114421 matches found
CVE-2026-16297
The Clearfy Cache WordPress plugin before 2.4.3 does not restrict the classes allowed when unserializing settings-import data, allowing users with administrator access to perform PHP Object Injection attacks, which may lead to remote code execution when a suitable gadget chain is present in the...
CVE-2026-15383 Blog Floating Button <= 1.4.20 - Unauthenticated Stored XSS via User-Agent Header
The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a...
EUVD-2026-52174
The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a...
CVE-2026-15383 Blog Floating Button <= 1.4.20 - Unauthenticated Stored XSS via User-Agent Header
The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a...
EUVD-2026-52175
The Simple Membership WordPress plugin before 4.7.8 does not verify whether user creation failed during registration before using the returned value as a user ID to update an account, allowing unauthenticated attackers to overwrite the primary administrator's account data including the email...
CVE-2026-15383
The Blog Floating Button WordPress plugin, version 1.4.20 and below , is vulnerable to unauthenticated stored XSS . The flaw exists because the plugin fails to sanitize or escape the visitor User-Agent header, which is accepted through an unauthenticated tracking REST endpoint. This malicious inp...
CVE-2026-15930 Simple Membership < 4.7.8 - Unauthenticated Administrator Account Takeover via Registration Username Collision
The Simple Membership WordPress plugin before 4.7.8 does not verify whether user creation failed during registration before using the returned value as a user ID to update an account, allowing unauthenticated attackers to overwrite the primary administrator's account data including the email...
CVE-2026-15930
The Simple Membership WordPress plugin versions prior to 4.7.8 contains a vulnerability where it fails to verify if user creation failed during the registration process. Instead, it uses the returned value as a user ID to update an account. This oversight allows unauthenticated attackers to overw...
CVE-2026-15930
The Simple Membership WordPress plugin before 4.7.8 does not verify whether user creation failed during registration before using the returned value as a user ID to update an account, allowing unauthenticated attackers to overwrite the primary administrator's account data including the email...
WordPress Import and export users and customers plugin < 2.4.3 - Admin+ Arbitrary File Read vulnerability
Admin+ Arbitrary File Read vulnerability discovered by Centesiman in WordPress Plugin Import and export users and customers versions 2.4.3...
CVE-2026-15254 Simply Schedule Appointments < 1.6.12.11 - Contributor+ Sensitive Data Disclosure via Admin Shortcode
The Simply Schedule Appointments WordPress plugin before 1.6.12.11 does not perform a capability check on an administrative appointment-listing shortcode, and its per-user result scoping fails open for non-staff users, allowing users with the Contributor role and above to disclose all customers'...
EUVD-2026-52161
The Simply Schedule Appointments WordPress plugin before 1.6.12.11 does not perform a capability check on an administrative appointment-listing shortcode, and its per-user result scoping fails open for non-staff users, allowing users with the Contributor role and above to disclose all customers'...
CVE-2026-15254
The Simply Schedule Appointments WordPress plugin before 1.6.12.11 does not perform a capability check on an administrative appointment-listing shortcode, and its per-user result scoping fails open for non-staff users, allowing users with the Contributor role and above to disclose all customers'...
CVE-2026-16534
The Import and export users and customers WordPress plugin versions prior to 2.4.2 contains a privilege escalation vulnerability. The root cause is a failure to enforce WordPress's role-assignment and per-user edit permissions during CSV imports. This allows an attacker with only the user-creatio...
CVE-2026-16534 Import and export users and customers < 2.4.2 - Custom Role Privilege Escalation to Administrator via CSV Import
The Import and export users and customers WordPress plugin before 2.4.2 does not enforce WordPress's role-assignment and per-user edit permissions during CSV import, allowing a user holding only the user-creation capability to create an administrator account and to overwrite an existing...
CVE-2026-15254 Simply Schedule Appointments < 1.6.12.11 - Contributor+ Sensitive Data Disclosure via Admin Shortcode
The Simply Schedule Appointments WordPress plugin before 1.6.12.11 does not perform a capability check on an administrative appointment-listing shortcode, and its per-user result scoping fails open for non-staff users, allowing users with the Contributor role and above to disclose all customers'...
CVE-2026-15254
The Simply Schedule Appointments WordPress plugin, in versions prior to 1.6.12.11 , contains a sensitive data disclosure vulnerability. The root cause is a missing capability check on an administrative appointment-listing shortcode, combined with per-user result scoping that fails open for non-st...
EUVD-2026-52166
The Import and export users and customers WordPress plugin before 2.4.2 does not enforce WordPress's role-assignment and per-user edit permissions during CSV import, allowing a user holding only the user-creation capability to create an administrator account and to overwrite an existing...
cn.hyperchain.javasdk:hyperchainsdk (>=4.2.1, <=4.2.3), com.blitz-chain:blitz-chain (1.2) +80 more potentially affected by CVE-2026-15055 via org.bouncycastle:bcpkix-jdk14 (>=1.47, <=1.84)
org.bouncycastle:bcpkix-jdk14 MAVEN version =1.47, =4.2.1, =9.1.20, =2.0, =2.0, =2.0, =0.1.1, =ibanity-java-1.1.20180605145337, =2.2, =2.0.1, =7.0-rc2, =1.5, =12.3, =22.2.3 and more Source cves: CVE-2026-15055 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18517497...
