Lucene search
+L

16125 matches found

Patchstack
Patchstack
added 2026/08/10 7:50 a.m.7 views

WordPress Local Delivery Drivers for WooCommerce plugin <= 3.0.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Zamaan in WordPress Plugin Local Delivery Drivers for WooCommerce versions = 3.0.0...

7.1CVSS5.1AI score0.0018EPSS
SaveExploits0Affected Software1
NVD
NVD
added 2026/08/10 7:16 a.m.11 views

CVE-2026-17542

The File Manager WordPress plugin before 6.9.1 does not perform any capability check on one of its file manager connector endpoints, allowing any authenticated user, such as a subscriber, to browse the entire WordPress installation directory and download files of certain types from it, including...

7.5CVSS0.00303EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/10 6:00 a.m.39 views

CVE-2026-17020 Salon Booking System – Free Version <= 10.31.0 - Subscriber+ Arbitrary Booking PII Disclosure

The Salon Booking System WordPress plugin through 10.31.0 does not verify that a requested booking belongs to the caller on one of its REST API endpoints, requiring only a basic read capability, allowing any authenticated user including a Subscriber or self-registered customer account to disclose...

0.00162EPSS
SaveExploits0References1
OSV
OSV
added 2026/08/07 3:46 p.m.30 views

CVE-2026-48093 Code Embed - Contributor Stored Cross-Site Scripting via Remote URL Embed

The Code Embed WordPress plugin prior to version 2.6.1 is vulnerable to stored Cross-Site Scripting XSS through the external URL embed feature in post content. The vulnerable code scans rendered content for URL embed tokens, fetches the remote URL, and inserts the remote response body into the pa...

6.5CVSS5.3AI score
SaveExploits0References5
OSV
OSV
added 2026/08/07 9:17 a.m.8 views

OESA-2026-3238 perl-YAML security update

The YAML.pm module implements a YAML Loader and Dumper based on the YAML 1.0 specification. http://www.yaml.org/spec/ YAML is a generic data serialization language that is optimized for human readability.It can be used to express the data structures of most modern programming languages. Including...

5.4CVSS5AI score
SaveExploits0References2
CVE
CVE
added 2026/08/06 2:28 p.m.85 views

CVE-2026-66709

The CVE-2026-66709 entry describes a Remote Code Execution (RCE) vulnerability in the WordPress CTX Feed plugin (CTX Feed)

9.1CVSS5.6AI score0.00483EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/06 2:27 p.m.58 views

CVE-2026-65545

CVE-2026-65545 concerns the WordPress plugin AI Engine (versions

7.1CVSS5.4AI score0.0018EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/06 2:27 p.m.33 views

CVE-2026-65517 WordPress Easy PayPal Buy Now Button plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Easy PayPal Buy Now Button = 2.0.4 versions...

7.1CVSS0.00184EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/06 2:27 p.m.29 views

CVE-2026-65509 WordPress wpDataTables plugin <= 7.5.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in wpDataTables = 7.5.1 versions...

7.1CVSS0.0018EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/06 2:27 p.m.30 views

CVE-2026-32469 WordPress CAPTCHA 4WP plugin <= 7.6.0 - Captcha Bypass vulnerability

Unauthenticated Bypass Vulnerability in CAPTCHA 4WP = 7.6.0 versions...

5.3CVSS0.00239EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/06 2:27 p.m.47 views

CVE-2026-28177 WordPress Popup Maker plugin <= 1.23.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Popup Maker = 1.23.0 versions...

7.1CVSS0.0018EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/06 2:27 p.m.30 views

CVE-2026-28140 WordPress JetFormBuilder plugin <= 3.6.4.1 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in JetFormBuilder = 3.6.4.1 versions...

7.5CVSS0.00246EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/06 2:27 p.m.75 views

CVE-2026-28139

CVE-2026-28139 concerns the WordPress plugin Ajax Search Lite (vulnerable: ≤ 4.14.4). The issue is an unauthenticated PHP Object Injection in the plugin’s handling of objects, as described in CVE details and corroborated by multiple feeds. Affected component: the Ajax Search Lite plugin; root cau...

9.8CVSS5.5AI score0.00386EPSS
SaveIn wildExploits0References1
CVE
CVE
added 2026/08/06 11:29 a.m.63 views

CVE-2026-11983

The Ad Inserter – Ad Manager & AdSense Ads WordPress plugin is affected by an authorization bypass in versions up to 2.8.16 caused by a missing capability check in the ai_ajax function. This allows unauthenticated attackers to view ad blocks that administrators have restricted to administrator-on...

5.3CVSS5.5AI score0.00251EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/08/06 6:00 a.m.13 views

EUVD-2026-53732

The Child Pages Card WordPress plugin before 1.09 does not sanitise and escape some of its shortcode attributes before outputting them back in a page, allowing users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

5.4CVSS5.5AI score0.00133EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/06 6:00 a.m.8 views

EUVD-2026-53718

PeproDev WooCommerce Receipt Uploader PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 slug: pepro-bacs-receipt-upload-for-woocommerce, all versions up to and including 2.8.0 latest on wordpress.org; no fixed version available at the time of writing, is vulnerable to...

5.3CVSS5.4AI score0.00121EPSS
SaveExploits0References1
Tenable Nessus
Tenable Nessus
added 2026/08/06 12:00 a.m.10 views

TencentOS Server 3: gstreamer1-plugins-bad-free (TSSA-2026:0819)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0819 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

7.5CVSS7.8AI score0.00577EPSS
SaveExploits0References3
NVD
NVD
added 2026/08/05 6:17 p.m.9 views

CVE-2026-70445

Missing permission checks in Jenkins Sauce OnDemand Plugin 2.2.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

4.3CVSS0.0017EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/08/05 5:40 p.m.10 views

CVE-2026-70432

A cross-site request forgery CSRF vulnerability in Jenkins Multijob Plugin 669.v9d96ad9c71b0 and earlier allows attackers to execute arbitrary code in the context of the Jenkins controller JVM...

8.8CVSS5.9AI score0.00207EPSS
SaveExploits0References2
CVE
CVE
added 2026/08/05 1:26 p.m.51 views

CVE-2026-17506

CVE-2026-17506 affects the Independent Analytics plugin for WordPress up to version 2.15.0. The vulnerability is a Stored XSS in the 404 not_found_url tracking parameter caused by get_cell_content() applying urldecode() after esc_url() when rendering the URL column for 404 entries, allowing perce...

7.2CVSS5.7AI score0.0023EPSS
SaveExploits0References7
Rows per page
Query Builder