308380 matches found
CVE-2026-81825 Simple Ajax Chat <= 20260811 - Unauthenticated Stored Cross-Site Scripting
The Simple Ajax Chat – Add a Fast, Secure Chat Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Chat Message in all versions up to, and including, = 20260811 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers t...
CVE-2026-18561
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) for WordPress is vulnerable to unauthenticated SQL injection in versions up to and including 2.0.16 . The flaw resides in the addontype parameter: when supplied as an array, element zero is used verbatim as a SQL comparison operat...
CVE-2026-18964 Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button <= 3.5.9 - Reflected Cross-Site Scripting
The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 3.5.9 due to insufficient input sanitization and...
CVE-2026-81825 Simple Ajax Chat <= 20260811 - Unauthenticated Stored Cross-Site Scripting
The Simple Ajax Chat – Add a Fast, Secure Chat Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Chat Message in all versions up to, and including, = 20260811 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers t...
EUVD-2026-75931
The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 3.5.9 due to insufficient input sanitization and...
CVE-2026-18561 Unlimited Elements For Elementor <= 2.0.16 - Unauthenticated SQL Injection
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection via the 'addontype' parameter in versions up to, and including, 2.0.16. This is due to insufficient escaping on the user-supplied parameter and the lack of sufficient preparation on the existing SQL query in...
CVE-2026-18561 Unlimited Elements For Elementor <= 2.0.16 - Unauthenticated SQL Injection
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection via the 'addontype' parameter in versions up to, and including, 2.0.16. This is due to insufficient escaping on the user-supplied parameter and the lack of sufficient preparation on the existing SQL query in...
EUVD-2026-75932
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection via the 'addontype' parameter in versions up to, and including, 2.0.16. This is due to insufficient escaping on the user-supplied parameter and the lack of sufficient preparation on the existing SQL query in...
EUVD-2026-75930
The Simple Ajax Chat – Add a Fast, Secure Chat Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Chat Message in all versions up to, and including, = 20260811 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers t...
CVE-2026-18964
The Floating Chat Widget (Chaty) plugin for WordPress is vulnerable to reflected cross-site scripting via the 's' parameter in all versions up to and including 3.5.9 . The root cause is insufficient input sanitization and output escaping: WordPress's server-side HTML encoding of the 's' search pa...
CVE-2026-11496 Woo PDF Invoice Builder <= 2.0.8 - Authenticated (Subscriber+) Insecure Direct Object Reference to Sensitive Order Information Disclosure
The Woo PDF Invoice Builder plugin also distributed as "PDF Builder for WooCommerce" for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.8. This is due to the InspectOrder AJAX handler woocommerce-pdf-invoice-ajax.php:513, registered on...
CVE-2026-12215 OTP Login & Register Woocommerce <= 2.7.2 - Unauthenticated Authentication Bypass via Brute Force
The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Authentication Bypass via OTP Brute Force in all versions up to, and including, 2.7.2. The vulnerability exists because the OTP rate-limit attempt counter in processotpform is keyed exclusively on the attacker-controlled...
EUVD-2026-75955
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'dataname' Parameter in all versions up to, and including, 2.0.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...
EUVD-2026-75928
The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Authentication Bypass via OTP Brute Force in all versions up to, and including, 2.7.2. The vulnerability exists because the OTP rate-limit attempt counter in processotpform is keyed exclusively on the attacker-controlled...
CVE-2026-77150 Unlimited Elements For Elementor <= 2.0.16 - Reflected Cross-Site Scripting
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'dataname' Parameter in all versions up to, and including, 2.0.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...
CVE-2026-15462 Sticky Chat Widget <= 1.4.2 - Unauthenticated SQL Injection
The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the 'scwformfields' parameter array keys of the 'scwsaveformdata' AJAX action in versions up to, and including, 1.4.2. This is due to the saveformdata function passing attacker-controlled POST array keys unsanitized to...
CVE-2026-15462
CVE-2026-15462 affects the Sticky Chat Widget WordPress plugin in versions up to and including 1.4.2 . The vulnerability is an unauthenticated SQL injection via the scw_form_fields parameter array keys in the scw_save_form_data AJAX action. The save_form_data() function passes attacker-controlled...
CVE-2026-12215
OTP Login & Register Woocommerce (WordPress plugin) is vulnerable to unauthenticated authentication bypass via OTP brute force in all versions up to and including 2.7.2 . The root cause is threefold: the OTP rate-limit counter is keyed exclusively on the attacker-controlled xoo_ml_user_ip_data co...
CVE-2026-15462 Sticky Chat Widget <= 1.4.2 - Unauthenticated SQL Injection
The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the 'scwformfields' parameter array keys of the 'scwsaveformdata' AJAX action in versions up to, and including, 1.4.2. This is due to the saveformdata function passing attacker-controlled POST array keys unsanitized to...
CVE-2026-77150 Unlimited Elements For Elementor <= 2.0.16 - Reflected Cross-Site Scripting
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'dataname' Parameter in all versions up to, and including, 2.0.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...