608847 matches found
EUVD-2026-66953
Unauthenticated Broken Access Control in Kali Forms = 2.4.23 versions...
CVE-2026-81274 WordPress Ditty plugin <= 3.1.67 - Broken Access Control vulnerability
Subscriber Broken Access Control in Ditty = 3.1.67 versions...
CVE-2026-81276 WordPress Kali Forms plugin <= 2.4.23 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Kali Forms = 2.4.23 versions...
EUVD-2026-66952
Subscriber Broken Access Control in Ditty = 3.1.67 versions...
CVE-2026-81272 WordPress FluentPlayer Pro plugin <= 1.3.2 - Broken Access Control vulnerability
Editor Broken Access Control in FluentPlayer Pro = 1.3.2 versions...
CVE-2026-81272
CVE-2026-81272 affects the WordPress FluentPlayer Pro plugin in versions 1.3.2 and below , where an Editor-level Broken Access Control flaw allows a user with the Editor role to perform actions they should not be permitted to. The CVSS 3.1 score is 4.9 (MEDIUM) with the vector AV:N/AC:L/PR:H/UI:N...
EUVD-2026-66950
Editor Broken Access Control in FluentPlayer Pro = 1.3.2 versions...
CVE-2026-80433 WordPress SureFeedback Client Site plugin <= 1.2.12 - Sensitive Data Exposure vulnerability
Subscriber Sensitive Data Exposure in SureFeedback Client Site = 1.2.12 versions...
CVE-2026-80433
SureFeedback Client Site is a WordPress plugin vulnerable to Subscriber-level Sensitive Data Exposure in versions 1.2.12 and below . The CVSS 3.1 score is 7.5 (High) , with a network attack vector requiring no privileges or user interaction, and a high impact on confidentiality but no impact on i...
CVE-2026-78285 WordPress Like Button Rating plugin <= 2.6.61 - SQL Injection vulnerability
Subscriber SQL Injection in Like Button Rating = 2.6.61 versions...
CVE-2026-78285
WordPress Like Button Rating plugin (versions
EUVD-2026-66937
Editor Arbitrary File Upload in Fluent Boards Pro = 2.0.11 versions...
EUVD-2026-66993
Unauthenticated SQL Injection in Epayco = 8.4.6 versions...
CVE-2026-78257
CVE-2026-78257 is a PHP Object Injection vulnerability in the WordPress plugin Booking and Rental Manager for WooCommerce (versions ≤ 2.7.5), discovered by daroo and rated CVSS 8.8 (High) by Patchstack. The flaw allows a user with Contributor privilege to exploit the injection over the network wi...
CVE-2026-78257 WordPress Booking and Rental Manager plugin <= 2.7.5 - PHP Object Injection vulnerability
Contributor PHP Object Injection in Booking and Rental Manager = 2.7.5 versions...
CVE-2026-32564
CVE-2026-32564 is a Subscriber-level SQL Injection in the ACPT (Pro) – Custom Post Types Plugin for WordPress (versions ≤ 2.0.63 ), discovered by VDsec. The vulnerability allows a low-privilege (Subscriber) authenticated user to inject SQL, resulting in HIGH confidentiality impact with changed sc...
EUVD-2026-66990
Subscriber SQL Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...
CVE-2026-32564 WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - SQL Injection vulnerability
Subscriber SQL Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...
CVE-2026-27330
An unauthenticated Broken Access Control vulnerability affects the WordPress plugin Mobile App for WooCommerce in versions ≤ 0.4.62 , as reported by researcher Phat RiO and cataloged by Patchstack. The flaw allows a remote attacker with no prior authentication or user interaction to access protec...