308019 matches found
PT-2026-90661
Name of the Vulnerable Software and Affected Versions Booking for Appointments and Events Calendar versions prior to 2.5.0 Description Stored Cross-Site Scripting occurs via multiple Elementor widgets due to insufficient input sanitization and output escaping on the load manually parameter within...
PT-2026-89757
The Themify – WooCommerce Product Filter plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via Query Parameter Name in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
PT-2026-89839
The Persian Elementor WordPress plugin from 2.7.10 before 2.8.2 does not verify that the payment authority returned to its ZarinPal payment callback belongs to the transaction being completed, allowing unauthenticated attackers to complete a pending order using a valid payment authority obtained...
PT-2026-89793
The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mla link attributes' parameter in all versions up to, and including, 3.35 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
WordPress Booking for Appointments and Events Calendar – Amelia plugin <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Nguyen Anh Quan prototw in WordPress Plugin Amelia versions = 2.4.9...
PT-2026-90598
Name of the Vulnerable Software and Affected Versions Tutor LMS versions prior to 4.0.8 Description The Tutor LMS plugin for WordPress is affected by a PHP Object Injection issue that can lead to remote code execution on over 100,000 sites worldwide. The flaw exists in the tutor save withdraw...
PT-2026-89774
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not perform any authorization or ownership checks before returning WooCommerce order metadata and the URLs of customer-uploaded attachments, allowing unauthenticated attackers to disclose other customers' order and attachment data...
CVE-2026-83546: Improper Neutralization of Input During Web Page Generation
The CoolClock WordPress plugin before 4.3.8 does not properly escape a skin setting before outputting it within an HTML attribute, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the content is viewed...
CVE-2026-77807 AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.0.4 - Unauthenticated Arbitrary File Read via 'user[name]' Parameter
The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 11.0.4 via the username Parameter. This makes it possible for unauthenticated attackers to read the conten...
CVE-2026-77807 AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.0.4 - Unauthenticated Arbitrary File Read via 'user[name]' Parameter
The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 11.0.4 via the username Parameter. This makes it possible for unauthenticated attackers to read the conten...
CVE-2026-77807
CVE-2026-77807 is a Directory Traversal vulnerability in the AcyMailing WordPress plugin (all versions up to and including 11.0.4 ), accessible via the user[name] parameter. An unauthenticated attacker can read arbitrary files on the server, potentially exposing sensitive information. Exploitatio...
WordPress BuddyPress plugin <= 14.3.3 - Insecure Direct Object Reference to Notifications Deletion vulnerability
Insecure Direct Object Reference to Notifications Deletion vulnerability discovered by Brian Mungai in WordPress Plugin BuddyPress versions = 14.3.3...
WordPress Masteriyo - LMS plugin <= 3.4.0 - Broken Access Control vulnerability
WordPress Masteriyo - LMS plugin = 3.4.0 - Broken Access Control vulnerability discovered by MYUNGYONG LEE in WordPress Plugin Masteriyo - LMS versions = 3.4.0...
WordPress RTMKit plugin <= 2.1.5 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by MYUNGYONG LEE in WordPress Plugin RTMKit versions = 2.1.5...
WordPress Starter Templates plugin <= 4.7.5 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Starter Templates versions = 4.7.5...
WordPress Booktics plugin <= 1.0.24 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Supakiad S. m3ez in WordPress Plugin Booktics versions = 1.0.24...
WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.21 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by sungbyeongchan in WordPress Plugin Flexible Quantity – Measurement Price Calculator for WooCommerce versions = 2.3.21...
WordPress Visual Composer Website Builder plugin <= 45.16.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by sungbyeongchan in WordPress Plugin Visual Composer Website Builder versions = 45.16.1...
WordPress Site Kit by Google plugin <= 1.186.0 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Site Kit by Google versions = 1.186.0...
WordPress Quiz And Survey Master plugin <= 11.2.5 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by Adam Kahlon Adkali in WordPress Plugin Quiz And Survey Master versions = 11.2.5...