290677 matches found
CVE-2024-49668
🚨 CVE-2024-49668: WordPress Verbalize WP Plugin Arbitrary File Upload Vulnerability 📋 Overview CVE-2024-49668 is a critical vulnerability in the WordPress Verbalize WP plugin versions 1.0 and below. This vulnerability allows unauthenticated attackers to upload arbitrary files, including web shell...
WordPress LiteSpeed Cache - Unauthenticated Privilege Escalation to Admin
Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Privilege Escalation.This issue affects LiteSpeed Cache: from 1.9 through 6.3.0.1. id: CVE-2024-28000 info: name: WordPress LiteSpeed Cache - Unauthenticated Privilege Escalation to Admin...
CVE-2026-15253
CVE-2026-15253 Easy Media Replace = 0.2.0 - Authenticated Author+ Stored Cross-Site Scripting Description The Easy Media Replace plugin is vulnerable to a Stored Cross-Site Scripting XSS via the media attachment title. When an Author renames a media file using an XSS payload and an Admin or Edito...
CLSA-2026-1792201277 TuxCare security update for @babel/plugin-transform-exponentiation-operator (2 CVEs)
TuxCare rebuilt @babel/plugin-transform-exponentiation-operator to address 2 CVEs. Fixed in 7.16.7-tuxcare.2...
CLSA-2026-1792201276 TuxCare security update for @babel/plugin-transform-exponentiation-operator (1 CVE)
TuxCare rebuilt @babel/plugin-transform-exponentiation-operator to address 1 CVE. Fixed in 7.18.9-tuxcare.3...
CLSA-2026-1792201267 TuxCare security update for @babel/plugin-transform-exponentiation-operator (1 CVE)
TuxCare rebuilt @babel/plugin-transform-exponentiation-operator to address 1 CVE. Fixed in 7.21.0-tuxcare.4...
CLSA-2026-1792201268 TuxCare security update for @babel/plugin-transform-exponentiation-operator (1 CVE)
TuxCare rebuilt @babel/plugin-transform-exponentiation-operator to address 1 CVE. Fixed in 7.21.5-tuxcare.1...
CLSA-2026-1792196728 TuxCare security update for @next/eslint-plugin-next (9 CVEs)
TuxCare rebuilt @next/eslint-plugin-next to address 9 CVEs. Fixed in 16.0.6-tuxcare.7...
CLSA-2026-1792196727 TuxCare security update for @next/eslint-plugin-next (9 CVEs)
TuxCare rebuilt @next/eslint-plugin-next to address 9 CVEs. Fixed in 14.2.35-tuxcare.5...
CLSA-2026-1792196726 TuxCare security update for @next/eslint-plugin-next (13 CVEs)
TuxCare rebuilt @next/eslint-plugin-next to address 13 CVEs. Fixed in 13.5.11-tuxcare.14...
CLSA-2026-1792196725 TuxCare security update for @next/eslint-plugin-next (2 CVEs)
TuxCare rebuilt @next/eslint-plugin-next to address 2 CVEs. Fixed in 12.3.7-tuxcare.8...
CVE-2024-50492
🚨 CVE-2024-50492 - ScottCart 🔥 Exploit Script for ScottCart 🧑💻 By Nxploit – Khaled Alenazi 📌 Description The ScottCart plugin for WordPress versions ≤ 1.1 is vulnerable to Remote Code Execution RCE. This allows unauthenticated attackers to execute arbitrary PHP functions on the server through a...
CVE-2024-50508
CVE-2024-50508 Woocommerce Product Design = 1.0.0 - Unauthenticated Arbitrary File Download Description The Woocommerce Product Design plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.0.0. This makes it possible for unauthenticated attackers to rea...
PT-2026-116374
Name of the Vulnerable Software and Affected Versions Patreon WordPress plugin versions prior to 1.10.0 Description The plugin fails to perform authorization checks on certain functionalities. This allows unauthenticated users to enumerate the names of terms within any taxonomy, including...
PT-2026-116376
Name of the Vulnerable Software and Affected Versions Patreon WordPress versions prior to 1.10.0 Description The plugin fails to verify a nonce a unique token used to prevent replay attacks when connecting the site to a Patreon account. This allows an attacker to use Cross-Site Request Forgery...
PT-2026-116199
Name of the Vulnerable Software and Affected Versions LearnPress versions prior to 4.4.11 Description Insufficient input sanitization and output escaping allow for Stored Cross-Site Scripting. This occurs via the quantity parameter in the REST API and the order comments parameter during checkout...
PT-2026-116375
Name of the Vulnerable Software and Affected Versions Patreon WordPress versions prior to 1.10.0 Description The plugin fails to validate user-supplied redirect destinations before performing a redirection. This allows unauthenticated attackers to use a crafted link to redirect visitors to an...
PT-2026-116353
Name of the Vulnerable Software and Affected Versions LearnPress – WordPress LMS Plugin for Create and Sell Online Courses versions prior to 4.4.11 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions...