278252 matches found
EUVD-2026-74716
The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering and returning its page content, allowing unauthenticated users to retrieve the content of pages that are not publicly available, such as private, draft, pending and trashed ones...
CVE-2026-84222 Kirki 6.2.1 - 6.2.5 - Unauthenticated Non-Public Post Content Disclosure via 'kirki_data' Parameter
The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering and returning its page content, allowing unauthenticated users to retrieve the content of pages that are not publicly available, such as private, draft, pending and trashed ones...
EUVD-2026-74718
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on one of its cookie scanner AJAX actions, allowing any authenticated user, such as a subscriber, to read back the automated scan schedule the administrator configured...
EUVD-2026-74715
The Quentn WP WordPress plugin before 1.2.15 does not properly sanitise and escape a parameter before using it in an SQL query, allowing high privilege users such as administrators to perform SQL injection attacks...
EUVD-2026-74717
The Sunshine Photo Cart WordPress plugin before 3.7 does not validate that a client-supplied price identifier belongs to the item being purchased when it is added to the cart, allowing unauthenticated users to buy items at a lower price defined elsewhere on the site and complete an order at that...
CVE-2026-85132
WPLP Cookie Consent WordPress plugin versions 4.0.2 through 4.4.1 fail to perform nonce or capability checks on the gcc_get_schedule_scan AJAX action. This allows any authenticated user at subscriber level or above to read back the automated cookie scan schedule configured by the administrator. T...
CVE-2026-84222
CVE-2026-84222 affects the Kirki WordPress plugin versions 6.2.1 through 6.2.5 . The plugin fails to verify whether the requester is authorized to read a post before rendering and returning its content via the kirki_data parameter. This allows unauthenticated users to retrieve the content of non-...
CVE-2026-85132 WPLP Cookie Consent 4.0.2 - 4.4.1 - Subscriber+ Cookie Scan Schedule Disclosure via gcc_get_schedule_scan
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on one of its cookie scanner AJAX actions, allowing any authenticated user, such as a subscriber, to read back the automated scan schedule the administrator configured...
WordPress Kirki plugin 6.2.1-6.2.5 - Unauthenticated Non-Public Post Content Disclosure vulnerability
Unauthenticated Non-Public Post Content Disclosure vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin Kirki versions 6.2.1-6.2.5...
WordPress Sunshine Photo Cart plugin < 3.7 - Unauthenticated Price Manipulation vulnerability
Unauthenticated Price Manipulation vulnerability discovered by Farid Narimanov in WordPress Plugin Sunshine Photo Cart versions 3.7...
CVE-2026-84113
CVE-2026-84113 affects the Quentn WP WordPress plugin in versions prior to 1.2.15 . The vulnerability stems from improper sanitization and escaping of the orderby and order parameters before they are used in an SQL query, enabling a SQL injection attack by users with high privileges (administrato...
CVE-2026-85037
The Sunshine Photo Cart WordPress plugin, prior to version 3.7 , fails to validate that a client-supplied price identifier belongs to the item being purchased when added to the cart. This Insecure Direct Object Reference (IDOR) flaw allows unauthenticated users to associate a lower price defined ...
CVE-2026-84113 Quentn WP < 1.2.15 - Admin+ SQLi via 'orderby'/'order' Parameter
The Quentn WP WordPress plugin before 1.2.15 does not properly sanitise and escape a parameter before using it in an SQL query, allowing high privilege users such as administrators to perform SQL injection attacks...
WordPress Quentn WP plugin < 1.2.15 - Admin+ SQLi vulnerability
Admin+ SQLi vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Quentn WP versions 1.2.15...
WordPress WPLP Cookie Consent plugin 4.0.2-4.4.1 - Subscriber+ Cookie Scan Schedule Disclosure vulnerability
Subscriber+ Cookie Scan Schedule Disclosure vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions 4.0.2-4.4.1...
CVE-2026-85037 Sunshine Photo Cart < 3.7 - Unauthenticated Price Manipulation via IDOR
The Sunshine Photo Cart WordPress plugin before 3.7 does not validate that a client-supplied price identifier belongs to the item being purchased when it is added to the cart, allowing unauthenticated users to buy items at a lower price defined elsewhere on the site and complete an order at that...
WordPress Sina Extension for Elementor plugin 3.7.1-3.10.3 - Contributor+ Stored XSS vulnerability
Contributor+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Sina Extension for Elementor versions 3.7.1-3.10.3...
EUVD-2026-74711
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have capability or nonce checks on some of its A/B testing actions, allowing any authenticated user, such as a subscriber, to overwrite the cookie banner configuration shown to every visitor and to irreversibly reset the stored A/B te...
CVE-2026-82848 Masteriyo LMS 1.3.1 - 2.3.3 - Unauthenticated Course Enrollment Disclosure
The Masteriyo LMS WordPress plugin before 3.4.0 does not perform any authorization check before returning a course enrolment record over its REST API, allowing unauthenticated users to read any learner's enrolment status, timestamps and course-progress data by walking sequential record identifier...
CVE-2026-83541
The Sina Extension for Elementor WordPress plugin (versions 3.7.1 through 3.10.3) contains a Stored Cross-Site Scripting (XSS) vulnerability. The root cause is a Table widget setting that is not properly escaped before being output within an HTML attribute. An attacker with the Contributor role o...