4224 matches found
CVE-2026-6933
The Premmerce Dev Tools plugin for WordPress is vulnerable to Remote Code Execution via missing authorization in versions up to and including 2.0. This is due to the 'generatePluginHandler' function lacking any authorization check before processing user-supplied POST data, combined with the...
CVE-2026-8443 WP Review Slider Pro <= 12.6.8 - Authenticated (Subscriber+) SQL Injection via 'stypes' Parameter
The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'stypes' and 'slocations' parameters of the wpprogetoverallchartdata AJAX action in versions up to, and including, 12.6.8. This is due to the use of stripslashes on user-supplied JSON strings prior to jsondecode,...
CVE-2026-39581: Improper Neutralization of Special Elements used in an SQL Command
Subscriber SQL Injection in WP Sessions Time Monitoring Full Automatic = 1.1.4 versions...
CVE-2026-10093: Improper Neutralization of Input During Web Page Generation
The File Sharing & Download Manager – User Private Files plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fldrttl' parameter in all versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
CVE-2026-6933: Unrestricted Upload of File with Dangerous Type
The Premmerce Dev Tools plugin for WordPress is vulnerable to Remote Code Execution via missing authorization in versions up to and including 2.0. This is due to the 'generatePluginHandler' function lacking any authorization check before processing user-supplied POST data, combined with the...
CVE-2026-8444: Improper Neutralization of Special Elements used in an SQL Command
The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'curselrevs' parameter of the wpfbfindreviews AJAX action in versions up to, and including, 12.6.8. This is due to the handler reading $POST'curselrevs' raw with no sanitization or type casting, then concatenatin...
CVE-2026-8443: Improper Neutralization of Special Elements used in an SQL Command
The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'stypes' and 'slocations' parameters of the wpprogetoverallchartdata AJAX action in versions up to, and including, 12.6.8. This is due to the use of stripslashes on user-supplied JSON strings prior to jsondecode,...
CVE-2016-20070 WordPress Booking Calendar Contact Form 1.0.23 Privilege Escalation Stored XSS
WordPress Booking Calendar Contact Form 1.0.23 contains privilege escalation and stored cross-site scripting vulnerabilities that allow authenticated users to modify plugin options and inject malicious scripts by failing to verify user privileges and sanitize input parameters. Attackers with...
CVE-2025-69332: Missing Authorization
Subscriber Broken Access Control in Bookify = 1.1.1 versions...
CVE-2026-48880: Improper Neutralization of Input During Web Page Generation
Subscriber Cross Site Scripting XSS in WP Job Portal = 2.5.2 versions...
CVE-2026-42659: Missing Authorization
Subscriber Broken Access Control in Advanced Form Integration = 1.126.12 versions...
CVE-2026-48882: Improper Neutralization of Special Elements used in an SQL Command
Subscriber SQL Injection in WP Time Slots Booking Form = 1.2.50 versions...
CVE-2026-48870: Improper Neutralization of Input During Web Page Generation
Subscriber Cross Site Scripting XSS in King Addons for Elementor = 51.1.62 versions...
CVE-2026-42651: Missing Authorization
Subscriber Broken Access Control in Classified Listing = 5.3.9 versions...
CVE-2026-52697: Improper Neutralization of Special Elements used in an SQL Command
Subscriber SQL Injection in Taskbuilder = 5.0.7 versions...
CVE-2026-49773: Improper Neutralization of Input During Web Page Generation
Subscriber Cross Site Scripting XSS in FV Flowplayer Video Player 7.5.51.7212 versions...
CVE-2026-49766: Improper Limitation of a Pathname to a Restricted Directory
Subscriber Arbitrary File Deletion in WP User Manager = 2.9.16 versions...
CVE-2026-49082: Insertion of Sensitive Information Into Sent Data
Subscriber Sensitive Data Exposure in Chatway Live Chat – AI Chatbot, Customer Support, FAQ & Helpdesk Customer Service & Chat Buttons = 1.4.8 versions...
CVE-2026-48964: Improper Neutralization of Special Elements used in an SQL Command
Subscriber SQL Injection in ELEX WordPress HelpDesk & Customer Ticketing System = 3.3.6 versions...