318419 matches found
CVE-2026-105397 LearnPress WordPress Plugin through 4.4.9.1 Stored XSS via Quiz Question Hint and Explanation
LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Attackers with the Instructor role can submit unsanitized payloads through the updatequestion...
WordPress Builderius plugin <= 1.4-beta - Server Side Request Forgery (SSRF) vulnerability
Server Side Request Forgery SSRF vulnerability discovered by Jitlada in WordPress Plugin Builderius versions = 1.4-beta...
WordPress WP2LEADS plugin <= 3.5.7 - SQL Injection vulnerability
SQL Injection vulnerability discovered by johska in WordPress Plugin WP2LEADS versions = 3.5.7...
WordPress WP2LEADS plugin <= 3.5.7 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by johska in WordPress Plugin WP2LEADS versions = 3.5.7...
WordPress Real 3D FlipBook plugin <= 5.5 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Real 3D FlipBook versions = 5.5...
WordPress Meta Box AIO plugin <= 3.7.1 - Privilege Escalation vulnerability
Privilege Escalation vulnerability discovered by wackydawg in WordPress Plugin Meta Box AIO versions = 3.7.1...
WordPress WP Event Solution plugin <= 4.1.25 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ratchanon Chamnankit in WordPress Plugin WP Event Solution versions = 4.1.25...
WordPress File Uploads Addon for WooCommerce plugin 1.7.2-1.7.6 - Unauthenticated Direct File Access vulnerability
Unauthenticated Direct File Access vulnerability discovered by J4ck13Ch4n in WordPress Plugin File Uploads Addon for WooCommerce versions 1.7.2-1.7.6...
WordPress Kit (formerly ConvertKit) for WooCommerce plugin <= 2.2.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Peter Tang in WordPress Plugin Kit formerly ConvertKit for WooCommerce versions = 2.2.0...
WordPress WPLMS theme <= 4.972 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme WPLMS versions = 4.972...
WordPress Morning for WooCommerce plugin <= 2.4.1 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by ParkHyunWoo in WordPress Plugin Morning for WooCommerce versions = 2.4.1...
WordPress HTTP Requests Manager plugin <= 1.3.11 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by dodoh4t in WordPress Plugin HTTP Requests Manager versions = 1.3.11...
WordPress Database for CF7 plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by ParkHyunWoo in WordPress Plugin Database for CF7 versions = 1.2.6...
WordPress Content Visibility for Divi Builder plugin <= 5.03 - Remote Code Execution (RCE) vulnerability
Remote Code Execution RCE vulnerability discovered by ParkHyunWoo in WordPress Plugin Content Visibility for Divi Builder versions = 5.03...
wp2shell
CVE-2026-63030 + CVE-2026-60137 – „wp2shell“: Unauthenticatede RCE im WordPress-Core Batch-Routen-Verwirrung der REST-API CVE-2026-63030 verknüpft mit einer WPQuery-authornotin-SQL-Injection CVE-2026-60137 → Pre-Auth Remote Code Execution gegen eine Standard-WordPress-Installation. Entdeckt von...
WordPress EduMall theme <= 4.5.3 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Theme EduMall versions = 4.5.3...
WordPress Lumise Product Designer plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Lumise Product Designer versions = 2.1.1...
WordPress Instapage Plugin plugin <= 3.7.2 - Server Side Request Forgery (SSRF) vulnerability
Server Side Request Forgery SSRF vulnerability discovered by ParkHyunWoo in WordPress Plugin Instapage Plugin versions = 3.7.2...
WordPress Edwiser Bridge plugin <= 4.3.4 - Sensitive Data Exposure vulnerability
Sensitive Data Exposure vulnerability discovered by Jakub Herman in WordPress Plugin Edwiser Bridge versions = 4.3.4...