Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...
EUVD-2026-59868
The Platnosci Online Blue Media Autopay plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.0.0 via the 'bmwoocommercecsseditorcontent' POST parameter. This is due to the CssEditor::handlesave method being wired to the WordPress 'init' hook by...
CVE-2026-15002
The CVE-2026-15002 entry concerns the Platnosci Online Blue Media (Autopay) WordPress plugin. A Stored XSS exists in versions up to 5.0.0 via the bm_woocommerce_css_editor_content POST parameter. The root cause is Css_Editor::handle_save() being wired to WordPress 'init' by Settings_Manager::init...
EUVD-2026-59867
The Serious Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'theme' Shortcode Attribute in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...
CVE-2026-15002 Autopay <= 5.0.0 - Unauthenticated Stored Cross-Site Scripting via 'bm_woocommerce_css_editor_content' Parameter
The Platnosci Online Blue Media Autopay plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.0.0 via the 'bmwoocommercecsseditorcontent' POST parameter. This is due to the CssEditor::handlesave method being wired to the WordPress 'init' hook by...
CVE-2026-15726
The Serious Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'theme' Shortcode Attribute in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...
CVE-2026-16779
Kubio AI Page Builder for WordPress (≤ v2.8.5) is vulnerable to an authorization bypass via the kubio_restore_front_page AJAX action. Authenticated attackers with contributor+ access can overwrite front-page configuration (show_on_front, page_on_front, page_for_posts), rewrite primary navigation ...
EUVD-2026-59866
The Quiz and Survey Master QSM – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to generic SQL Injection via 'randoncategory' Quiz Option in all versions up to, and including, 11.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...
EUVD-2026-59865
The Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'soundFile' parameter in all versions up to, and including, 5.4.12 due to insufficient input sanitization and output escaping. Th...
CVE-2026-15963
The Quiz and Survey Master QSM – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to generic SQL Injection via 'randoncategory' Quiz Option in all versions up to, and including, 11.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...
CVE-2026-15009
The Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'soundFile' parameter in all versions up to, and including, 5.4.12 due to insufficient input sanitization and output escaping. Th...