9052 matches found
WordPress HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by kiemtiendinhau in WordPress Plugin HT Mega versions = 3.1.1...
CVE-2026-102720
A DHCP server, or anyone on the LAN who answers a DISCOVER first, can make the client read about a kilobyte past the end of the received message. The option walk keeps a pointer and an offset in step, and the only bound check uses the offset: c / addons/dhcp/nxddhcpclient.c:7538, 7572 / while i...
CVE-2026-102720
A DHCP server, or anyone on the LAN who answers a DISCOVER first, can make the client read about a kilobyte past the end of the received message. The option walk keeps a pointer and an offset in step, and the only bound check uses the offset: c / addons/dhcp/nxddhcpclient.c:7538, 7572 / while i...
CVE-2026-4885
CVE-2026-4885 – Explotación masiva de Piotnet Addons para Elementor Pro Carga arbitraria de archivos no autenticada que conduce a la ejecución remota de código RCE en Piotnet Addons for Elementor Pro ≤ 7.1.70. Esta herramienta está diseñada para la explotación masiva – proporcione una lista de...
ShallowEnd-Plugins
ShallowEnd-Plugins !Build and Releasehttps://github.com/B...
CVE-2026-82901
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in the 'uacf7wpcf7mailcomponents' function in all versions up to, and including, 3.5.50. This makes it possible for unauthenticated attackers to upload arbitrar...
EUVD-2026-87790
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in the 'uacf7wpcf7mailcomponents' function in all versions up to, and including, 3.5.50. This makes it possible for unauthenticated attackers to upload arbitrar...
CVE-2026-82901
The Ultra Addons for Contact Form 7 WordPress plugin (versions ≤ 3.5.50 ) is vulnerable to unauthenticated arbitrary file upload (CWE-434) due to insufficient validation in the uacf7_wpcf7_mail_components function. This flaw is specifically exploitable when the PDF Generator module is enabled (wh...
CVE-2026-82901 Ultra Addons for Contact Form 7 <= 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Form Field
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in the 'uacf7wpcf7mailcomponents' function in all versions up to, and including, 3.5.50. This makes it possible for unauthenticated attackers to upload arbitrar...
CVE-2026-82901 Ultra Addons for Contact Form 7 <= 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Form Field
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in the 'uacf7wpcf7mailcomponents' function in all versions up to, and including, 3.5.50. This makes it possible for unauthenticated attackers to upload arbitrar...
CVE-2026-82901: Unrestricted Upload of File with Dangerous Type
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in the 'uacf7wpcf7mailcomponents' function in all versions up to, and including, 3.5.50. This makes it possible for unauthenticated attackers to upload arbitrar...
Malicious code in @nf-addons/am-global-header (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f4f7297a2ae76eee65506183462a7138df6115ee2bfad9c84878b7f3c7998c8 The package's install lifecycle script runs node index.js, which loads runtime/support/telemetry/probe/impl.js. That module reads os.userInfo.usernam...
WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.51 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Ultimate Addons for Contact Form 7 versions = 3.5.51...
WordPress ThemeREX Addons plugin < 2.45.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin ThemeREX Addons versions 2.45.0...
WordPress ThemeREX Addons plugin < 2.45.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin ThemeREX Addons versions 2.45.0...
WordPress King Addons for Elementor plugin <= 51.1.85 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin King Addons for Elementor versions = 51.1.85...
WordPress The Plus Addons for Elementor Page Builder Lite plugin <= 6.5.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin The Plus Addons for Elementor Page Builder Lite versions = 6.5.1...
CVE-2026-95586
Contributor Cross Site Scripting XSS in Ultimate Addons for Contact Form 7 = 3.5.50 versions...