164 matches found
WCAPF WooCommerce Ajax Product Filter - SQL Injection
WCAPF WooCommerce Ajax Product Filter = 4.2.3 contains a time-based SQL injection caused by insufficient escaping of the 'post-author' parameter, letting unauthenticated attackers extract sensitive database information remotely. id: CVE-2026-3396 info: name: WCAPF WooCommerce Ajax Product Filter ...
CVE-2026-108685
The WP Post Author WordPress plugin before 4.2.0 does not check that the account was created before updating its profile during front-end registration, allowing unauthenticated users to overwrite the display name, nickname and website of the first user account, which is normally the administrator...
CVE-2026-108686
The WP Post Author WordPress plugin before 4.2.0 does not restrict the integration settings it returns to visitors, allowing unauthenticated users to read the reCAPTCHA secret key when one has been saved...
CVE-2026-108685 WP Post Author < 4.2.0 - Unauthenticated Modification of the First User Account's Profile Fields
The WP Post Author WordPress plugin before 4.2.0 does not check that the account was created before updating its profile during front-end registration, allowing unauthenticated users to overwrite the display name, nickname and website of the first user account, which is normally the administrator...
CVE-2026-108686 WP Post Author < 4.2.0 - Unauthenticated reCAPTCHA Secret Key Disclosure
The WP Post Author WordPress plugin before 4.2.0 does not restrict the integration settings it returns to visitors, allowing unauthenticated users to read the reCAPTCHA secret key when one has been saved...
EUVD-2026-112619
The WP Post Author WordPress plugin before 4.2.0 does not restrict the integration settings it returns to visitors, allowing unauthenticated users to read the reCAPTCHA secret key when one has been saved...
EUVD-2026-112618
The WP Post Author WordPress plugin before 4.2.0 does not check that the account was created before updating its profile during front-end registration, allowing unauthenticated users to overwrite the display name, nickname and website of the first user account, which is normally the administrator...
CVE-2026-108686
The WP Post Author WordPress plugin versions before 4.2.0 is vulnerable to an unauthenticated reCAPTCHA secret key disclosure . The plugin fails to restrict the integration settings it returns to visitors, allowing any unauthenticated user to read the secret key once it has been saved. No specifi...
CVE-2026-108685
The WP Post Author WordPress plugin (versions before 4.2.0 ) is vulnerable to an unauthenticated modification of the first user account's profile fields. The root cause is a failure to verify account creation timestamps during front-end registration; if a registration form declares specific field...
WordPress WP Post Author plugin < 4.2.0 - Unauthenticated reCAPTCHA Secret Key Disclosure vulnerability
Unauthenticated reCAPTCHA Secret Key Disclosure vulnerability discovered by Mutantgun in WordPress Plugin WP Post Author versions 4.2.0...
WordPress WP Post Author plugin < 4.2.0 - Unauthenticated Modification of the First User Account's Profile Fields vulnerability
Unauthenticated Modification of the First User Account's Profile Fields vulnerability discovered by Mutantgun in WordPress Plugin WP Post Author versions 4.2.0...
CVE-2026-108125
Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in wp-post-author. This issue affects wp-post-author version 4.0.0 prior to 4.1.0...
CVE-2026-108124
Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in wp-post-author. This issue affects wp-post-author before 4.1.0...
CVE-2026-108125 WordPress Post Author Authenticated SQLi
Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in wp-post-author. This issue affects wp-post-author version 4.0.0 prior to 4.1.0...
CVE-2026-108125 WordPress Post Author Authenticated SQLi
Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in wp-post-author. This issue affects wp-post-author version 4.0.0 prior to 4.1.0...
EUVD-2026-95821
Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in wp-post-author. This issue affects wp-post-author version 4.0.0 prior to 4.1.0...
CVE-2026-108125
The wp-post-author plugin is vulnerable to an SQL injection flaw due to the improper neutralization of special elements used in an SQL command. This security issue specifically affects wp-post-author version 4.0.0 prior to 4.1.0 . Exploitation of this vulnerability may result in high confidential...
CVE-2026-108124 WordPress Post Author Authenticated SQLi
Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in wp-post-author. This issue affects wp-post-author before 4.1.0...
CVE-2026-108124 WordPress Post Author Authenticated SQLi
Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in wp-post-author. This issue affects wp-post-author before 4.1.0...