58 matches found
WordPress Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin <= 2.48 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Advanced Woo Labels versions = 2.48...
WordPress Easy Appointments plugin <= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Arbitrary Connection Deletion vulnerability
Missing Authorization to Authenticated Contributor+ Arbitrary Connection Deletion vulnerability discovered by Vamshi Krishna Upadrasta in WordPress Plugin Easy Appointments versions = 3.12.27...
CVE-2026-65482
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows DOM-Based XSS.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.6.3...
CVE-2026-65526 WordPress Visualizer plugin <= 4.0.1 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Themeisle Visualizer allows Blind SQL Injection. This issue affects Visualizer: from n/a through 4.0.1...
EUVD-2026-48092
Contributor Local File Inclusion in Vino = 1.9 versions...
CVE-2026-65473
Contributor Cross Site Scripting XSS in Virtue/Ascend/Pinnacle Toolkit = 4.9.12 versions...
PT-2026-63877
Contributor SQL Injection in Quiz And Survey Master = 11.2.0 versions...
WordPress Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin <= 6.6.10 - Authenticated (Contributor+) Account Takeover vulnerability
Authenticated Contributor+ Account Takeover vulnerability discovered by Jonah Burgess CryptoCat in WordPress Plugin Essential Addons for Elementor versions = 6.6.10...
CVE-2026-8892
The CM Business Directory – Optimise and showcase local business plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Business Address Meta Fields in all versions up to, and including, 1.5.7 due to insufficient input sanitization and output escaping. This makes it possible for...
WordPress Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin <= 11.1.4 - Missing Authorization to Authenticated (Contributor+) Arbitrary Quiz Modification and Email Reroute vulnerability
Missing Authorization to Authenticated Contributor+ Arbitrary Quiz Modification and Email Reroute vulnerability discovered by Kirasec in WordPress Plugin Quiz And Survey Master versions = 11.1.4...
CVE-2026-57765
Contributor SQL Injection in WP EasyCart = 5.9.0 versions...
EUVD-2026-41305
Contributor Local File Inclusion in SportsPress Pro = 2.7.29 versions...
WordPress Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin <= 5.9.27 - Missing Authorization to Authenticated (Contributor+) Settings Modification vulnerability
Missing Authorization to Authenticated Contributor+ Settings Modification vulnerability discovered by Dmitrii Ignatyev - CleanTalk Inc in WordPress Plugin Email Subscribers & Newsletters versions = 5.9.27...
CVE-2026-57651
Contributor Cross Site Scripting XSS in Ghost Kit = 3.6.0 versions...
EUVD-2026-39762
Contributor Local File Inclusion in Panorama Viewer – 360 Degree Image + Video Viewer = 1.6.1 versions...
CVE-2026-57618
Contributor Cross Site Scripting XSS in Neve PRO = 3.1.2 versions...
EUVD-2026-39733
Contributor Arbitrary File Deletion in H5P = 1.17.7 versions...
EUVD-2026-39728
Contributor Remote Code Execution RCE in Blocksy Companion Pro = 2.1.45 versions...
PT-2026-52812
Name of the Vulnerable Software and Affected Versions Gallery versions prior to 4.7.9 Description An issue exists that allows for SQL Injection, a technique where malicious SQL statements are inserted into entry fields for execution, specifically affecting contributors. Recommendations Update to ...