254575 matches found
WordPress Plugin WP Statistics <= 13.1.5 - SQL Injection
The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the IP parameter found in the /includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive...
WordPress Google Maps <7.11.18 - SQL Injection
WordPress Google Maps plugin before 7.11.18 contains a SQL injection vulnerability. The plugin includes /class.rest-api.php in the REST API and does not sanitize field names before a SELECT statement. An attacker can possibly obtain sensitive information from a database, modify data, and execute...
CVE-2026-15253
CVE-2026-15253 Easy Media Replace = 0.2.0 - ะััะตะฝัะธัะธัะธัะพะฒะฐะฝะฝะพะต Author+ ั ัะฐะฝะธะผะพะต ะผะตะถัะฐะนัะพะฒะพะต ะฒัะฟะพะปะฝะตะฝะธะต ััะตะฝะฐัะธะตะฒ ะะฟะธัะฐะฝะธะต ะะปะฐะณะธะฝ Easy Media Replace ััะทะฒะธะผ ะบ ั ัะฐะฝะธะผะพะผั ะผะตะถัะฐะนัะพะฒะพะผั ะฒัะฟะพะปะฝะตะฝะธั ััะตะฝะฐัะธะตะฒ XSS ัะตัะตะท ะทะฐะณะพะปะพะฒะพะบ ะผะตะดะธะฐะฒะปะพะถะตะฝะธั. ะะพะณะดะฐ Author ะฟะตัะตะธะผะตะฝะพะฒัะฒะฐะตั ะผะตะดะธะฐัะฐะนะป, ะธัะฟะพะปัะทัั XSS-ะฟะพะปะตะทะฝ...
[SECURITY] Fedora 45 Update: xmms2-0.9.7-9.fc45
XMMS2 is an audio framework, but it is not a general multimedia player - it will not play videos. It has a modular framework and plugin architecture for audio processing, visualisation and output, but this framework has not been designed to support video. Also the client-server design of XMMS2 an...
[SECURITY] Fedora 45 Update: xfce4-weather-plugin-0.12.0-2.fc45
A weather plugin for the Xfce panel. It shows the current temperature and weather condition, using weather data provided by xoap.weather.com...
[SECURITY] Fedora 45 Update: vim-syntastic-3.10.0-32.fc45
Syntastic is a syntax checking plugin that runs files through external syntax checkers and displays any resulting errors to the user. This can be done on demand, or automatically as files are saved. If syntax errors are detected, t he user is notified and is happy because they didn't have to...
[SECURITY] Fedora 45 Update: evolution-rspam-0.6.0-67.fc45
Rspam Evolution Plugin enables Evolution Mail client to report email messages as spam to checksum-based and statistical filtering networks. It supports Razor network, DCC, SpamCop and Pyzor. This plugins requires a pretty new version of evolution to build. See README for more information about...
CVE-2024-50492
๐จ CVE-2024-50492 - ScottCart ๐ฅ Exploit Script for ScottCart ๐งโ๐ป By Nxploit โ Khaled Alenazi ๐ Description The ScottCart plugin for WordPress versions โค 1.1 is vulnerable to Remote Code Execution RCE. This allows unauthenticated attackers to execute arbitrary PHP functions on the server through a...
CVE-2024-50508
CVE-2024-50508 Woocommerce Product Design = 1.0.0 - Unauthenticated Arbitrary File Download Description The Woocommerce Product Design plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.0.0. This makes it possible for unauthenticated attackers to rea...
CVE-2026-92243: Improper Neutralization of Input During Web Page Generation
The Ivory Search โ WordPress Search Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 5.5.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
CVE-2026-100152: Improper Control of Generation of Code
The The All in One SEO โ AI SEO Plugin to Boost SEO Rankings & Traffic Schema, Local SEO, Sitemap & SEO Insights plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.2 This is due to the software allowing users to execute an action that doe...
Fedora 44 : buildstream (2026-ccf62cb9b3)
The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-ccf62cb9b3 advisory. CVE-2026-82331 CWE-59: tar source plugin symlink escape while fetching a malicious tarball Python = 3.12, so the packaged /usr/bin/bst was already using...
CVE-2026-92538: Improper Neutralization of Input During Web Page Generation
The LearnPress โ WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'orderby' parameter in all versions up to, and including, 4.4.7 due to insufficient input sanitization and output escaping. This makes it...
CVE-2026-101162: Improper Neutralization of Input During Web Page Generation
The WP Ultimate Review WordPress plugin before 2.4.4 does not escape some of its review overview settings before outputting them in posts, which could allow users with a role as low as author to perform Stored Cross-Site Scripting attacks, when author reviews are enabled...
CVE-2026-103293: Improper Limitation of a Pathname to a Restricted Directory
The MPG WordPress plugin before 4.2.3 does not validate that the dataset source supplied when importing a project is a remote URL before treating it as a local filesystem path and copying that file into a publicly accessible uploads folder. This makes it possible for users with the Editor role an...
CVE-2026-91078: Improper Authentication
The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the privileged POS account it creates on activation to be changed before use, and it authenticates its public POS login endpoint on that PIN alone with no identity or capability check, allowing...
CVE-2026-103514: Improper Authentication
The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has observed a valid code within its validity window to replay it and bypass two-factor authentication, including on...
CVE-2026-89236: Improper Neutralization of Special Elements used in an SQL Command
The SaveTo Wishlist Lite WordPress plugin before 1.1.5 does not sanitise and escape parameters before using them in the ORDER BY clause of a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database...
PT-2026-104530
Name of the Vulnerable Software and Affected Versions TillKit WordPress plugin versions prior to 1.0.5 Description The plugin creates a privileged POS account upon activation that uses a hard-coded, publicly known PIN. The system does not require this PIN to be changed before use and authenticate...
CVE-2026-80518: Exposure of Sensitive Information to an Unauthorized Actor
The WP Ultimate CSV Importer WordPress plugin before 9.2 does not use a site-specific secret when deriving the storage location of the import logs it writes under the uploads directory, nor does it block direct access to them, allowing unauthenticated attackers to retrieve the personal data of...