16121 matches found
CVE-2026-32463 WordPress Sync Post With Other Site plugin <= 1.9.3 - Arbitrary File Upload vulnerability
Contributor Arbitrary File Upload in Sync Post With Other Site = 1.9.3 versions...
EUVD-2026-60893
Unauthenticated Cross Site Scripting XSS in Quill Forms = 5.7.1 versions...
CVE-2026-28192
The Piotnet Addons For Elementor Pro WordPress plugin (versions ≤ 7.1.67) allows unauthenticated arbitrary file upload, enabling remote code execution with CVSS 9.6 (Critical). Patchstack assigned PT-2026-77033; CISA SSVC rates technical impact as total with no known exploitation yet. Upgrade bey...
CVE-2026-28192 WordPress Piotnet Addons For Elementor Pro plugin <= 7.1.67 - Arbitrary File Upload vulnerability
Unauthenticated Arbitrary File Upload in Piotnet Addons For Elementor Pro = 7.1.67 versions...
WordPress Typing Effect plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Typing Effect versions = 1.3.7...
WordPress WP Tab Widget plugin <= 1.2.11 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Tab Widget versions = 1.2.11...
EUVD-2026-60105
opensslencrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuard blocks a different set of modules than the AST analyzer's DANGEROUSMODULES set. Attackers can bypass AST analysis through string obfuscation or encoding to import unblocked dangerous...
WordPress Extra Product Options & Add-Ons for WooCommerce plugin < 7.6 - Arbitrary File Download vulnerability
Arbitrary File Download vulnerability discovered by daroo in WordPress Plugin Extra Product Options & Add-Ons for WooCommerce versions 7.6...
WordPress Breeze plugin <= 2.5.12 - Arbitrary Content Deletion vulnerability
Arbitrary Content Deletion vulnerability discovered by Asim Alshaya in WordPress Plugin Breeze versions = 2.5.12...
WordPress Ezoic plugin <= 2.22.11 - Broken Authentication vulnerability
Broken Authentication vulnerability discovered by HaiND in WordPress Plugin Ezoic versions = 2.22.11...
CVE-2026-73403
The CVE-2026-73403 entry concerns the WordPress User Registration plugin (versions ≤ 5.2.6) with unauthenticated broken access control in its registration flow. Affected software: WordPress User Registration plugin; vulnerable component: registration/authentication logic described as enforcing br...
EUVD-2026-57912
Unauthenticated Broken Access Control in GiveWP 4.16.6 versions...
CVE-2026-73344 WordPress WP Data Access plugin <= 5.5.79 - Cross Site Scripting (XSS) vulnerability
Author Cross Site Scripting XSS in WP Data Access = 5.5.79 versions...
CVE-2026-66468
Unauthenticated Cross Site Scripting XSS in Local Delivery Drivers for WooCommerce = 3.0.0 versions...
CVE-2026-66467
CVE-2026-66467 affects the WordPress FluentCommunity plugin (versions <= 2.7.5). The connected records confirm a Cross Site Scripting (XSS) vulnerability in the Subscriber context. The CVE entry lists CVSS v3.1 metrics with a base score of 6.5 (Medium) and attributes: Network attack vector, Lo...
CVE-2026-66453 WordPress Salon booking system plugin <= 10.30.26 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in Salon booking system = 10.30.26 versions...
EUVD-2026-57977
Unauthenticated Arbitrary File Download in OMGF Pro = 5.2.7 versions...
CVE-2026-61974
Unauthenticated Cross Site Scripting XSS in Mang Board WP = 2.3.4 versions...