49373 matches found
CVE-2025-10005
The PPWP – Password Protect WordPress | 1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.20 via the ppwfreesetpassword AJAX action due to missing validation on a user controlled key. This makes it...
EUVD-2025-210731
The PPWP – Password Protect WordPress | 1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.20 via the ppwfreesetpassword AJAX action due to missing validation on a user controlled key. This makes it...
CVE-2025-10005
The CVE-2025-10005 entry describes a vulnerability in the PPWP – Password Protect WordPress plugin (WordPress). An Insecure Direct Object Reference exists in all versions up to and including 1.9.20 via the ppw_free_set_password AJAX action, caused by missing validation on a user-controlled key. T...
CVE-2025-10005 Password Protect WordPress Lite <= 1.9.20 - Insecure Direct Object Reference to Authenticated (Contributor+) Password Protected Post Password Update
The PPWP – Password Protect WordPress | 1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.20 via the ppwfreesetpassword AJAX action due to missing validation on a user controlled key. This makes it...
CVE-2026-16079 Fullscreen Galleria <= 1.6.12 - Authenticated (Contributor+) SQL Injection via 'href' Attribute in Post Content
The Fullscreen Galleria plugin for WordPress is vulnerable to generic SQL Injection via 'href' Attribute in Post Content in all versions up to, and including, 1.6.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This make...
EUVD-2026-59857
The Fullscreen Galleria plugin for WordPress is vulnerable to generic SQL Injection via 'href' Attribute in Post Content in all versions up to, and including, 1.6.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This make...
CVE-2026-16098 ProSolution WP Client <= 2.0.10 - Unauthenticated Arbitrary File Upload via Content-Disposition Header Filename Override
The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.0.10 via the proSolhandleFileUpload function. This is due to missing validation of the attacker-controlled Content-Disposition header filename, which overrides the...
CVE-2026-16098
CVE-2026-16098 affects the ProSolution WP Client plugin for WordPress up to version 2.0.10, where the proSol_handleFileUpload function allows Arbitrary File Upload. The root cause is missing validation of the attacker-controlled Content-Disposition header filename, which can override the allowed ...
CVE-2026-19613: Exposure of Sensitive Information to an Unauthorized Actor
The ECS WordPress plugin before 4.3.10 does not perform ownership or post-status checks when one of its dynamic repeater data sources reads custom field values from a user-supplied post identifier, allowing users with a contributor-level account or above to read custom field values and post...
CVE-2026-16079: Improper Neutralization of Special Elements used in an SQL Command
The Fullscreen Galleria plugin for WordPress is vulnerable to generic SQL Injection via 'href' Attribute in Post Content in all versions up to, and including, 1.6.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This make...
PT-2026-73137
The Gallery by BestWebSoft plugin for WordPress is vulnerable to SQL Injection via the ' gallery order post id' parameter array keys in all versions up to, and including, 4.7.9. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing...
PT-2026-73121
The ECS WordPress plugin before 4.3.10 does not perform ownership or post-status checks when one of its dynamic repeater data sources reads custom field values from a user-supplied post identifier, allowing users with a contributor-level account or above to read custom field values and post...
PT-2026-73110
Name of the Vulnerable Software and Affected Versions Smash Balloon Social Post Feed versions prior to 4.9.1 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject...
CVE-2026-16775: Improper Neutralization of Input During Web Page Generation
The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'id' Shortcode Attribute in all versions up to, and including, 4.9.0 due to insufficient input sanitization and output escaping. This makes it possible for...
PT-2026-73107
Name of the Vulnerable Software and Affected Versions Toocheke Companion versions prior to 2.11 Description The Toocheke Companion plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs because the toocheke series bg color save function fails to properly sanitize input fro...
CVE-2026-18807 ECS < 4.3.8 - Contributor+ Arbitrary Post Binding and Global Preset Modification via Dynamic Repeater Handlers
The ECS WordPress plugin before 4.3.8 does not have capability or ownership checks on its dynamic repeater actions, relying only on a nonce available to any user who can open the page builder, allowing users with a contributor-level account or above to read, alter and delete the binding...
CVE-2026-18807
The ECS WordPress plugin (specifically Ele Custom Skin for Elementor ) versions prior to 4.3.8 is vulnerable to a missing authorization flaw. The plugin fails to perform adequate capability or ownership checks on its dynamic repeater actions , relying solely on a nonce accessible to any user capa...
CVE-2026-18807 ECS < 4.3.8 - Contributor+ Arbitrary Post Binding and Global Preset Modification via Dynamic Repeater Handlers
The ECS WordPress plugin before 4.3.8 does not have capability or ownership checks on its dynamic repeater actions, relying only on a nonce available to any user who can open the page builder, allowing users with a contributor-level account or above to read, alter and delete the binding...
CVE-2026-14229 ECS < 4.3.8 - Unauthenticated Private Content Disclosure via ecsload
The ECS WordPress plugin before 4.3.8 does not check the post status or any capability when rendering an Elementor document requested through one of its AJAX actions, allowing unauthenticated users to retrieve the rendered content of unpublished private, draft, pending documents by supplying thei...
