305009 matches found
CVE-2026-14444
The WP Fusion Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.47.13. This is due to insufficient authorization checks on the role parameter in the ThriveCart Auto Login handler's thrivecart function. This makes it possible for authenticated...
CVE-2026-12757
The The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.9.27. This is due to the software allowing users to execute an action that do...
WordPress Product Catalog Enquiry for WooCommerce by MultiVendorX plugin <= 6.1.4 - Privilege Escalation vulnerability
Privilege Escalation vulnerability discovered by Peng Zhou in WordPress Plugin Product Catalog Enquiry for WooCommerce by MultiVendorX versions = 6.1.4...
WordPress WpEvently plugin <= 5.6.0 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by benzdeus in WordPress Plugin WpEvently versions = 5.6.0...
WordPress Csomagpontok és szállítási címkék WooCommerce-hez plugin < 4.2.8 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Peng Zhou in WordPress Plugin Csomagpontok és szállítási címkék WooCommerce-hez versions 4.2.8...
WordPress Open User Map plugin <= 1.4.50 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by care in WordPress Plugin Open User Map versions = 1.4.50...
WordPress Unbounce Landing Pages plugin <= 1.1.4 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by HieuPenguinnn in WordPress Plugin Unbounce Landing Pages versions = 1.1.4...
CVE-2026-14444 WP Fusion (Pro) <= 3.47.13 - Authenticated (Subscriber+) Privilege Escalation via ThriveCart Auto Login 'role' Parameter
The WP Fusion Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.47.13. This is due to insufficient authorization checks on the role parameter in the ThriveCart Auto Login handler's thrivecart function. This makes it possible for authenticated...
CVE-2026-14444
CVE-2026-14444 is a Privilege Escalation vulnerability in the WP Fusion (Pro) WordPress plugin, affecting all versions up to and including 3.47.13 . The root cause is insufficient authorization checks on the role parameter in the ThriveCart Auto Login handler's thrivecart() function. Authenticate...
EUVD-2026-72403
The WP Fusion Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.47.13. This is due to insufficient authorization checks on the role parameter in the ThriveCart Auto Login handler's thrivecart function. This makes it possible for authenticated...
CVE-2026-14444 WP Fusion (Pro) <= 3.47.13 - Authenticated (Subscriber+) Privilege Escalation via ThriveCart Auto Login 'role' Parameter
The WP Fusion Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.47.13. This is due to insufficient authorization checks on the role parameter in the ThriveCart Auto Login handler's thrivecart function. This makes it possible for authenticated...
CVE-2026-12757 Email Subscribers & Newsletters <= 5.9.27 - Unauthenticated Arbitrary Shortcode Execution via Subscriber Name Field
The The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.9.27. This is due to the software allowing users to execute an action that do...
CVE-2026-12757 Email Subscribers & Newsletters <= 5.9.27 - Unauthenticated Arbitrary Shortcode Execution via Subscriber Name Field
The The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.9.27. This is due to the software allowing users to execute an action that do...
EUVD-2026-72402
The The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.9.27. This is due to the software allowing users to execute an action that do...
CVE-2026-12757
The Email Subscribers & Newsletters WordPress plugin is vulnerable to unauthenticated arbitrary shortcode execution in all versions up to and including 5.9.27 . The root cause is that the plugin's subscription-handling logic does not properly validate user-supplied input (the subscriber name fiel...
CVE-2026-8279
The Masteriyo LMS plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the 'deleteitempermissionscheck' function in the CourseProgressItemsController in all versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers ...
CVE-2026-6431
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Biographical Info' meta field parameter in all versions up to, and including, 3.15.7 due to insufficient input sanitization and...
CVE-2026-4945
The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1.7 via the 'watchcheckout' function due to missing validation on a user controlled key. This makes it possib...
WordPress JetFormBuilder plugin <= 3.6.5.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Anthony Green of Greenhat Security in WordPress Plugin JetFormBuilder versions = 3.6.5.1...
CVE-2026-12853
The Flamingo plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access a...