316187 matches found
WordPress WP Events Manager plugin < 2.2.5 - Unauthenticated Payment Bypass and Booking Status Update via IDOR vulnerability
Unauthenticated Payment Bypass and Booking Status Update via IDOR vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin WP Events Manager versions 2.2.5...
WordPress Ninja Forms plugin < 3.14.10 - Unauthenticated Arbitrary Shortcode Execution via Query-String Populated Field Default vulnerability
Unauthenticated Arbitrary Shortcode Execution via Query-String Populated Field Default vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin Ninja Forms versions 3.14.10...
WordPress miniOrange 2FA plugin < 6.2.7 - 2FA Bypass via Password-Only Second-Factor Rebinding vulnerability
2FA Bypass via Password-Only Second-Factor Rebinding vulnerability discovered by Artus KG in WordPress Plugin miniOrange's Google Authenticator versions 6.2.7...
WordPress Contest Gallery plugin < 30.0.7 - Unauthenticated Login-Protection and 2FA Bypass via post_cg_login vulnerability
Unauthenticated Login-Protection and 2FA Bypass via postcglogin vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Contest Gallery versions 30.0.7...
WordPress Event Booking Manager for WooCommerce (Pro) plugin <= 5.0.2 - Unauthenticated Price Manipulation vulnerability
Unauthenticated Price Manipulation vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Event Booking Manager for WooCommerce Pro versions = 5.0.2...
WordPress Newsletters plugin < 4.16 - Unauthenticated API Authentication Bypass via Type Juggling vulnerability
Unauthenticated API Authentication Bypass via Type Juggling vulnerability discovered by Haitam Lazaar in WordPress Plugin Newsletters versions 4.16...
WordPress Easy Booking plugin < 3.5.0 - Unauthenticated Minimum Booking Duration Bypass vulnerability
Unauthenticated Minimum Booking Duration Bypass vulnerability discovered by marim00 in WordPress Plugin Easy Booking – WooCommerce Booking & Reservation Plugin versions 3.5.0...
WordPress Iptanus File Upload plugin < 5.1.7 - File Overwrite via Race Condition vulnerability
File Overwrite via Race Condition vulnerability discovered by Luca Jungnickel in WordPress Plugin WordPress File Upload versions 5.1.7...
WordPress WPForms Lite plugin < 1.10.0.5 - Unauthenticated PayPal Webhook Forgery vulnerability
Unauthenticated PayPal Webhook Forgery vulnerability discovered by Sudhanshu Chauhan RedHunt Labs in WordPress Plugin Contact Form by WPForms versions 1.10.0.5...
NPM: Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site
NPM: Tina: Broken Access Control letting any TinaCloud user authorize against any self-hosted site vulnerability discovered by ? in WordPress Npm next-tinacms-azure versions = 15.0.0...
WordPress ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin <= 6.5.5 - Authenticated (Author+) PHP Object Injection vulnerability
Authenticated Author+ PHP Object Injection vulnerability discovered by Josh Bolding in WordPress Plugin ShortPixel Image Optimizer versions = 6.5.5...
WordPress RT Mega Menu plugin <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pointer_menu_item' Block Attribute vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via 'pointermenuitem' Block Attribute vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg versions = 1.5.2...
CVE-2026-90887
Unauthenticated Cross Site Scripting XSS in WP Inventory Manager = 2.5.4 versions...
CVE-2026-90887 WordPress WP Inventory Manager plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in WP Inventory Manager = 2.5.4 versions...
CVE-2026-90887 WordPress WP Inventory Manager plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in WP Inventory Manager = 2.5.4 versions...
CVE-2026-90887
WP Inventory Manager (WordPress plugin, versions
CVE-2026-78528
CVE-2026-78528 affects the WordPress plugin BerqWP in versions 4.1.15 and earlier . The vulnerability is an unauthenticated Broken Access Control flaw, discovered by z3r0s , meaning any remote user can exploit it without prior authentication. The CVSS 3.1 score is 5.3 (MEDIUM) , with a vector of ...
CVE-2026-78295
An unauthenticated Cross Site Request Forgery (CSRF) vulnerability affects the Xagio SEO WordPress plugin in versions ≤ 7.1.0.43 . The flaw was discovered by Matheo Beuve and rated CVSS 8.8 (High) with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating that a remote, unauthenticated atta...