3969 matches found
CVE-2026-2508: Improper Neutralization of Special Elements used in an SQL Command
The Gravity Forms Booking plugin for WordPress is vulnerable to time-based SQL Injection via the ‘staffid’ parameter in all versions up to, and including, 2.7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...
CVE-2026-9619: Missing Authorization
The Reviews and Rating – Docplanner plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...
CVE-2026-8688: Missing Authorization
The Advance Nav Menu Manager plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...
CVE-2026-8378: Undefined Security Weakness
The Frontend File Manager Plugin WordPress plugin through 23.6 does not sanitise nor escape a filename submitted to the frontend file-rename endpoint before storing it as post meta and rendering it back on the admin File Manager listing, leading to a Stored Cross-Site Scripting vulnerability...
CVE-2026-8163: Undefined Security Weakness
The Infility Global WordPress plugin before 2.15.19 does not properly sanitize and escape some parameters before using them in SQL statements, leading to a SQL Injection vulnerability exploitable by authenticated users with Subscriber-level access and above...
CVE-2026-4610: Improper Neutralization of Input During Web Page Generation
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pmauthormessage' parameter in the pmsendmessagetoauthor function in all versions up to, and including, 5.9.9.2 due to insufficient input sanitization and output...
CVE-2026-9822: Undefined Security Weakness
The WP Hotel Booking WordPress plugin before 2.3.1 does not enforce capability checks in several of its AJAX handlers, allowing authenticated users with Subscriber-level access to read other users' booking line items, enumerate active coupons, and read pricing data...
CVE-2026-10779: Missing Authorization
The Classified Listing – Classified ads & Business Directory plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 5.4.2. This is due to a missing capability/ownership check on the galleryimageupdateasfeature AJAX handler action:...
CVE-2026-9013: Missing Authorization
The Bogo plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.1 via the bogorestcreateposttranslation. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the raw title, content, excerpt,...
CVE-2026-54804: Authentication Bypass Using an Alternate Path or Channel
Subscriber Broken Authentication in Melhor Envio = 2.16.3 versions...
CVE-2026-45436: Missing Authorization
Subscriber Broken Access Control in WPBakery Page Builder = 8.7.2 versions...
CVE-2026-54805: Incorrect Privilege Assignment
Subscriber Privilege Escalation in Falang multilanguage = 1.4.2 versions...
CVE-2026-25446: Unrestricted Upload of File with Dangerous Type
Subscriber Arbitrary File Upload in WishList Member X = 3.29.0 versions...
CVE-2026-48967: Improper Neutralization of Special Elements used in an SQL Command
Subscriber SQL Injection in Geo Mashup = 1.13.19 versions...
CVE-2026-40749: Unrestricted Upload of File with Dangerous Type
Subscriber Arbitrary File Upload in Charity Zone = 1.1.1 versions...
CVE-2026-40748: Unrestricted Upload of File with Dangerous Type
Subscriber Arbitrary File Upload in Kids Gift Shop = 0.5.4 versions...
CVE-2026-40723: Missing Authorization
Subscriber Broken Access Control in Bricks Builder = 2.1.4 versions...
CVE-2026-39546: Incorrect Privilege Assignment
Subscriber Privilege Escalation in MultiLoca = 4.2.15 versions...