291012 matches found
CVE-2026-86813
CVE-2026-86813 affects the MetForm WordPress plugin prior to version 4.1.9 . The vulnerability resides in how the plugin handles newline characters in user-submitted values that are placed into notification email headers, specifically the Reply-To field. An unauthenticated attacker can inject add...
EUVD-2026-76041
The MetForm WordPress plugin before 4.1.9 does not properly neutralize newline characters in user-submitted values that are placed into notification email headers, allowing unauthenticated attackers to inject additional email headers, such as Bcc, into the emails the site sends when a submitted...
EUVD-2026-76040
The Persian Elementor WordPress plugin from 2.7.10 before 2.8.2 does not verify that the payment authority returned to its ZarinPal payment callback belongs to the transaction being completed, allowing unauthenticated attackers to complete a pending order using a valid payment authority obtained...
CVE-2026-85116
The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin (versions 1.2.2 before 1.42.3) is vulnerable to unauthenticated arbitrary shortcode execution . The root cause is that the plugin's shortcode parser runs over the entire rendered Contact Form 7 form, including values a visitor submitte...
EUVD-2026-76039
The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin from 1.2.2 before 1.42.3 runs the shortcode parser over the whole rendered Contact Form 7 form, including the values a visitor submitted, allowing unauthenticated users to execute arbitrary shortcodes registered on the site...
CVE-2026-82215 WC PayPay Gateway 0.5 - 0.9.3 - Unauthenticated Payment Bypass via Unverified Webhook
The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the payment notifications it receives before acting on them, allowing unauthenticated attackers who know the store's merchant identifier to mark arbitrary orders as paid, or to cancel...
CVE-2026-82215 WC PayPay Gateway 0.5 - 0.9.3 - Unauthenticated Payment Bypass via Unverified Webhook
The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the payment notifications it receives before acting on them, allowing unauthenticated attackers who know the store's merchant identifier to mark arbitrary orders as paid, or to cancel...
EUVD-2026-76038
The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the payment notifications it receives before acting on them, allowing unauthenticated attackers who know the store's merchant identifier to mark arbitrary orders as paid, or to cancel...
CVE-2026-82215
The Payment Gateway PayPay for WooCommerce WordPress plugin (versions 0.5 through 0.9.3) fails to verify the authenticity of incoming payment notification webhooks before acting on them. An unauthenticated attacker who knows a store's merchant identifier can mark arbitrary orders as paid , or can...
WordPress Payment Gateway PayPay for WooCommerce plugin 0.5-0.9.3 - Unauthenticated Payment Bypass vulnerability
Unauthenticated Payment Bypass vulnerability discovered by Pedro Pinho in WordPress Plugin Payment Gateway PayPay for WooCommerce versions 0.5-0.9.3...
EUVD-2026-76037
The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that the saved payment token being requested belongs to the current user, allowing unauthenticated attackers to retrieve other customers' stored card token references together with a valid authorisation signature...
CVE-2026-82213
CVE-2026-82213 affects the Nexi XPay Build WordPress plugin, versions 7.6.1 through 7.6.2 . The root cause is an Insecure Direct Object Reference (IDOR) flaw: the plugin does not verify that a requested saved payment token belongs to the current user. As a result, unauthenticated attackers can re...
CVE-2026-82213 Nexi XPay Build 7.6.1 - 7.6.2 - Unauthenticated Saved Payment Token Disclosure via IDOR
The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that the saved payment token being requested belongs to the current user, allowing unauthenticated attackers to retrieve other customers' stored card token references together with a valid authorisation signature...
CVE-2026-82213 Nexi XPay Build 7.6.1 - 7.6.2 - Unauthenticated Saved Payment Token Disclosure via IDOR
The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that the saved payment token being requested belongs to the current user, allowing unauthenticated attackers to retrieve other customers' stored card token references together with a valid authorisation signature...
WordPress Nexi XPay Build plugin 7.6.1-7.6.2 - Unauthenticated Saved Payment Token Disclosure vulnerability
Unauthenticated Saved Payment Token Disclosure vulnerability discovered by ryan fabella in WordPress Plugin Nexi XPay Build versions 7.6.1-7.6.2...
WordPress Kirki – Freeform Page Builder, Website Builder & Customizer plugin <= 6.2.0 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by daroo in WordPress Plugin Kirki versions = 6.2.0...
WordPress Unlimited Elements For Elementor plugin <= 2.0.16 - Reflected Cross-Site Scripting vulnerability
Reflected Cross-Site Scripting vulnerability discovered by Kuba in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions = 2.0.16...
CVE-2026-17037
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘comment’ parameter in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for...