WordPress Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin <= 4.1.17 - Missing Authorization to Authenticated (Subscriber+) Notification Flow Management vulnerability

Missing Authorization to Authenticated Subscriber+ Notification Flow Management vulnerability discovered by Sushi Com Abacate in WordPress Plugin WP Event Solution versions = 4.1.17...

CVE-2026-4882

CVE-2026-4882 User Registration Advanced Fields = 1.6.20 - 認証なし任意ファイルアップロード 説明 : User Registration Advanced Fields = 1.6.20 - 認証なし任意ファイルアップロード WordPress用プラグイン「User Registration Advanced Fields」バージョン1.6.20以下 は、AJAXアクション urafprofilepictureuploadmethodupload...

CVE-2025-4396

CVE-2025-4396 — Relevanssi SQLインジェクション（時間ベース・ブラインド） 免責事項： このリポジトリは許可されたペネトレーションテスト、セキュリティ研究、教育目的のみ を対象としています。コンピュータシステムへの不正アクセスは違法かつ非倫理的です。 概要 Relevanssi 4.24.4 WordPressプラグインにおける時間ベースのブラインドSQLインジェクション脆弱性の概念実証エクスプロイトです。この実装は、以下のような堅牢化された環境に特化しています： カンマがフィルタリングされる — 標準のSUBSTRstr, pos, lenやIFcond,...

WordPress WP Crowdfunding plugin <= 2.2.1 - Authenticated (Shop Manager+) SQL Injection vulnerability

Authenticated Shop Manager+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin WP Crowdfunding versions = 2.2.1...

WordPress Podlove Podcast Publisher plugin <= 4.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Podlove Podcast Publisher versions = 4.5.5...

WordPress Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin <= 1.31.0 - Authenticated (Custom+) SQL Injection vulnerability

Authenticated Custom+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Mail Mint versions = 1.31.0...

WordPress Ninja Forms – The Contact Form Builder That Grows With You plugin <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection vulnerability

Authenticated Administrator+ PHP Object Injection vulnerability discovered by Hermione in WordPress Plugin Ninja Forms versions = 3.14.6...

WordPress My Calendar – Accessible Event Manager plugin <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin My Calendar versions = 3.8.3...

WordPress My Calendar – Accessible Event Manager plugin <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin My Calendar versions = 3.8.3...

CVE-2026-11784-Optimole-CSRF

CVE-2026-11784: Optimole WordPress 플러그인의 CSRF로 인한 임의 파일 덮어쓰기 요약 Optimole WordPress 플러그인버전 = 4.2.5에서 발견된 CSRFCross-Site Request Forgery 취약점으로 인해, 인증되지 않은 공격자가 nonce 검증 부재로 인해 wpajaxoptmlreplacefile AJAX 액션을 통해 기존 미디어 라이브러리 자산을 무단으로 덮어쓸 수 있습니다. CVE ID : CVE-2026-11784 취약점 유형 : CSRF Cross-Site Reque...

WordPress Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin <= 4.1.22 - Authenticated (Custom+) Local File Inclusion vulnerability

Authenticated Custom+ Local File Inclusion vulnerability discovered by Wordfence PRISM in WordPress Plugin WP Event Solution versions = 4.1.22...

WordPress Salon booking system plugin <= 10.31.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Tiago Ventura @perses in WordPress Plugin Salon booking system versions = 10.31.5...

WordPress Simple Cloudflare Turnstile plugin <= 1.42.1 - Content Injection vulnerability

Content Injection vulnerability discovered by kta1kri in WordPress Plugin Simple Cloudflare Turnstile versions = 1.42.1...

WordPress Simple Cloudflare Turnstile plugin <= 1.42.1 - Captcha Bypass vulnerability

Captcha Bypass vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Simple Cloudflare Turnstile versions = 1.42.1...

WordPress WP-Stateless plugin <= 4.4.1 - Settings Change vulnerability

Settings Change vulnerability discovered by Johan Buenavida in WordPress Plugin WP-Stateless versions = 4.4.1...

WordPress WPAdverts plugin <= 2.3.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ivaylo Atanassov in WordPress Plugin WPAdverts versions = 2.3.3...

CVE-2026-76931

The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 3.3.205 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Custom-level...

CVE-2026-2520

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updateAddon' function in all versions up to, and including, 27.2. This makes it possible for authenticated attackers, wit...

CVE-2026-3174

The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Stripe OAuth return endpoint in all versions up to, and including, 5.27.4. This makes it possible for unauthenticated attackers to overwrite the site...

CVE-2026-17509

The WPML Multilingual CMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘elementIds’ parameter in all versions up to, and including, 4.9.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes ...