Lucene search
+L

4471 matches found

NVD
NVD
added 2026/09/19 9:16 a.m.7 views

CVE-2026-9766

The Empik for Woocommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

4.3CVSS0.00232EPSS
SaveExploits0References8
CVE
CVE
added 2026/09/19 8:27 a.m.12 views

CVE-2026-9766

The Empik for Woocommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 1.5.1 . The root cause is improper verification of user permissions in the empik_csv_process_emp_log_classes AJAX action, allowing any authenticated user with subscriber-level ...

4.3CVSS0.00232EPSS
SaveExploits0References8
Cvelist
Cvelist
added 2026/09/19 8:27 a.m.11 views

CVE-2026-5410 Redux Framework <= 4.5.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Spinner Field Input

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the spinner field in versions up to, and including, 4.5.13 This is due to insufficient input sanitization and output escaping. In the usermetasave function scalar values bypass the sanitization logic that on...

6.4CVSS0.00216EPSS
SaveExploits0References7
NVD
NVD
added 2026/09/19 8:16 a.m.4 views

CVE-2026-5400

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Media field filter values in versions up to, and including, 4.5.13 This is due to insufficient input sanitization of nested array values in the usermetasave function and unsafe output of filter CSS value...

6.4CVSS0.00241EPSS
SaveExploits0References10
NVD
NVD
added 2026/09/19 8:16 a.m.5 views

CVE-2026-2278

The VW Writer Blog theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'vwwriterblogresetallsettings' function in all versions up to, and including, 1.3.8. This makes it possible for authenticated attackers, with Subscriber-level access...

4.3CVSS0.00196EPSS
SaveExploits0References4
NVD
NVD
added 2026/09/19 8:16 a.m.4 views

CVE-2026-15946

The Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.23. This is due to the plugin not properly verifying that a user is authorized to perform an...

4.3CVSS0.00232EPSS
SaveExploits0References8
NVD
NVD
added 2026/09/19 8:16 a.m.5 views

CVE-2026-13770

The AppMySite – WordPress & WooCommerce Mobile App Builder No-Code Android & iOS App Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via saveamslicensekey AJAX Handler in all versions up to, and including, 3.15.3 due to insufficient input sanitization and output escaping...

6.4CVSS0.00201EPSS
SaveExploits0References6
EUVD
EUVD
added 2026/09/19 7:43 a.m.5 views

EUVD-2026-83545

The Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.23. This is due to the plugin not properly verifying that a user is authorized to perform an...

4.3CVSS0.00232EPSS
SaveExploits0References8
Cvelist
Cvelist
added 2026/09/19 7:43 a.m.10 views

CVE-2026-15946 Search Atlas SEO <= 2.6.23 - Missing Authorization to Authenticated (Subscriber+) Whitelabel Password Modification via handle_whitelabel_password_early Function

The Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.23. This is due to the plugin not properly verifying that a user is authorized to perform an...

4.3CVSS0.00232EPSS
SaveExploits0References8
Cvelist
Cvelist
added 2026/09/19 7:43 a.m.11 views

CVE-2026-13770 AppMySite <= 3.15.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via save_ams_license_key AJAX Handler

The AppMySite – WordPress & WooCommerce Mobile App Builder No-Code Android & iOS App Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via saveamslicensekey AJAX Handler in all versions up to, and including, 3.15.3 due to insufficient input sanitization and output escaping...

6.4CVSS0.00201EPSS
SaveExploits0References6
EUVD
EUVD
added 2026/09/19 7:43 a.m.5 views

EUVD-2026-83576

The Flex Import plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.0. This is due to the licenseactivatefleximp and licensedeactivatefleximp functions, hooked to the wpajaxlicenseactivatefleximp and wpajaxlicensedeactivatefleximp AJAX actions,...

4.3CVSS0.0025EPSS
SaveExploits0References10
NVD
NVD
added 2026/09/19 3:17 a.m.6 views

CVE-2026-87909

The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppaimagemagick function. This is due to insufficient sanitization of the multipart upload filename before concatenation into an ImageMagick command string executed via exec, with only...

7.5CVSS0.00525EPSS
SaveExploits0References6
Kitploit
Kitploit
added 2026/09/19 2:36 a.m.7 views

CVE-2022-1051

CVE-2022-1051 WPQA 5.2 - Хранимый межсайтовый скриптинг XSS через поля профиля у пользователей с ролью «Подписчик» и выше Описание Плагин, используемый в качестве сопутствующего плагина для тем Discy и Himer, не санитизирует и не экранирует поля города, телефона или учётных данных профиля при их...

5.4CVSS6.1AI score0.01271EPSS
SaveExploits2
CVE
CVE
added 2026/09/19 2:27 a.m.16 views

CVE-2026-87909

The WP Photo Album Plus WordPress plugin (versions ≤ 9.2.09.002 ) is vulnerable to authenticated remote code execution (CVSS 7.5 HIGH) via the wppa_image_magick function. The root cause is insufficient sanitization of a multipart upload filename before it is concatenated into an ImageMagick comma...

7.5CVSS0.00525EPSS
SaveExploits0References6
EUVD
EUVD
added 2026/09/19 2:27 a.m.5 views

EUVD-2026-83471

The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppaimagemagick function. This is due to insufficient sanitization of the multipart upload filename before concatenation into an ImageMagick command string executed via exec, with only...

7.5CVSS0.00525EPSS
SaveExploits0References6
EUVD
EUVD
added 2026/09/19 2:27 a.m.4 views

EUVD-2026-83470

The Divi Essential plugin for WordPress is vulnerable to sensitive information exposure in versions up to, and including, 5.8.1 via the dnxtegetdatabasetables and dnxtegetdatabasedata AJAX actions. The handlers only conditionally verify a nonce the check runs solely when the 'nonce' POST paramete...

6.5CVSS0.00221EPSS
SaveExploits0References2
CVE
CVE
added 2026/09/19 2:27 a.m.10 views

CVE-2026-89333

Tutor LMS (eLearning plugin for WordPress, versions up to and including 4.0.8 ) contains an Insecure Direct Object Reference (IDOR) vulnerability via the student_id parameter, caused by missing validation on a user-controlled key. Authenticated attackers with subscriber-level access or higher can...

6.5CVSS0.00269EPSS
SaveExploits0References7
Nuclei
Nuclei
added 2026/09/19 2:05 a.m.28 views

WordPress CBX Bookmark & Favorite Plugin <= 2.0.4 - SQL Injection

CBX Bookmark & Favorite WordPress plugin = 2.0.4 contains a SQL injection caused by insufficient escaping of the 'orderby' parameter, letting authenticated attackers with Subscriber-level access extract sensitive database information id: CVE-2025-13652 info: name: WordPress CBX Bookmark & Favorit...

6.5CVSS5.7AI score0.01167EPSS
SaveExploits0References3
Kitploit
Kitploit
added 2026/09/19 1:43 a.m.7 views

CVE-2023-47504-POC

CVE-2023-47504 POC CVE-2023-47504 のエクスプロイト。 NIST によると、この脆弱性により、認証されていないユーザーが Elementor Website Builder プラグインの機能にアクセスできるはずです。 脆弱性の調査と、脆弱性を説明する Patchstack の URL...

9.8CVSS7.9AI score0.01452EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/18 9:55 p.m.10 views

CVE-2024-7856

CVE-2024-7856 ★ CVE-2024-7856 PoC произвольного удаления файлов ★ Описание CVE-2024-7856 : MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar = 5.7.0.1 – Отсутствие проверки авторизации у аутентифицированных пользователей Subscriber+: произвольное удаление файлов Исследователь :...

8.1CVSS6.4AI score0.19177EPSS
SaveExploits1
Rows per page
Query Builder