317545 matches found
CVE-2026-104677: Improper Control of Generation of Code
The WP Coder WordPress plugin before 4.5.2 does not restrict access to its PHP code-execution feature to administrators, gating it on a content capability that the Editor role holds by default, which allows Editor-level users to save and execute arbitrary PHP code on the server and fully compromi...
PT-2026-107402
The Envira Gallery WordPress plugin before 1.16.1 does not sanitise and escape a gallery item identifier before outputting it in an image tag attribute, allowing users with the Author role and above to inject arbitrary web scripts that execute when any visitor, including an administrator, views a...
PT-2026-107432
The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 's' Search Parameter via comments-atom Feed in all versions up to, and including, 6.3.10 due to insufficient input sanitization and output escaping. This makes it...
PT-2026-107454
Missing Authorization vulnerability in WPMU DEV Hustle wordpress-popup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hustle: from n/a through 7.8.14.2...
PT-2026-107411
The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin page, allowing attackers to execute arbitrary JavaScript in the browser of a logged-in user who opens a crafted link...
CVE-2026-97188: Deserialization of Untrusted Data
The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, allowing unauthenticated attackers to store a serialized PHP object that is instantiated when an administrator later opens and...
PT-2026-107719
Name of the Vulnerable Software and Affected Versions LatePoint - Appointment Booking & Reservation plugin for WordPress versions prior to 5.7.0 Description An Insecure Direct Object Reference exists because the process step customer function relies solely on is user logged in to validate request...
PT-2026-107407
The MPG WordPress plugin before 4.2.3 does not properly validate the structure of imported project data before using it in a database query, allowing users with the Editor role or higher to perform SQL injection attacks and read sensitive data such as password hashes...
CVE-2026-82212: Insufficient Verification of Data Authenticity
The Nexi XPay Build WordPress plugin through 7.6.2 does not correctly validate the security token on its payment notification route, accepting the request when the target order has no stored token, which allows unauthenticated attackers to mark arbitrary orders as paid, or to mark genuinely paid...
PT-2026-107418
The Nexi XPay Build WordPress plugin through 7.6.2 does not correctly validate the security token on its payment notification route, accepting the request when the target order has no stored token, which allows unauthenticated attackers to mark arbitrary orders as paid, or to mark genuinely paid...
Linux Distros Unpatched Vulnerability : CVE-2026-66666
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data. This issue affects WordPress:...
PT-2026-107400
The Academy LMS WordPress plugin before 4.0.0 does not verify that a quiz question belongs to the course the requesting user is authorized to access before returning that question's answer options, allowing any authenticated user with access to a single course, such as an enrolled student, to rea...
CVE-2026-103378: Exposure of Sensitive Information to an Unauthorized Actor
The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not prevent unauthenticated access to a log file it stores within its own web-accessible directory, into which it writes the site's carrier integration key while processing requests from unauthenticated users, allowing attacker...
PT-2026-107405
The WP Coder WordPress plugin before 4.5.2 does not restrict access to its PHP code-execution feature to administrators, gating it on a content capability that the Editor role holds by default, which allows Editor-level users to save and execute arbitrary PHP code on the server and fully compromi...
CVE-2026-87782: Improper Privilege Management
The Koinonia Link WordPress plugin before 1.1.5 does not check that a user is allowed to change roles before saving a role selection submitted with a profile update, allowing any authenticated user, such as a subscriber, to grant themselves the Administrator role...
CVE-2026-103075: Missing Authorization
Missing Authorization vulnerability in WPMU DEV Hustle wordpress-popup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hustle: from n/a through 7.8.14.2...
CVE-2024-1207
Booking Calendar = 9.9 - Unauthenticated SQL Injection CVE-2024-1207 https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/booking/booking-calendar-99-unauthenticated-sql-injection POC: POST /wp-admin/admin-ajax.php HTTP/1.1 Host: vulnerablesite.com User-Agent: Mozilla/5.0...
cve-2026-87902-poc
CVE-2026-87902 — WordPress Core: path traversal non autenticato nella risoluzione dei template di pagina Inclusione locale non autenticata di file PHP in WordPress Core tramite un valore pagename con doppia codifica — e, in specifiche condizioni di deployment, esecuzione di codice PHP con i...
NPM: knowns OS Command Injection via Insecure LSP Binary Path Config in .knowns/config.json
NPM: knowns OS Command Injection via Insecure LSP Binary Path Config in .knowns/config.json vulnerability discovered by ? in WordPress Npm knowns versions = 0.29.1...
DEBIAN-CVE-2026-66666
Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data. This issue affects WordPress: from 7.1 through 7.1.2, from 7.0 through 7.0.6, from 6.9 through 6.9.9, from 6.8 through 6.8.10, from 6.7 through 6.7.9, and from 6.6...