16144 matches found
CVE-2026-32475 WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files. This issue affects Elementor Pro: from n/a through 4.2.1...
EUVD-2026-62376
Subscriber SQL Injection in Community by PeepSo = 9.0.5.2 versions...
EUVD-2026-62374
Unauthenticated Cross Site Scripting XSS in Newsletter = 9.3.3 versions...
WordPress JetEngine plugin <= 3.8.14 - Remote Code Execution (RCE) vulnerability
Remote Code Execution RCE vulnerability discovered by dutafi in WordPress Plugin JetEngine versions = 3.8.14...
WordPress Kalles Addons plugin <= 1.0.6 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Kalles Addons versions = 1.0.6...
WordPress Maps Marker Pro plugin <= 4.32 - SQL Injection vulnerability
SQL Injection vulnerability discovered by johska in WordPress Plugin Maps Marker Pro versions = 4.32...
CVE-2026-19709 Membership For WooCommerce < 3.1.2 - Unauthenticated Member Data Disclosure via REST Consumer Secret Bypass
The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to reach its REST routes and disclose any user's membership plan detail...
EUVD-2026-62210
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in David Lingren Media LIbrary Assistant allows Stored XSS. This issue affects Media LIbrary Assistant: from n/a through 3.39...
WordPress Media LIbrary Assistant plugin <= 3.39 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Abdullah Kareem "cyberkareem" in WordPress Plugin Media LIbrary Assistant versions = 3.39...
CVE-2026-74012
Deserialization of Untrusted Data vulnerability in TaxoPress allows Object Injection. This issue affects TaxoPress: from n/a through 3.51.0...
CVE-2026-32547
Unauthenticated Cross Site Scripting XSS in BP Better Messages = 2.15.22 versions...
CVE-2026-73996
The Masteriyo LMS WordPress plugin (≤2.3.2) allows unauthenticated arbitrary file uploads, enabling remote code execution on affected sites. Patchstack rates it Critical (CVSS 9.8). No patch version or exploitation evidence is provided in the documents.
EUVD-2026-60797
Unauthenticated Cross Site Scripting XSS in Site Reviews = 8.2.0 versions...
EUVD-2026-60795
Unauthenticated PHP Object Injection in Popup by Supsystic = 1.13.0 versions...
CVE-2026-66644 WordPress Typing Effect plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in Typing Effect = 1.3.7 versions...
CVE-2026-66641 WordPress Video Conferencing with Zoom plugin <= 4.6.8 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in Video Conferencing with Zoom = 4.6.8 versions...
CVE-2026-66627
The WordPress GP Premium plugin (versions ≤ 2.5.5) allows contributors to upload arbitrary files, enabling potential remote code execution, data theft, or site defacement. CVSS 9.9 (Critical) reflects network-accessible, low-complexity exploitation with low privileges required. Update to the late...
CVE-2026-66621 WordPress Ultimate Dashboard Pro plugin <= 3.11.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in MapSteps UG Ultimate Dashboard Pro allows DOM-Based XSS. This issue affects Ultimate Dashboard Pro: from n/a through 3.11.2...
