291162 matches found
WordPress iTracker360 plugin <= 2.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'itracker_license' Settings Field vulnerability
Cross-Site Request Forgery to Stored Cross-Site Scripting via 'itrackerlicense' Settings Field vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os - krei.dev | ogbuilders.io in WordPress Plugin iTracker360 versions = 2.2.0...
WordPress Quentn WP plugin 1.2.13-1.2.14 - Unauthenticated SQLi vulnerability
Unauthenticated SQLi vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Quentn WP versions 1.2.13-1.2.14...
CVE-2026-77771
The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not scope its second-factor attempt limit to the account being attacked, keying it instead to an identifier the client supplies and can change at will, allowing an attacker who already knows a...
CVE-2026-81431
The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post Contributor...
CVE-2026-82925
The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site's WordPress nonce key, which makes the key publicly computable on installs where that key is absent, left at its sample value, or...
CVE-2026-78361
The zipMoneyZip Co Payments Plugin for WooCommerce WordPress plugin before 2.4.0 does not perform any authorisation checks on one of its front-end request handlers, and does not restrict which option name a caller may supply, allowing unauthenticated users to delete arbitrary WordPress options...
CVE-2026-19840
The Notiqoo WordPress plugin before 1.4.14 does not have capability checks on several of its AJAX actions and builds the name of the option to write from user input, allowing users with a role as low as contributor to modify arbitrary WordPress options, which can be used to deactivate Notiqoo...
CVE-2026-77770
The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not require a validated transaction before deleting site options whose names come from unauthenticated request input, allowing any visitor to delete arbitrary options, which can lock every...
WordPress Loops & Logic plugin < 4.3.0 - Unauthenticated User Data and Site Option Disclosure vulnerability
Unauthenticated User Data and Site Option Disclosure vulnerability discovered by Philipp Doblhofer in WordPress Plugin Loops & Logic versions 4.3.0...
jadx-magic-strings v1.0.3-dev
JADX Magic Strings Plugin A JADX plugin that extracts information from string constants. Features The plugin extracts and analyzes string constants from decompiled code to find: 1. Source File References : Detects references to Java/Kotlin source files .java, .kt, .kts, .scala, .groovy in string...
WordPress ELEX WooCommerce Request a Quote plugin < 2.4.1 - Unauthenticated SQLi vulnerability
Unauthenticated SQLi vulnerability discovered by Artus KG in WordPress Plugin ELEX WooCommerce Request a Quote versions 2.4.1...
WordPress ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form plugin <= 3.1.3 - Missing Authorization to Unauthenticated Sensitive Information Exposure vulnerability
Missing Authorization to Unauthenticated Sensitive Information Exposure vulnerability discovered by NumeX in WordPress Plugin Chat Help versions = 3.1.3...
WordPress WP Business Intelligence Lite plugin <= 3.2.0 - Authenticated (Subscriber+) Missing Authorization to Privilege Escalation vulnerability
Authenticated Subscriber+ Missing Authorization to Privilege Escalation vulnerability discovered by Nabil Irawan in WordPress Plugin Business Intelligence Lite versions = 3.2.0...
WordPress Direct Download for WooCommerce plugin <= 1.19 - Unauthenticated Arbitrary File Read vulnerability
Unauthenticated Arbitrary File Read vulnerability discovered by Spy0x7 in WordPress Plugin Direct Download for WooCommerce versions = 1.19...
WordPress Bulk Password Reset plugin <= 1.3.3 - Authenticated (Subscriber+) Arbitrary Password Reset vulnerability
Authenticated Subscriber+ Arbitrary Password Reset vulnerability discovered by Afan, moonge in WordPress Plugin Bulk Password Reset versions = 1.3.3...
CVE-2026-85645
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the bulkaction parameter in all versions up to, and including, 1.15.46 due to insufficient input sanitization and output escaping. This makes it...
EUVD-2026-75264
The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not scope its second-factor attempt limit to the account being attacked, keying it instead to an identifier the client supplies and can change at will, allowing an attacker who already knows a...
CVE-2026-78361 zipMoney(Zip Co) Payments Plugin for WooCommerce < 2.4.0 - Unauthenticated Arbitrary Option Deletion
The zipMoneyZip Co Payments Plugin for WooCommerce WordPress plugin before 2.4.0 does not perform any authorisation checks on one of its front-end request handlers, and does not restrict which option name a caller may supply, allowing unauthenticated users to delete arbitrary WordPress options...
EUVD-2026-75263
The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not require a validated transaction before deleting site options whose names come from unauthenticated request input, allowing any visitor to delete arbitrary options, which can lock every...
CVE-2026-78361
The zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin, in versions prior to 2.4.0 , is vulnerable to unauthenticated arbitrary option deletion . This is caused by a lack of authorization checks on one of the plugin's front-end request handlers and a failure to restrict the option ...