16353 matches found
WordPress Easy Appointments plugin <= 3.12.26 - Contributor+ Appointment Data Disclosure & Modification vulnerability
Contributor+ Appointment Data Disclosure & Modification vulnerability discovered by Youssef massoudi in WordPress Plugin Easy Appointments versions = 3.12.26...
The vulnerability of the AI.Plugin.Azure software for vulnerability and error detection tools like PT Application Inspector arises from the lack of measures taken to neutralize special elements. This allows attackers to execute arbitrary commands.
The vulnerability of the AI.Plugin.Azure software patch, which is used for identifying vulnerabilities and errors in PT Application Inspector, stems from the lack of measures taken to neutralize its special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary...
PT-2026-66394
Name of the Vulnerable Software and Affected Versions MotoPress Hotel Booking versions prior to 6.0.4 Description The plugin fails to perform a capability check before returning full customer details during an AJAX action. This allows any authenticated user with low-privileged access, such as a...
WordPress CAFEHAUS API plugin <= 1.0.0 - Unauthenticated Arbitrary User Password Reset vulnerability
Unauthenticated Arbitrary User Password Reset vulnerability discovered by moonge in WordPress Plugin CAFEHAUS API versions = 1.0.0...
CVE-2026-16597
The GTM4WP – A Google Tag Manager GTM plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via WooCommerce Billing Fields in all versions up to, and including, 1.22.3 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-13692 PayU CommercePro < 3.9.0 - Unauthenticated Order Tampering
The PayU CommercePro Plugin WordPress plugin before 3.9.0 does not verify the payment-gateway signature before applying order modifications, allowing unauthenticated attackers to tamper with the totals, shipping and metadata of arbitrary WooCommerce orders...
PT-2026-65694
The PayU CommercePro Plugin WordPress plugin through 3.8.9 does not verify the payment-gateway signature before applying order modifications, allowing unauthenticated attackers to tamper with the totals, shipping and metadata of arbitrary WooCommerce orders...
Linux Distros Unpatched Vulnerability : CVE-2026-58178
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Apache Traffic Server ESI plugin can recurse without bound and fetch attacker-controlled URLs. This issue affects Apache Traffic Server: from 8.0.0 through...
CVE-2026-4912
CVE-2026-4912 : The Media Cleaner: Clean your WordPress! plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to and including 7.0.3. The vulnerability is caused by get_urls_from_html() using DOMDocument::loadHTMLFile() to fetch iframe source URLs with an insuffici...
WordPress AIWU plugin <= 1.5.6 - Privilege Escalation vulnerability
Privilege Escalation vulnerability discovered by qdtad in WordPress Plugin AIWU versions = 1.5.6...
CVE-2026-14870
The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin, in versions before 1.5.3 , is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape a parameter, which is subsequently reflected back on an admin page . This vu...
CVE-2026-14490 Demi <= 0.0.6 - Unauthenticated Arbitrary Directory Deletion via demi_restore_step AJAX action
The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 0.0.7. The vulnerability exists because the plugin stores its HMAC signing key and per-step restore token as dotfiles inside a...
EUVD-2026-49692
The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 0.0.7. The vulnerability exists because the plugin stores its HMAC signing key and per-step restore token as dotfiles inside a...
PT-2026-65398
The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete sticker function in all versions up to, and including, 2.15.19. This makes it possible for authenticat...
PT-2026-65388
The PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the serveTemplatePdfAjax function and the serveTemplatePdf REST route which is registered...
CVE-2026-61953 WordPress Simple Link Directory Pro plugin <= 15.0.6 - Server Side Request Forgery (SSRF) vulnerability
Unauthenticated Server Side Request Forgery SSRF in Simple Link Directory Pro = 15.0.6 versions...
CVE-2026-61957 WordPress miniorange otp verification plugin <= 5.5.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in miniorange otp verification = 5.5.1 versions...
EUVD-2026-49405
A flaw was found in the file-icns plugin in GIMP. When applying a decompressed mask during ICNS image processing, the plugin reads from the mask data buffer without verifying if the cursor exceeds the allocated resource size. If a crafted file contains a truncated mask resource, the icnsdecompres...
WordPress Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin <= 2.15.19 - Authenticated (Administrator+) Arbitrary File Deletion vulnerability
Authenticated Administrator+ Arbitrary File Deletion vulnerability discovered by Wordfence PRISM in WordPress Plugin BP Better Messages versions = 2.15.19...
