278336 matches found
CVE-2026-3835 Prevent Direct Access – Protect WordPress Files <= 2.8.8.8 - Unauthenticated Protected File Access
The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token validation in the getadvancefilebyurl method in all versions up to, and including, 2.8.8.8 The method uses a SQL LIKE operator for token looku...
CVE-2026-3835
The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token validation in the getadvancefilebyurl method in all versions up to, and including, 2.8.8.8 The method uses a SQL LIKE operator for token looku...
EUVD-2026-57720
The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token validation in the getadvancefilebyurl method in all versions up to, and including, 2.8.8.8 The method uses a SQL LIKE operator for token looku...
CVE-2026-3835 Prevent Direct Access – Protect WordPress Files <= 2.8.8.8 - Unauthenticated Protected File Access
The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token validation in the getadvancefilebyurl method in all versions up to, and including, 2.8.8.8 The method uses a SQL LIKE operator for token looku...
CVE-2026-3835
The CVE covers the WordPress plugin Prevent Direct Access – Protect WordPress Files. All versions up to 2.8.8.8 are affected due to insufficient token validation in get_advance_file_by_url(), which uses a SQL LIKE without escaping wildcards via $wpdb->esc_like(). This allows unauthenticated us...
PT-2026-71519
Subscriber Privilege Escalation in Service Finder Booking = 6.2 versions...
PT-2026-71563
Subscriber Cross Site Scripting XSS in Profile Extra Fields by BestWebSoft = 1.3.4 versions...
PT-2026-71576
Subscriber Cross Site Scripting XSS in Accordion = 3.0.6 versions...
PT-2026-71508
Unauthenticated Cross Site Scripting XSS in Maspik – Spam blacklist = 2.9.1 versions...
PT-2026-71577
Unauthenticated SQL Injection in Everest Backup = 2.3.12 versions...
PT-2026-71583
Unauthenticated Local File Inclusion in Biagiotti Core = 2.1.1 versions...
PT-2026-71534
Unauthenticated Cross Site Scripting XSS in WP Full Stripe Free = 8.5.0 versions...
PT-2026-71522
Customer Arbitrary Content Deletion in WP Event SOlution = 4.1.19 versions...
PT-2026-71544
Unauthenticated Broken Access Control in WPMobile.App = 11.77 versions...
PT-2026-71528
Subscriber SQL Injection in Form Maker by 10Web = 1.15.44 versions...
PT-2026-71525
Unauthenticated PHP Object Injection in Booking Activities = 1.18.4 versions...
PT-2026-71529
Unauthenticated Broken Authentication in Log in with Google = 1.4.2 versions...
PT-2026-71547
Unauthenticated Privilege Escalation in SMS Alert Order Notifications = 3.9.7 versions...