316188 matches found
CVE-2026-87836
The Comments Import & Export WordPress plugin versions 2.1.11 through 2.5.3 is vulnerable to an unauthorized information disclosure. The plugin fails to restrict comment exports to users with moderation capabilities or scope them to content owned by the requesting user. This allows users with the...
CVE-2026-87786
The Dewa Kirim WordPress plugin (versions
CVE-2026-88792
The Dictionary WordPress plugin (versions
EUVD-2026-81347
The wpShopGermany IT-RECHT KANZLEI WordPress plugin before 2.4 does not generate its API authentication token securely, deriving it from data the requester controls and creating it as a side effect of the check that is supposed to validate it, allowing unauthenticated attackers to predict the tok...
CVE-2026-88795
The wpShopGermany IT-RECHT KANZLEI WordPress plugin (versions before 2.4 ) contains a vulnerability where it fails to generate API authentication tokens securely. The plugin derives these tokens from data controlled by the requester and creates them as a side effect of the validation check. This ...
CVE-2026-86824
The Newsletter WordPress plugin (versions before 9.3.8 ) is vulnerable to unauthenticated subscriber PII disclosure and modification . The root cause is the failure to generate an email tracking signing key with sufficient entropy, combined with the use of an unkeyed hash to sign tracking links. ...
EUVD-2026-81343
The Newsletter WordPress plugin before 9.3.8 does not generate its email tracking signing key with sufficient entropy and signs its tracking links with an unkeyed hash, allowing an unauthenticated attacker who recovers that key offline to forge tracking links, obtain any subscriber's session toke...
CVE-2026-87836 Comments Import & Export 2.1.11 - 2.5.3 - Author+ Comment PII Disclosure via Export
The Comments Import & Export WordPress plugin before 2.5.4 does not restrict its comment export to users able to moderate comments, nor scope the export to content owned by the requesting user, allowing users with the Author role and above to retrieve every comment on the site, including commente...
EUVD-2026-81345
The Comments Import & Export WordPress plugin before 2.5.4 does not restrict its comment export to users able to moderate comments, nor scope the export to content owned by the requesting user, allowing users with the Author role and above to retrieve every comment on the site, including commente...
CVE-2026-86707
The Private Feed Key WordPress plugin (versions
WordPress HT Mega Addons for Elementor plugin 3.2.0-3.2.5 - Contributor+ Stored XSS vulnerability
Contributor+ Stored XSS vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin HT Mega versions 3.2.0-3.2.5...
CVE-2026-86710
The Login with QR WordPress plugin (versions
CVE-2026-86709 The Pressengine <= 1.0 - Unauthenticated Authentication Bypass
The Pressengine WordPress plugin through 1.0 does not stop its login handler from issuing a session when authentication fails, allowing unauthenticated attackers to log in as any user, including administrators...
CVE-2026-86788
The HT Mega Addons for Elementor WordPress plugin, in versions 3.2.0 through 3.2.5 , contains a Stored Cross-Site Scripting (XSS) vulnerability. The issue stems from a failure to restrict HTML tag names used to render section headlines in several widgets and blocks to a safe allowlist. This allow...
EUVD-2026-81341
The Login with QR WordPress plugin through 1.0.0 does not verify that the code used to log a user in is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators...
EUVD-2026-81339
The Private Feed Key WordPress plugin through 0.1 does not verify that the key used to authenticate a feed request is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators...
CVE-2026-86709 The Pressengine <= 1.0 - Unauthenticated Authentication Bypass
The Pressengine WordPress plugin through 1.0 does not stop its login handler from issuing a session when authentication fails, allowing unauthenticated attackers to log in as any user, including administrators...
CVE-2026-86707 Private Feed Key <= 0.1 - Unauthenticated Authentication Bypass via 'feedkey' Parameter
The Private Feed Key WordPress plugin through 0.1 does not verify that the key used to authenticate a feed request is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators...
EUVD-2026-81340
The Pressengine WordPress plugin through 1.0 does not stop its login handler from issuing a session when authentication fails, allowing unauthenticated attackers to log in as any user, including administrators...