21629 matches found
EUVD-2026-67569
The shared-files-pro WordPress plugin before 1.7.70 does not validate the file path supplied when creating a featured image, allowing unauthenticated attackers to read arbitrary files from the server and republish their contents at a public URL...
EUVD-2026-67566
The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.70 do not perform a capability check in their file-upload handler, which is registered for unauthenticated users and protected only by a nonce that is output on public pages, so an unauthenticated visito...
EUVD-2026-67565
The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.68 do not properly sanitize a file path taken from a frontend file submission and their single-pass traversal filter is bypassable, allowing unauthenticated users to store a path that points outside the...
CVE-2026-12514 Shared Files < 1.7.70 - Unauthenticated Limited File Upload
The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.70 do not perform a capability check in their file-upload handler, which is registered for unauthenticated users and protected only by a nonce that is output on public pages, so an unauthenticated visito...
EUVD-2026-67564
The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 's' parameter of the Advanced Search REST endpoint in all versions up to, and including, 4.10.1 due to insufficient input sanitization and output escaping. The REST endpoint at...
CVE-2026-4246
ElementsKit Pro (WordPress plugin) versions up to and including 4.10.1 are affected by an unauthenticated Stored Cross-Site Scripting (XSS) vulnerability via the s parameter of the Advanced Search REST endpoint at /wp-json/elementskit/v1/advanced-search. The endpoint uses permission_callback set ...
CVE-2026-4246 ElementsKit Pro <= 4.10.1 - Unauthenticated Stored Cross-Site Scripting via 's' Parameter
The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 's' parameter of the Advanced Search REST endpoint in all versions up to, and including, 4.10.1 due to insufficient input sanitization and output escaping. The REST endpoint at...
CVE-2026-4246 ElementsKit Pro <= 4.10.1 - Unauthenticated Stored Cross-Site Scripting via 's' Parameter
The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 's' parameter of the Advanced Search REST endpoint in all versions up to, and including, 4.10.1 due to insufficient input sanitization and output escaping. The REST endpoint at...
VulnCheck KEV: CVE-2026-32566
Unauthenticated Privilege Escalation in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...
PT-2026-82878
The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 's' parameter of the Advanced Search REST endpoint in all versions up to, and including, 4.10.1 due to insufficient input sanitization and output escaping. The REST endpoint at...
PT-2026-82875
The shared-files-pro WordPress plugin before 1.7.70 does not validate the file path supplied when creating a featured image, allowing unauthenticated attackers to read arbitrary files from the server and republish their contents at a public URL...
Exploit for CVE-2026-32475
CVE-2026-32475 — Elementor Pro ≤ 4.2.1 Unauthenticated Arbitra...
WordPress WP Maps Pro plugin < 6.1.3 - Unauthenticated Denial of Service vulnerability
Unauthenticated Denial of Service vulnerability discovered by Mohammad Aghdasi in WordPress Plugin Advanced Google Maps versions 6.1.3...
CVE-2026-81272
Editor Broken Access Control in FluentPlayer Pro = 1.3.2 versions...
CVE-2026-81273
Unauthenticated Cross Site Request Forgery CSRF in FluentBooking Pro = 2.2.4 versions...
CVE-2026-78276
Editor PHP Object Injection in Fluent Boards Pro = 2.0.11 versions...
CVE-2026-78271
Editor Privilege Escalation in FluentCRM Pro = 3.1.12 versions...
CVE-2026-78274
Editor Arbitrary File Upload in Fluent Boards Pro = 2.0.11 versions...