8581 matches found
CVE-2026-85123 Easy Form Builder 4.0.0 - 4.1.3 - Unauthenticated Registration Policy Bypass via Login Form Type Confusion
The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to create WordPress accounts on a site whose owner has disabled registration...
CVE-2026-85123 Easy Form Builder 4.0.0 - 4.1.3 - Unauthenticated Registration Policy Bypass via Login Form Type Confusion
The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to create WordPress accounts on a site whose owner has disabled registration...
EUVD-2026-82666
The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to create WordPress accounts on a site whose owner has disabled registration...
EUVD-2026-82665
The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to store arbitrary content which is then rendered unescaped in an admin page, leading to Stored XSS...
CVE-2026-85122 Easy Form Builder 4.0.0 - 4.1.3 - Unauthenticated Stored XSS via Form Type Confusion
The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to store arbitrary content which is then rendered unescaped in an admin page, leading to Stored XSS...
CVE-2026-85122
The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to store arbitrary content which is then rendered unescaped in an admin page, leading to Stored XSS...
CVE-2026-85122 Easy Form Builder 4.0.0 - 4.1.3 - Unauthenticated Stored XSS via Form Type Confusion
The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to store arbitrary content which is then rendered unescaped in an admin page, leading to Stored XSS...
CVE-2026-87965: Improper Access Control
The Easy Appointments WordPress plugin before 4.0.2.2 does not use an unguessable token to authorize its mail-link appointment cancellation and confirmation action, deriving the token from a hardcoded source-embedded salt and the appointment's creation timestamp, so unauthenticated attackers who...
CVE-2026-87966: Authorization Bypass Through User-Controlled Key
The Easy Appointments WordPress plugin before 4.0.2.2 does not perform an ownership or authorization check on its unauthenticated appointment-reservation endpoint before updating an existing appointment identified by a request-supplied id, allowing unauthenticated attackers to overwrite, and...
CVE-2026-12739: Missing Authorization
The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
CVE-2026-85123: Improper Access Control
The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to create WordPress accounts on a site whose owner has disabled registration...
CVE-2026-85122: Improper Neutralization of Input During Web Page Generation
The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to store arbitrary content which is then rendered unescaped in an admin page, leading to Stored XSS...
WordPress WP Easy Pay – Payment and Donation Form Builder for Square plugin <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion vulnerability
Missing Authorization to Authenticated Subscriber+ Arbitrary Post Deletion vulnerability discovered by Wordfence PRISM in WordPress Plugin WP EasyPay versions = 4.5.0...
WordPress Easy Booking plugin < 3.5.0 - Unauthenticated Minimum Booking Duration Bypass vulnerability
Unauthenticated Minimum Booking Duration Bypass vulnerability discovered by marim00 in WordPress Plugin Easy Booking – WooCommerce Booking & Reservation Plugin versions 3.5.0...
CVE-2026-66676
Unauthenticated Broken Access Control in Easy Invoice = 2.3.8 versions...
EUVD-2026-81512
Unauthenticated Broken Access Control in Easy Invoice = 2.3.8 versions...
CVE-2026-66676
CVE-2026-66676 is an unauthenticated Broken Access Control vulnerability in the WordPress Easy Invoice plugin, affecting versions 2.3.8 and below . The vulnerability was discovered by Rahul Yadav and allows a remote attacker to access data with low confidentiality impact (CVSS 3.1: 5.3 MEDIUM ). ...
CVE-2026-66676 WordPress Easy Invoice plugin <= 2.3.8 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Easy Invoice = 2.3.8 versions...