WordPress Post Grid <2.1.8 - Cross-Site Scripting

WordPress Post Grid plugin before 2.1.8 contains a reflected cross-site scripting vulnerability. The slider import search feature and tab parameter of thesettings are not properly sanitized before being output back in the pages, id: CVE-2021-24488 info: name: WordPress Post Grid 2.1.8 - Cross-Sit...

WordPress WooCommerce <1.13.22 - Cross-Site Scripting

WordPress WooCommerce before 1.13.22 contains a reflected cross-site scripting vulnerability via the slider import search feature because it does not properly sanitize the keyword GET parameter. id: CVE-2021-24300 info: name: WordPress WooCommerce 1.13.22 - Cross-Site Scripting author: cckuailong...

CVE-2026-7458

🧨 CVE-2026-7458 – PickPlugins User Verification OTP 绕过 通过 OTP 验证 REST API 中的松散比较实现未认证身份验证绕过 PickPlugins User Verification ≤ 2.0.46 📖 描述 PickPlugins 为 WordPress 开发的 User Verification 插件（版本 ≤ 2.0.46 ）在其 OTP 登录机制中存在一个严重漏洞。由于验证逻辑中采用了松散比较（==），未认证的攻击者可以通过发送布尔值 true（而非数字 OTP 值）来绕过 OTP 认证。攻击者无需知道 OTP...

CVE-2026-14861

The User Verification by PickPlugins WordPress plugin through 2.0.47 does not verify that a request to resend a verification email is authorized to act on the supplied user, nor bind the protecting token to that user, allowing unauthenticated attackers to reset arbitrary users' email-verification...

CVE-2026-14861: Authorization Bypass Through User-Controlled Key

The User Verification by PickPlugins WordPress plugin through 2.0.47 does not verify that a request to resend a verification email is authorized to act on the supplied user, nor bind the protecting token to that user, allowing unauthenticated attackers to reset arbitrary users' email-verification...

CVE-2026-10207 PickPlugins Question Answer <= 1.2.73 - Unauthenticated SQL Injection via 'id' Parameter

The PickPlugins Question Answer plugin for WordPress is vulnerable to SQL Injection in versions up to and including 1.2.73. This is due to insufficient sanitization of user-supplied input via the 'id' GET parameter in the user profile template combined with the use of wpunslash which removes...

EUVD-2026-49734

The PickPlugins Question Answer plugin for WordPress is vulnerable to SQL Injection in versions up to and including 1.2.73. This is due to insufficient sanitization of user-supplied input via the 'id' GET parameter in the user profile template combined with the use of wpunslash which removes...

CVE-2026-10207

The CVE-2026-10207 issue affects the WordPress plugin PickPlugins Question Answer (WordPress) up to version 1.2.73 . The vulnerability is an SQL Injection caused by insufficient sanitization of the user-supplied input via the 'id' GET parameter in the user profile template, combined with wp_unsla...

PT-2026-65428

The PickPlugins Question Answer plugin for WordPress is vulnerable to SQL Injection in versions up to and including 1.2.73. This is due to insufficient sanitization of user-supplied input via the 'id' GET parameter in the user profile template combined with the use of wp unslash which removes...

CVE-2026-10207: Improper Neutralization of Special Elements used in an SQL Command

The PickPlugins Question Answer plugin for WordPress is vulnerable to SQL Injection in versions up to and including 1.2.73. This is due to insufficient sanitization of user-supplied input via the 'id' GET parameter in the user profile template combined with the use of wpunslash which removes...

📄 WordPress PickPlugins 2.0.46 OTP Bypass

WordPress PickPlugins plugin version 2.0.46 proof of concept user verification OTP authentication bypass exploit. ================================================================================================================================== | Title : WordPress PickPlugins 2.0.46 User...

Exploit for CVE-2026-7458

🧨 CVE-2026-7458 – PickPlugins User Verification OTP Bypass Un...

CVE-2025-62745

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PickPlugins Team Showcase allows Stored XSS. This issue affects Team Showcase: from n/a through 1.22.28...

CVE-2025-62745

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PickPlugins Team Showcase allows Stored XSS. This issue affects Team Showcase: from n/a through 1.22.28...

EUVD-2025-209926

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PickPlugins Team Showcase allows Stored XSS. This issue affects Team Showcase: from n/a through 1.22.28...

CVE-2025-62745

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PickPlugins Team Showcase allows Stored XSS. This issue affects Team Showcase: from n/a through 1.22.28...

PT-2026-43132

Name of the Vulnerable Software and Affected Versions Team Showcase versions prior to 1.22.29 Description Improper neutralization of input during web page generation in PickPlugins Team Showcase allows for Stored Cross-site Scripting XSS, a condition where malicious scripts are permanently stored...

CVE-2025-62745: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PickPlugins Team Showcase allows Stored XSS. This issue affects Team Showcase: from n/a through 1.22.28...

WordPress User Verification by PickPlugins plugin <= 2.0.46 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by kai63001 in WordPress Plugin User Verification versions = 2.0.46...

CVE-2026-7458

The User Verification by PickPlugins plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.46. This is due to the use of a loose PHP comparison operator to validate OTP codes in the "userverificationformwrapprocessotpLogin" function. This makes it...