291082 matches found
CVE-2026-81275 WordPress Youzify plugin <= 1.3.7 - Arbitrary File Download vulnerability
Subscriber Arbitrary File Download in Youzify = 1.3.7 versions...
CVE-2026-81782 WordPress WP Docs plugin <= 2.3.1 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting XSS in WP Docs = 2.3.1 versions...
CVE-2026-81275 WordPress Youzify plugin <= 1.3.7 - Arbitrary File Download vulnerability
Subscriber Arbitrary File Download in Youzify = 1.3.7 versions...
CVE-2026-81782
WordPress WP Docs plugin versions up to 2.3.1 contain a Cross-Site Scripting (XSS) vulnerability accessible to Subscriber-level users. The CVSS v3.1 score is 6.5 (Medium) , with a network attack vector, low complexity, required user interaction, and a changed scope resulting in low impact on conf...
CVE-2026-81782 WordPress WP Docs plugin <= 2.3.1 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting XSS in WP Docs = 2.3.1 versions...
CVE-2026-66674 WordPress Simple Cloudflare Turnstile plugin <= 1.42.1 - Captcha Bypass vulnerability
Unauthenticated Bypass Vulnerability in Simple Cloudflare Turnstile = 1.42.1 versions...
CVE-2026-66674
CVE-2026-66674 affects the Simple Cloudflare Turnstile WordPress plugin, versions
CVE-2026-66632
CVE-2026-66632 is an unauthenticated Content Injection vulnerability in the WordPress plugin Simple Cloudflare Turnstile , affecting versions 1.42.1 and earlier . Discovered by kta1kri , the flaw allows a remote attacker with no prior access or user interaction to inject content, carrying a CVSS ...
CVE-2026-66632 WordPress Simple Cloudflare Turnstile plugin <= 1.42.1 - Content Injection vulnerability
Unauthenticated Content Injection in Simple Cloudflare Turnstile = 1.42.1 versions...
CVE-2026-66632 WordPress Simple Cloudflare Turnstile plugin <= 1.42.1 - Content Injection vulnerability
Unauthenticated Content Injection in Simple Cloudflare Turnstile = 1.42.1 versions...
CVE-2026-66674 WordPress Simple Cloudflare Turnstile plugin <= 1.42.1 - Captcha Bypass vulnerability
Unauthenticated Bypass Vulnerability in Simple Cloudflare Turnstile = 1.42.1 versions...
CVE-2026-85310 WordPress Groundhogg plugin <= 4.7.1 - Path Traversal vulnerability
importcontacts Path Traversal in Groundhogg = 4.7.1 versions...
CVE-2026-85310 WordPress Groundhogg plugin <= 4.7.1 - Path Traversal vulnerability
importcontacts Path Traversal in Groundhogg = 4.7.1 versions...
CVE-2026-85310
A Path Traversal vulnerability exists in the import_contacts function of the Groundhogg WordPress plugin, affecting versions ≤ 4.7.1 . The CVSS 3.1 score is 6.5 (Medium) , indicating a network-attack vector with low complexity, low privileges required, and a high impact on confidentiality but no ...
CVE-2026-88876
AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/PlayerSkins/seo.php that allows unauthenticated attackers to access password-protected video sources by calling getSources without password validation. Attackers can request t...
CVE-2026-88869
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the ADServer plugin's log.php endpoint that fails to escape the label parameter before storage. An unauthenticated attacker can inject malicious HTML through the label parameter,...
CVE-2026-88870
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in the LoginControl plugin PGP key endpoints that lack CSRF token validation. Attackers can craft malicious pages with image tags pointing to savePublicKey.json.php to replace a...
CVE-2026-88868
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LiveLinks plugin where title and description fields are stored without sanitization. A user with canStream permission can inject malicious scripts that execute in the browser...
WordPress Insert or Embed Articulate Content into WordPress plugin < 4.3000000025 - Author+ Upload to RCE vulnerability
Author+ Upload to RCE vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Insert or Embed Articulate Content into WordPress versions 4.3000000025...
WordPress WPMK Block plugin <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zakaria in WordPress Plugin WPMK Block versions = 1.0.1...