308326 matches found
CVE-2026-75957
The Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.15.0 via the checkoutform parameter of the logincustomeraftercheckout function. This is due to the publicly accessible...
CVE-2026-15989
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's beforeemailsuccessmsg function whitelisting the client-submitted 'role' key and copying it into the...
CVE-2026-19902
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Referer header in all versions up to, and including, 2.8.18 due to insufficient input sanitization and output escaping on the 'search-query' dynamic tag. When an ad block's code...
CVE-2026-8181
CVE-2026-8181 — Burst Statistics 3.4.0 – 3.4.1.1 — Bypass de Autenticación para Toma de Control de Cuenta de Administrador Resumen de la Vulnerabilidad El plugin de WordPress Burst Statistics versiones 3.4.0 a 3.4.1.1 es vulnerable a una vulnerabilidad de bypass de autenticación no autenticado qu...
WordPress AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by whale120 in WordPress Plugin AI Engine versions = 3.8.0...
CVE-2026-87902-Toolkit
CVE‑2026‑87902 – WordPress Unauth LFI→RCE Toolkit ETHICAL USE ONLY – AUTHORIZED SECURITY TESTING This repository provides tools for authorized security professionals, blue teams, and penetration testers only. Unauthorized access to computer systems is illegal under CFAA US, Computer Misuse Act UK...
WordPress Extendify plugin <= 3.1.6 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Jack Taylor in WordPress Plugin Extendify versions = 3.1.6...
CVE-2025-14124
CVE-2025-14124 WordPress Team Plugin - Unauthenticated SQL Injection Author: Hyun Chiya Vulnerability Information Field| Value ---|--- CVE ID| CVE-2025-14124 Plugin| WordPress Team Plugin Affected Versions| esclike $this-s's' ; // ⚠️ esclike only escapes %, , \ $where .= "OR $wpdb-posts.posttitle...
CVE-2025-13597
AI Feeds = 1.0.11 - Carga de archivos arbitraria sin autenticación El complemento de WordPress AI Feeds en versiones 1.0.11 e inferiores contiene una vulnerabilidad de ejecución remota de código sin autenticación en el archivo actualizadorgit.php. Este archivo es accesible directamente vía HTTP s...
CVE-2026-15989
The Super Forms – Drag & Drop Form Builder plugin for WordPress (versions up to and including 6.3.316 ) is vulnerable to unauthenticated privilege escalation . The root cause lies in the Register & Login add-on's before_email_success_msg() function, which whitelists the client-submitted role key ...
CVE-2026-15989 Super Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameter
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's beforeemailsuccessmsg function whitelisting the client-submitted 'role' key and copying it into the...
CVE-2026-15989 Super Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameter
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's beforeemailsuccessmsg function whitelisting the client-submitted 'role' key and copying it into the...
EUVD-2026-90545
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Referer header in all versions up to, and including, 2.8.18 due to insufficient input sanitization and output escaping on the 'search-query' dynamic tag. When an ad block's code...
CVE-2026-19902
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress (versions up to and including 2.8.18 ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping on the {search-query} dynamic tag. The replace_ai_tags() function in...
CVE-2026-15989 Super Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameter
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's beforeemailsuccessmsg function whitelisting the client-submitted 'role' key and copying it into the...
CVE-2026-75957
The Ultimate Multisite WordPress plugin (versions ↜ 2.15.0 ) is vulnerable to an Authentication Bypass via the checkout_form parameter in the login_customer_after_checkout function. The publicly accessible wu_ajax_nopriv_wu_validate_form AJAX handler accepts a freely obtainable nonce. When the ch...
EUVD-2026-90547
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's beforeemailsuccessmsg function whitelisting the client-submitted 'role' key and copying it into the...
CVE-2026-75957 Ultimate Multisite <= 2.15.0 - Unauthenticated Authentication Bypass via 'checkout_form' Parameter
The Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.15.0 via the checkoutform parameter of the logincustomeraftercheckout function. This is due to the publicly accessible...
CVE-2026-75957 Ultimate Multisite <= 2.15.0 - Unauthenticated Authentication Bypass via 'checkout_form' Parameter
The Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.15.0 via the checkoutform parameter of the logincustomeraftercheckout function. This is due to the publicly accessible...
CVE-2026-19902 Ad Inserter <= 2.8.18 - Reflected Cross-Site Scripting via {search-query} Dynamic Tag (Referer Header)
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Referer header in all versions up to, and including, 2.8.18 due to insufficient input sanitization and output escaping on the 'search-query' dynamic tag. When an ad block's code...