74 matches found
CVE-2026-16593 WP Directory Kit <= 1.5.7 - Editor+ SQL Injection via Elementor Category and Location Widget Settings
The WP Directory Kit WordPress plugin through 1.5.7 does not sanitize and escape some widget settings before using them in a SQL statement, allowing authenticated users with access to the page builder Editor and above to perform SQL injection attacks that execute when the affected page is rendere...
WordPress WP Directory Kit plugin <= 1.5.7 - Editor+ SQL Injection vulnerability
Editor+ SQL Injection vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin WP Directory Kit versions = 1.5.7...
CVE-2026-84221 Kirki 6.0.0 - 6.2.5 - Editor+ SQLi via Content Manager Field ID
The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allowing users with editor-level access and above to append arbitrary SQL and read the contents of the database, including user credentials...
CVE-2026-78364
CVE-2026-78364 affects the MW WP Form WordPress plugin in versions prior to 5.1.6 . The vulnerability is a Stored Cross-Site Scripting (XSS) caused by failure to sanitize and escape form settings before outputting them in an admin dashboard page, specifically via the Inquiry Data List . An authen...
CVE-2026-78364 MW WP Form < 5.1.6 - Editor+ Stored XSS via Inquiry Data List
The MW WP Form WordPress plugin before 5.1.6 does not sanitise and escape some of its form settings before outputting them back in an admin dashboard page, which could allow users with a role as low as Editor to perform Stored Cross-Site Scripting attacks against high privilege users such as admi...
EUVD-2026-66938
Editor Arbitrary File Deletion in Fluent Boards Pro = 2.0.11 versions...
CVE-2026-75982 LearnPress <= 4.4.4 - Missing Authorization to Authenticated (Editor+) Limited Option Update via 'field_name' Parameter
The LearnPress plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in versions up to, and including, 4.4.4 via the learnpresscreatepage AJAX action. The LPAdminAjax::createpage handler only checks the editpages capability and a wprest nonce both availabl...
EUVD-2026-64042
Unleash is an open-source feature management platform. Prior to 8.0.3, FeatureEventFormatterMd.format in src/lib/addons/feature-event-formatter-md.ts assigns Mustache.escape to an identity function before rendering action and path templates. Because Mustache.escape is process-wide, the assignment...
CVE-2026-63466
Unleash (open-source feature management platform) is affected by a global Mustache.escape override in versions prior to 8.0.3 . The FeatureEventFormatterMd.format function in feature-event-formatter-md.ts assigns Mustache.escape to an identity function before rendering templates. Because this ass...
CVE-2026-15049
CVE-2026-15049 affects the Depicter — Popup & Slider Builder WordPress plugin in versions prior to 4.8.0 . The plugin's import feature does not validate the type of uploaded files and fails to remove malformed uploads, allowing any user with editor-level access to write an arbitrary file—includin...
EUVD-2026-60594
grav-plugin-api getgrav/grav-plugin-api versions = 1.0.0-beta.10 and = 1.0.14 contain a path traversal vulnerability in the PagesController::batchCopy method. An incomplete fix for GHSA-qjq4-jp55-4mx2 left the user-controlled 'suffix' parameter via POST /api/v1/pages/batch unvalidated. An...
CVE-2026-17604 Kirki <= 6.1.1 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' Parameter
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.1.1 via the 'data' parameter parameter. This makes it possible for authenticated attackers, with editor-level access and above, to read...
CVE-2026-28183
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2026-28183
This CVE ID is rejected/not used and does not represent an active vulnerability entry.
EUVD-2026-53953
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2026-67351
Serendipity before 2.6.1 contains an authentication context confusion vulnerability where password validation and session loading operate independently without ensuring both use the same user record. An authenticated Editor can create a username collision with an Administrator account and obtain...
Cross-site Scripting (XSS)
Overview wagtail is an open source content management system built on Django. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the dynamic image URL generator view within the admin interface. An attacker with a limited-permission editor account can execute arbitrary...
EUVD-2026-36916
Editor Privilege Escalation in AI Engine = 3.4.9 versions...