61 matches found
CVE-2026-19804
The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 260814 via the 'firstname' parameter parameter. This is due to insufficient...
CVE-2026-19804 s2Member <= 260814 - Unauthenticated Remote Code Execution via 'first_name' Parameter in PayPal Proxy Return
The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 260814 via the 'firstname' parameter parameter. This is due to insufficient...
EUVD-2026-86577
The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 260814 via the 'firstname' parameter parameter. This is due to insufficient...
CVE-2026-19804
The s2Member plugin for WordPress (versions up to and including 260814 ) is vulnerable to Remote Code Execution (RCE) . The root cause is insufficient sanitization of the first_name parameter using esc_refs(), which fails to strip PHP tags before they are substituted into an eval'd Signup Trackin...
CVE-2026-19804 s2Member <= 260814 - Unauthenticated Remote Code Execution via 'first_name' Parameter in PayPal Proxy Return
The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 260814 via the 'firstname' parameter parameter. This is due to insufficient...
CVE-2026-96039
The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via firstname Parameter in all versions up to, and including, 1.8.27 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
CVE-2026-96039
The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.8.27 . The root cause is insufficient input sanitization and output escaping of the first_name parameter. This allows unauthenticated attackers to inject arbitrary ...
CVE-2026-96039 BA Book Everything <= 1.8.27 - Unauthenticated Stored Cross-Site Scripting via first_name Parameter
The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via firstname Parameter in all versions up to, and including, 1.8.27 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
EUVD-2026-86546
The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via firstname Parameter in all versions up to, and including, 1.8.27 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
CVE-2025-7605
CVE-2025-7605 code-projects AVL Rooms Project V1.0/profile.php Inyección SQL NOMBRE DEL PRODUCTOS AFECTADOS AVL Rooms Página web del vendedor https://code-projects.org/avl-rooms-in-php-css-javascript-and-mysql-free-download/ Remitente dazhi Archivo vulnerable /profile.php VERSIÓNES V1.0 Enlace de...
CVE-2026-19945
The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'firstname' parameter in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...
EUVD-2026-74624
The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'firstname' parameter in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...
CVE-2026-19945
The WP Crowdfunding plugin for WordPress is vulnerable to stored cross-site scripting (XSS) via the first_name parameter in all versions up to and including 2.2.1 , caused by insufficient input sanitization and output escaping. An authenticated attacker with subscriber-level access or above can i...
CVE-2026-19945 WP Crowdfunding <= 2.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'first_name' Parameter
The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'firstname' parameter in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...
CVE-2026-19945 WP Crowdfunding <= 2.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'first_name' Parameter
The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'firstname' parameter in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...
CVE-2026-19945: Improper Neutralization of Input During Web Page Generation
The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'firstname' parameter in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...
CVE-2026-75872 HTML Injection in MailerUp double opt-in verification email
HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message carrying arbitrary HTML, to an attacker-chosen address and from the form owner's configured sending identity, via the firstname field of t...
CVE-2026-75872
In maalfer MailerUp before 1.1.3, the unauthenticated public subscription form interpolates the first_name field unescaped into the double opt-in verification email, letting remote attackers send arbitrary HTML from the form owner's configured sending identity to an attacker-chosen address. The v...
CVE-2026-75872 HTML Injection in MailerUp double opt-in verification email
HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message carrying arbitrary HTML, to an attacker-chosen address and from the form owner's configured sending identity, via the firstname field of t...
EUVD-2026-60820
HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message carrying arbitrary HTML, to an attacker-chosen address and from the form owner's configured sending identity, via the firstname field of t...