Lucene search
+L

90804 matches found

CVE
CVE
added 2026/09/09 6:00 a.m.13 views

CVE-2026-82184

The WPLP Cookie Consent WordPress plugin prior to 4.4.2 is missing both authorization and CSRF checks when storing the IAB TCF consent option . Because this code executes on every front-end page load, an unauthenticated attacker can overwrite this site-wide option with arbitrary data. The CVSS 3....

5.3CVSS0.00114EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/09 6:00 a.m.6 views

EUVD-2026-74702

The WP Travel WordPress plugin before 12.0.2 does not verify that the requester is authorized to act on the booking targeted by one of its front-end payment-message handlers, allowing unauthenticated attackers to cancel the payment on any customer's booking...

5.3CVSS0.00221EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/09 6:00 a.m.34 views

CVE-2026-75861 Ultimate Gift Cards for WooCommerce < 3.2.10 - Subscriber+ Gift Card Theft and Destruction via Unauthorized Redemption

The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not verify that the user redeeming a gift card is its intended recipient, allowing any authenticated user, such as a subscriber, to redeem gift cards belonging to other users, zeroing their balance and crediting the value...

0.00212EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/09 6:00 a.m.5 views

EUVD-2026-74705

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end, allowing unauthenticated users to obtain the secret that gates access to any order and, through it, that...

5.3CVSS0.00206EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/09 6:00 a.m.16 views

CVE-2026-75861

The Ultimate Gift Cards for WooCommerce WordPress plugin (versions before 3.2.10 ) fails to verify that the user redeeming a gift card is its intended recipient. This allows any authenticated user with subscriber-level access to redeem another user's gift card, zeroing the original owner's balanc...

6.5CVSS0.00212EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/09 6:00 a.m.5 views

EUVD-2026-74698

The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handler, allowing an unauthenticated attacker who knows the target customer's email address to reset that customer's booking...

3.7CVSS0.00192EPSS
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/09 5:55 a.m.7 views

CVE-2026-39987

CVE-2026-39987 — Marimo Pre-Auth RCE For educational and authorized security research purposes only. Description Pre-authenticated Remote Code Execution in Marimo = 0.20.4. The WebSocket endpoint /terminal/ws skips authentication validation, allowing an unauthenticated attacker to obtain a full...

9.8CVSS7.9AI score0.98945EPSS
SaveExploits25
CVE
CVE
added 2026/09/09 5:31 a.m.13 views

CVE-2026-8615

CVE-2026-8615 affects the Reviso Exporter for WooCommerce WordPress plugin in versions up to and including 1.2.3 . The root cause is a missing capability check and nonce verification on the disconnect_callback() function, registered to the wp_ajax_wcefr-disconnect AJAX action. This function uncon...

4.3CVSS0.00196EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/09/09 5:31 a.m.6 views

EUVD-2026-74690

The Reviso Exporter for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the disconnectcallback function in versions up to, and including, 1.2.3. The function is registered to the...

4.3CVSS0.00196EPSS
SaveExploits0References4
OSV
OSV
added 2026/09/09 5:31 a.m.6 views

CVE-2026-8615 ilGhera Reviso Exporter for WooCommerce <= 1.2.3 - Missing Authorization to Authenticated (Subscriber+) Agreement Grant Token Deletion via disconnect_callback Function

The Reviso Exporter for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the disconnectcallback function in versions up to, and including, 1.2.3. The function is registered to the...

4.3CVSS5.7AI score
SaveExploits0References6
Cvelist
Cvelist
added 2026/09/09 5:31 a.m.32 views

CVE-2026-8615 ilGhera Reviso Exporter for WooCommerce <= 1.2.3 - Missing Authorization to Authenticated (Subscriber+) Agreement Grant Token Deletion via disconnect_callback Function

The Reviso Exporter for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the disconnectcallback function in versions up to, and including, 1.2.3. The function is registered to the...

4.3CVSS0.00196EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/09/09 5:31 a.m.5 views

EUVD-2026-74687

The WPFunnels plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.12.13. This is due to the plugin registering the 'wpfnlloadpayment' AJAX action for both authenticated and unauthenticated wpajaxnopriv users and the underlying addofferproducttocart...

5.3CVSS0.00243EPSS
SaveExploits0References8
Cvelist
Cvelist
added 2026/09/09 5:31 a.m.31 views

CVE-2026-84908 WPFunnels <= 3.12.13 - Missing Authorization to Unauthenticated Arbitrary Product Price Manipulation via 'wpfnl_load_payment' AJAX Action

The WPFunnels plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.12.13. This is due to the plugin registering the 'wpfnlloadpayment' AJAX action for both authenticated and unauthenticated wpajaxnopriv users and the underlying addofferproducttocart...

5.3CVSS0.00243EPSS
SaveExploits0References8
CVE
CVE
added 2026/09/09 5:31 a.m.13 views

CVE-2026-84908

The WPFunnels WordPress plugin (versions ≤ 3.12.13 ) is vulnerable to Missing Authorization in its wpfnl_load_payment AJAX action, which is registered for both authenticated and unauthenticated users. The underlying add_offer_product_to_cart() function performs no nonce verification, no capabilit...

5.3CVSS0.00243EPSS
SaveExploits0References8
Cvelist
Cvelist
added 2026/09/09 5:31 a.m.33 views

CVE-2026-19946 Awesome Support <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Denial via 'user_id' Parameter

The Awesome Support plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.3.9. This is due to a missing capability check on the wpasdomrdenyuser function, which unlike its counterpart wpasdomractivateuser does not enforce currentusercan'editusers' or...

4.3CVSS0.00246EPSS
SaveExploits0References5
CVE
CVE
added 2026/09/09 5:31 a.m.15 views

CVE-2026-19946

The Awesome Support plugin for WordPress (versions up to and including 6.3.9 ) contains a Missing Authorization flaw in the wpas_do_mr_deny_user() function. Unlike its counterpart wpas_do_mr_activate_user(), this function fails to enforce a current_user_can('edit_users') capability check, relying...

4.3CVSS0.00246EPSS
SaveExploits0References5
EUVD
EUVD
added 2026/09/09 5:31 a.m.10 views

EUVD-2026-74686

The Awesome Support plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.3.9. This is due to a missing capability check on the wpasdomrdenyuser function, which unlike its counterpart wpasdomractivateuser does not enforce currentusercan'editusers' or...

4.3CVSS0.00246EPSS
SaveExploits0References5
Kitploit
Kitploit
added 2026/09/09 5:29 a.m.6 views

CVE-2019-8451

This repository does not have a README...

6.5CVSS6.8AI score0.94453EPSS
SaveExploits2
Kitploit
Kitploit
added 2026/09/09 5:28 a.m.6 views

-CVE-2005-3299-

Este repositorio no tiene un README...

5CVSS8AI score0.15919EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/09 4:51 a.m.7 views

cve-2017-12149

Este repositorio no tiene un README...

9.8CVSS8.2AI score0.90713EPSS
SaveExploits14
Rows per page
Query Builder