278955 matches found
CVE-2026-8279
The Masteriyo LMS plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the 'deleteitempermissionscheck' function in the CourseProgressItemsController in all versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers ...
CVE-2026-6431
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Biographical Info' meta field parameter in all versions up to, and including, 3.15.7 due to insufficient input sanitization and...
CVE-2026-4945
The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1.7 via the 'watchcheckout' function due to missing validation on a user controlled key. This makes it possib...
CVE-2026-12853
The Flamingo plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access a...
WordPress Easy Appointments plugin <= 4.0.2.2 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by 0xzenko in WordPress Plugin Easy Appointments versions = 4.0.2.2...
CVE-2026-4945
The Otter Blocks plugin for WordPress (Gutenberg Blocks, Page Builder & FSE) is vulnerable to Insecure Direct Object Reference (IDOR) in the watch_checkout function across all versions up to and including 3.1.7 . The root cause is missing validation on a user-controlled key, allowing unauthentica...
EUVD-2026-72367
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Biographical Info' meta field parameter in all versions up to, and including, 3.15.7 due to insufficient input sanitization and...
CVE-2026-6431 User Profile Builder <= 3.15.7 - Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Biographical Info' meta field parameter in all versions up to, and including, 3.15.7 due to insufficient input sanitization and...
EUVD-2026-72368
The Masteriyo LMS plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the 'deleteitempermissionscheck' function in the CourseProgressItemsController in all versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers ...
CVE-2026-4945 Otter Blocks <= 3.1.7 - Missing Authorization to Unauthenticated Purchase Verification Bypass
The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1.7 via the 'watchcheckout' function due to missing validation on a user controlled key. This makes it possib...
CVE-2026-8279
CVE-2026-8279 affects the Masteriyo LMS WordPress plugin in all versions up to and including 2.2.0 . The root cause is a missing capability check in the delete_item_permissions_check function within the CourseProgressItemsController, allowing unauthenticated attackers to delete arbitrary course p...
CVE-2026-6431
CVE-2026-6431 affects the User Profile Builder WordPress plugin (all versions up to and including 3.15.7 ), which is vulnerable to unauthenticated stored Cross-Site Scripting (XSS) through the 'Biographical Info' meta field parameter. The root cause is insufficient input sanitization and output e...
CVE-2026-8279 Masteriyo LMS <= 2.2.0 - Missing Authorization to Unauthenticated Arbitrary Course Progress Deletion
The Masteriyo LMS plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the 'deleteitempermissionscheck' function in the CourseProgressItemsController in all versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers ...
EUVD-2026-72365
The Flamingo plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access a...
CVE-2026-12853 Flamingo <= 2.6.2 - Authenticated (Contributor+) Missing Authorization to Unauthorized Tag Information Disclosure via wp.getTerms and ajax-tag-search
The Flamingo plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access a...
CVE-2026-12853
The Flamingo plugin for WordPress (versions up to and including 2.6.2 ) is vulnerable to an authorization bypass. The plugin's flamingo_map_meta_cap() filter restricts access to its admin UI but does not extend to WordPress core APIs, specifically XML-RPC wp.getTerms and admin-ajax ajax-tag-searc...
CVE-2026-2390
The Powerkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Lazy Load module's image processing in all versions up to, and including, 3.0.4. This is due to the 'contentprocessimages' function using a flawed regex-based HTML attribute parser. This makes it possible for...
EUVD-2026-72350
The Powerkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Lazy Load module's image processing in all versions up to, and including, 3.0.4. This is due to the 'contentprocessimages' function using a flawed regex-based HTML attribute parser. This makes it possible for...
CVE-2026-2390
The Powerkit WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) via its Lazy Load module's image processing in all versions up to and including 3.0.4 . The root cause is the content_process_images function, which relies on a flawed regex-based HTML attribute parser, allowing auth...
WordPress Beaver Builder Plugin (Pro Version) plugin <= 2.11.0.1 - Reflected Cross-Site Scripting via 'no_results_message' node_preview Parameter vulnerability
Reflected Cross-Site Scripting via 'noresultsmessage' nodepreview Parameter vulnerability discovered by Austin Ginder - Anchor Hosting in WordPress Plugin Beaver Builder Plugin Starter Version versions = 2.11.0.1...