16121 matches found
WordPress GamiPress <= 2.5.7 - SQL Injection
The GamiPress plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.5.7 due to insufficient escaping on the user supplied parameter '$qv$fieldid' and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to...
RLSA-2026:56936 Important: mysql:8.4 security, bug fix, and enhancement update
MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon mysqld and many client programs and libraries. Security Fixes: mysql: Performance Schema unspecified vulnerability CPU Jul 2026 CVE-2026-61081 mysql: Optimizer unspecified vulnerability CPU Jul 2026...
mysql:8.4 security, bug fix, and enhancement update
An update is available for module.mysql, module.mecab-ipadic, mysql, mecab-ipadic, mecab, module.mecab. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list MySQL is ...
CVE-2026-32475 WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files. This issue affects Elementor Pro: from n/a through 4.2.1...
EUVD-2026-62376
Subscriber SQL Injection in Community by PeepSo = 9.0.5.2 versions...
EUVD-2026-62374
Unauthenticated Cross Site Scripting XSS in Newsletter = 9.3.3 versions...
CVE-2026-19709 Membership For WooCommerce < 3.1.2 - Unauthenticated Member Data Disclosure via REST Consumer Secret Bypass
The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to reach its REST routes and disclose any user's membership plan detail...
EUVD-2026-62210
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in David Lingren Media LIbrary Assistant allows Stored XSS. This issue affects Media LIbrary Assistant: from n/a through 3.39...
WordPress Media LIbrary Assistant plugin <= 3.39 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Abdullah Kareem "cyberkareem" in WordPress Plugin Media LIbrary Assistant versions = 3.39...
CVE-2026-74012
Editor PHP Object Injection in TaxoPress = 3.51.0 versions...
CVE-2026-32547
Unauthenticated Cross Site Scripting XSS in BP Better Messages = 2.15.22 versions...
CVE-2026-73996
The Masteriyo LMS WordPress plugin (≤2.3.2) allows unauthenticated arbitrary file uploads, enabling remote code execution on affected sites. Patchstack rates it Critical (CVSS 9.8). No patch version or exploitation evidence is provided in the documents.
EUVD-2026-60797
Unauthenticated Cross Site Scripting XSS in Site Reviews = 8.2.0 versions...
EUVD-2026-60795
Unauthenticated PHP Object Injection in Popup by Supsystic = 1.13.0 versions...
CVE-2026-66644 WordPress Typing Effect plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in Typing Effect = 1.3.7 versions...
CVE-2026-66641 WordPress Video Conferencing with Zoom plugin <= 4.6.8 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in Video Conferencing with Zoom = 4.6.8 versions...
CVE-2026-66627
The WordPress GP Premium plugin (versions ≤ 2.5.5) allows contributors to upload arbitrary files, enabling potential remote code execution, data theft, or site defacement. CVSS 9.9 (Critical) reflects network-accessible, low-complexity exploitation with low privileges required. Update to the late...
CVE-2026-66621 WordPress Ultimate Dashboard plugin <= 3.11.2 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Ultimate Dashboard = 3.11.2 versions...
