116 matches found
CVE-2026-66440 WordPress WPIDE – File Manager & Code Editor plugin <= 3.5.7 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in WPIDE – File Manager & Code Editor = 3.5.7 versions...
CVE-2025-14469
The Theme Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1. This is due to missing nonce validation on the msupdate AJAX action. This makes it possible for unauthenticated attackers to modify child theme CSS styles via a forged...
CVE-2026-12426: Exposure of Sensitive Information to an Unauthorized Actor
The Members – Membership & User Role Editor Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.22 via the membersfilterprotectedpostsforrest. This makes it possible for unauthenticated attackers to extract determine the existence...
org.webjars.npm:draft-js (>=0.9.0, <=0.11.7), org.webjars.npm:github-com-marmelab-restful-js (0.9.6) +2 more potentially affected by CVE-2026-59879 via org.webjars.npm:immutable (3.7.6)
org.webjars.npm:immutable MAVEN version 3.7.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:immutable and may be impacted: - org.webjars.npm:draft-js =0.9.0, =0.5.5, =0.8.10 - org.webjars.npm:rc-editor-plugin-image 0.0.3 Source cves:...
org.webjars.npm:draft-js (>=0.9.0, <=0.11.7), org.webjars.npm:github-com-marmelab-restful-js (0.9.6) +2 more potentially affected by CVE-2026-59880 via org.webjars.npm:immutable (3.7.6)
org.webjars.npm:immutable MAVEN version 3.7.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:immutable and may be impacted: - org.webjars.npm:draft-js =0.9.0, =0.5.5, =0.8.10 - org.webjars.npm:rc-editor-plugin-image 0.0.3 Source cves:...
CVE-2026-9154 Arbitrary File Write in Rapid7 InsightConnect Sed Plugin
Arbitrary File Write vulnerability in Rapid7 InsightConnect Sed Plugin on Linux allows authenticated attackers to write attacker-controlled content to arbitrary file paths via the expression parameter...
CVE-2026-3772
The WP Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.9.2. This is due to missing nonce verification in the 'addpluginspage' and 'addthemespage' functions. This makes it possible for unauthenticated attackers to overwrite arbitrar...
WordPress WP Editor plugin <= 1.2.9.2 - Cross-Site Request Forgery to Remote Code Execution vulnerability
Cross-Site Request Forgery to Remote Code Execution vulnerability discovered by Jack Pas Dark. - Black Lantern Security in WordPress Plugin WP Editor versions = 1.2.9.2...
CVE-2026-39640 WordPress Theme Editor plugin <= 3.2 - Cross Site Request Forgery (CSRF) to Remote Code Execution vulnerability
Cross-Site Request Forgery CSRF vulnerability in mndpsingh287 Theme Editor theme-editor allows Code Injection.This issue affects Theme Editor: from n/a through = 3.2...
CVE-2026-3026
A vulnerability has been found in erzhongxmu JEEWMS 3.7. Affected by this issue is some unknown functionality of the file /plug-in/ueditor/jsp/getRemoteImage.jsp of the component UEditor. The manipulation of the argument upfile leads to server-side request forgery. The attack can be initiated...
CVE-2026-1827
The Flask Micro code-editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's codeflask shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
CVE-2026-1827 IDE Micro code-editor <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute
The Flask Micro code-editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's codeflask shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
WordPress Guest posting / Frontend Posting / Front Editor - WP Front User Submit plugin <= 5.0.0 - Missing Authorization to Unauthenticated Media Deletion vulnerability
WordPress Guest posting / Frontend Posting / Front Editor - WP Front User Submit plugin = 5.0.0 - Missing Authorization to Unauthenticated Media Deletion vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan - Knight Squad in WordPress Plugin WP Front User Submit / Front Editor versio...
CVE-2025-12134: Missing Authorization
The ZoloBlocks – Gutenberg Block Editor Plugin with Advanced Blocks, Dynamic Content, Templates & Patterns plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the updatepopupstatus function in all versions up to, and including, 2.3.11. This...
EUVD-2025-34985
The Theme Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0. This is due to missing or incorrect nonce validation on the 'themeeditortheme' page. This makes it possible for unauthenticated attackers to achieve remote code execution v...
EUVD-2021-12898
Malware in sbrugna...
EUVD-2021-25547
Malware in sbrugna...
EUVD-2023-49582
Malicious code in bioql PyPI...