490156 matches found
CVE-2026-28190
CVE-2026-28190 is a Broken Access Control vulnerability in the ProLancer Element WordPress plugin, affecting versions 1.4.8 and earlier . The flaw allows users with the Subscriber role to perform actions beyond their intended privilege level, resulting in primarily integrity impact and minor avai...
CVE-2026-28167
CVE-2026-28167 is an unauthenticated arbitrary file download vulnerability in the WordPress Super Forms plugin affecting versions 6.3.315 and below . The flaw allows a remote attacker to download arbitrary files from the server without authentication, leading to a high confidentiality impact (CVS...
CVE-2026-28165 WordPress Digits plugin <= 9.2 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Digits = 9.2 versions...
EUVD-2026-64794
Unauthenticated Privilege Escalation in Digits = 9.2 versions...
CVE-2026-28166
CVE-2026-28166 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress Tourmaster plugin , affecting versions 5.4.9 and earlier . The CVSS 3.1 base score is 7.1 (HIGH) , with a network attack vector, low complexity, no required privileges, and a changed scope. CISA's SSVC ...
EUVD-2026-64793
Unauthenticated Cross Site Scripting XSS in Events Made Easy = 3.2.5 versions...
CVE-2026-28153
Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More plugin (versions
EUVD-2026-64787
Unauthenticated Cross Site Request Forgery CSRF in Hash Form = 1.4.0 versions...
CVE-2026-78290
CVE-2026-78290 is a Contributor-level Cross-Site Scripting (XSS) vulnerability in the WordPress Magazine Blocks plugin , affecting versions ≤ 1.8.6 . The vulnerability requires a user with Contributor privileges and user interaction, with a Changed Scope impact (CVSS 3.1 base score 6.5 MEDIUM ). ...
CVE-2026-78280
CVE-2026-78280 is an unauthenticated Cross-Site Request Forgery (CSRF) vulnerability in the WordPress Hash Form plugin , affecting versions 1.4.0 and earlier . The flaw was discovered by sanghyeok Kim and reported via Patchstack. Per the CVSS 3.1 vector, an attacker with network access and low co...
EUVD-2026-64786
Unauthenticated Cross Site Request Forgery CSRF in Fluent Support Pro = 2.3.1 versions...
CVE-2026-78279 WordPress Fluent Support Pro plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery CSRF in Fluent Support Pro = 2.3.1 versions...
EUVD-2026-64836
Subscriber Broken Access Control in Fluent Support Pro = 2.3.1 versions...
CVE-2026-78270
An Author SQL Injection vulnerability affects the WordPress FluentCRM Pro plugin in versions 3.1.12 and below . Discovered by Ananda Dhakal (Patchstack), the flaw requires a high-privilege user to exploit (CVSS 7.6 HIGH , vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L), yielding high confidentiality ...
CVE-2026-78270 WordPress FluentCRM Pro plugin <= 3.1.12 - SQL Injection vulnerability
Author SQL Injection in FluentCRM Pro = 3.1.12 versions...
CVE-2026-78258
CVE-2026-78258 is an unauthenticated Broken Access Control vulnerability in the Booking and Rental Manager WordPress plugin (for WooCommerce), affecting versions 2.7.5 and earlier . The flaw allows remote attackers to access data without proper authorization, resulting in a low confidentiality im...
EUVD-2026-64833
Unauthenticated Broken Access Control in Booking and Rental Manager = 2.7.5 versions...
EUVD-2026-64834
Contributor Server Side Request Forgery SSRF in Shared Files = 1.7.69 versions...