16125 matches found
CVE-2026-66627
The WordPress GP Premium plugin (versions ≤ 2.5.5) allows contributors to upload arbitrary files, enabling potential remote code execution, data theft, or site defacement. CVSS 9.9 (Critical) reflects network-accessible, low-complexity exploitation with low privileges required. Update to the late...
CVE-2026-66621 WordPress Ultimate Dashboard plugin <= 3.11.2 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Ultimate Dashboard = 3.11.2 versions...
CVE-2026-32468
Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway = 2.11.14 versions...
EUVD-2026-60901
Customer PHP Object Injection in Essential Real Estate = 5.3.3 versions...
CVE-2026-32463 WordPress Sync Post With Other Site plugin <= 1.9.3 - Arbitrary File Upload vulnerability
Contributor Arbitrary File Upload in Sync Post With Other Site = 1.9.3 versions...
EUVD-2026-60893
Unauthenticated Cross Site Scripting XSS in Quill Forms = 5.7.1 versions...
CVE-2026-28192
The Piotnet Addons For Elementor Pro WordPress plugin (versions ≤ 7.1.67) allows unauthenticated arbitrary file upload, enabling remote code execution with CVSS 9.6 (Critical). Patchstack assigned PT-2026-77033; CISA SSVC rates technical impact as total with no known exploitation yet. Upgrade bey...
CVE-2026-28192 WordPress Piotnet Addons For Elementor Pro plugin <= 7.1.67 - Arbitrary File Upload vulnerability
Unauthenticated Arbitrary File Upload in Piotnet Addons For Elementor Pro = 7.1.67 versions...
WordPress Typing Effect plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Typing Effect versions = 1.3.7...
WordPress WP Tab Widget plugin <= 1.2.11 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Tab Widget versions = 1.2.11...
EUVD-2026-60105
opensslencrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuard blocks a different set of modules than the AST analyzer's DANGEROUSMODULES set. Attackers can bypass AST analysis through string obfuscation or encoding to import unblocked dangerous...
WordPress Extra Product Options & Add-Ons for WooCommerce plugin < 7.6 - Arbitrary File Download vulnerability
Arbitrary File Download vulnerability discovered by daroo in WordPress Plugin Extra Product Options & Add-Ons for WooCommerce versions 7.6...
WordPress Breeze plugin <= 2.5.12 - Arbitrary Content Deletion vulnerability
Arbitrary Content Deletion vulnerability discovered by Asim Alshaya in WordPress Plugin Breeze versions = 2.5.12...
WordPress Ezoic plugin <= 2.22.11 - Broken Authentication vulnerability
Broken Authentication vulnerability discovered by HaiND in WordPress Plugin Ezoic versions = 2.22.11...
CVE-2026-73403
The CVE-2026-73403 entry concerns the WordPress User Registration plugin (versions ≤ 5.2.6) with unauthenticated broken access control in its registration flow. Affected software: WordPress User Registration plugin; vulnerable component: registration/authentication logic described as enforcing br...
EUVD-2026-57912
Unauthenticated Broken Access Control in GiveWP 4.16.6 versions...
CVE-2026-73344 WordPress WP Data Access plugin <= 5.5.79 - Cross Site Scripting (XSS) vulnerability
Author Cross Site Scripting XSS in WP Data Access = 5.5.79 versions...
CVE-2026-66468
Unauthenticated Cross Site Scripting XSS in Local Delivery Drivers for WooCommerce = 3.0.0 versions...
CVE-2026-66467
CVE-2026-66467 affects the WordPress FluentCommunity plugin (versions <= 2.7.5). The connected records confirm a Cross Site Scripting (XSS) vulnerability in the Subscriber context. The CVE entry lists CVSS v3.1 metrics with a base score of 6.5 (Medium) and attributes: Network attack vector, Lo...