315755 matches found
CVE-2026-87796: Unrestricted Upload of File with Dangerous Type
The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.1.9 via the movefile function. This is due to insufficient file type validation during chunked upload handling. This makes it possible for unauthenticated...
PT-2026-95257
Name of the Vulnerable Software and Affected Versions WordPress versions 4.7 through 7.1 Description An unauthenticated stored cross-site scripting XSS issue, dubbed Comment2Shell, exists in the WordPress core. The flaw occurs in the wpautop function, which converts line breaks into paragraphs. A...
PT-2026-95063
Name of the Vulnerable Software and Affected Versions FaustWP versions prior to 1.8.11 Description The FaustWP WordPress plugin fails to include the 16-byte initialization vector in the HMAC Hash-based Message Authentication Code, a mechanism for verifying data integrity within the encrypt and...
CVE-2026-91009: Cross-Site Request Forgery (CSRF)
The Active Woot Products Tables for WooCommerce. 100% FREE WordPress plugin before 2.1.3 does not have authorisation and CSRF checks in some of its AJAX actions, allowing any authenticated users, such as subscriber, to change the title of arbitrary posts, pages and products...
PT-2026-94170
Name of the Vulnerable Software and Affected Versions Dictionary WordPress plugin versions prior to 1.1 Description Lack of authorization, sanitization, and escaping when adding or updating dictionary entries allows unauthenticated users to perform a Stored Cross-Site Scripting XSS attack. This...
CVE-2026-16750: Missing Authorization
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to unauthorized access of data due to missing authorization checks in mvlajaxdealerloadcars function in all versions up to, and including, 1.4.120. This makes it possible for unauthenticated attackers to...
CVE-2026-91014: Improper Neutralization of Input During Web Page Generation
The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.4.2 does not sanitise and escape some of its parameters before reflecting them back in the page, allowing unauthenticated attackers to run arbitrary web scripts in a visitor's browser if they can trick the visitor into...
PT-2026-94193
Name of the Vulnerable Software and Affected Versions Checkout Field Manager Checkout Manager for WooCommerce WordPress versions prior to 7.9.7 Description An issue exists where the software fails to properly validate the ownership of an attachment before deletion. This allows any authenticated...
CVE-2026-92579 AVideo through 29.0 Broken Access Control via CSRF Exemption Basename Collision
In AVideo through 29.0, the autoCSRFGuard function maintains a hardcoded allowlist of exempt basenames tested without directory context, allowing plugin files matching core filenames to inherit CSRF exemptions. The LoginWordPress plugin file login.json.php inherits an exemption and unconditionall...
WordPress Easy Invoice plugin <= 2.3.8 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Rahul Yadav in WordPress Plugin Easy Invoice versions = 2.3.8...
WordPress Cooked plugin <= 1.16.0 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by Nixxies in WordPress Plugin Cooked versions = 1.16.0...
WordPress Simple Membership plugin <= 4.8.2 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Simple Membership versions = 4.8.2...
WordPress Booking Calendar plugin <= 11.7 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Booking Calendar versions = 11.7...
WordPress User Registration plugin <= 5.2.7 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by asdqgggg in WordPress Plugin User Registration versions = 5.2.7...
WordPress PublishPress Series plugin <= 3.1.3 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by benzdeus in WordPress Plugin PublishPress Series versions = 3.1.3...
WordPress Geo Mashup plugin <= 1.13.21 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by JunHee CHO in WordPress Plugin Geo Mashup versions = 1.13.21...
WordPress Xagio SEO plugin <= 7.1.0.43 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by Matheo Beuve in WordPress Plugin Xagio SEO versions = 7.1.0.43...
WordPress WPFunnels plugin <= 3.12.13 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by Aditya Gurav in WordPress Plugin WPFunnels versions = 3.12.13...
WordPress BerqWP plugin <= 4.1.15 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by z3r0s in WordPress Plugin BerqWP versions = 4.1.15...
WordPress Multi Uploader for Gravity Forms plugin <= 1.1.9 - Unauthenticated Arbitrary File Upload vulnerability
Unauthenticated Arbitrary File Upload vulnerability discovered by Adam Rayyan Aryasatya in WordPress Plugin Multi Uploader for Gravity Forms versions = 1.1.9...