41174 matches found
CVE-2026-65524 WordPress Avada Custom Branding plugin <= 1.2 - Broken Access Control vulnerability
Contributor Broken Access Control in Avada Custom Branding = 1.2 versions...
CVE-2026-65501 WordPress Shiptastic for WooCommerce plugin <= 5.1.0 - Insecure Direct Object References (IDOR) vulnerability
Unauthenticated Insecure Direct Object References IDOR in Shiptastic for WooCommerce = 5.1.0 versions...
EUVD-2026-48092
Contributor Local File Inclusion in Vino = 1.9 versions...
CVE-2026-65480 WordPress TheGem theme < 5.12.1.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CodexThemes TheGem allows DOM-Based XSS. This issue affects TheGem: from n/a before 5.12.1.1...
CVE-2026-65480 WordPress TheGem theme < 5.12.1.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CodexThemes TheGem allows DOM-Based XSS. This issue affects TheGem: from n/a before 5.12.1.1...
EUVD-2026-48078
Custom role Server Side Request Forgery SSRF in JetBooking = 4.1.2 versions...
CVE-2026-65466
CVE-2026-65466 concerns a Server Side Request Forgery (SSRF) in the WordPress JetBooking plugin <= 4.1.2 . The description specifies a custom role -driven SSRF vulnerability affecting JetBooking versions up to 4.1.2. The CVSSv3.1 metrics (source: Patchstack) indicate a network attack vector , ...
EUVD-2026-48224
Unauthenticated Cross Site Request Forgery CSRF in Zarinpal Gateway = 5.1.0 versions...
EUVD-2026-48222
Subscriber Broken Access Control in ЮKassa для WooCommerce = 2.16.1 versions...
CVE-2026-59547 WordPress Payment Gateway for PayPal on WooCommerce plugin <= 9.1.4 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Payment Gateway for PayPal on WooCommerce = 9.1.4 versions...
EUVD-2026-48194
Subscriber Privilege Escalation in WP BASE Booking = 6.3.1 versions...
CVE-2026-57735 WordPress Breakdance plugin <= 2.7.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Breakdance = 2.7.1 versions...
CVE-2026-27399 WordPress MarketKing plugin <= 2.1.40 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in MarketKing = 2.1.40 versions...
EUVD-2026-48157
Unauthenticated Broken Access Control in MarketKing = 2.1.40 versions...
Exploit for Use After Free in Linux Linux_Kernel
CVE-2026-43499 Exploit Configuration for realme RMX3888 D...
CVE-2026-15394 Header Footer Script Adder <= 2.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'asm_code' Snippet Meta
The Header Footer Script Adder – Insert Code in Header, Body & Footer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'asmcode' Snippet Meta in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-12421
The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'password' Field Values in all versions up to, and including, 7.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...
Off-by-one error in 'harden-below-nxdomain' logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN
...
CVE-2026-9713
The Lumise Product Designer for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'id' and 'table' parameters in the uploaded cart JSON file processed by the checkout AJAX action in versions up to, and including, 2.1.1. This is due to insufficient escaping on the user-suppli...
CVE-2026-9713
CVE-2026-9713 : The Lumise Product Designer for WooCommerce WordPress plugin (up to version 2.1.1) is vulnerable to SQL injection via the uploaded cart JSON file processed by the checkout AJAX action. The root cause is insufficient escaping of user-provided parameters in the find_resource() funct...