4006 matches found
CVE-2026-104742
The AI Puffer – Chat. Create. Automate. formerly AI Power plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.4.89. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
CVE-2026-104741
The AI Puffer – Chat. Create. Automate. formerly AI Power plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.4.89. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
CVE-2026-103520
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom text attribute user-defined field name' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output...
EUVD-2026-96115
The Graphene theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'Current location' and 'Author profile image URL' Profile Fields in all versions up to, and including, 2.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
CVE-2026-17025
The Graphene theme for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.9.4 . The root cause is insufficient input sanitization and output escaping within the 'Current location' and 'Author profile image URL' profile fields. This allows authentica...
CVE-2026-17025 Graphene <= 2.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Fields
The Graphene theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'Current location' and 'Author profile image URL' Profile Fields in all versions up to, and including, 2.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
EUVD-2026-96100
The Church Admin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, and including, 5.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and...
CVE-2026-94421
The Church Admin plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 5.1.2 . The flaw exists because of insufficient input sanitization and output escaping associated with the 'email' parameter . An authenticated attacker with Subscriber-level a...
CVE-2026-94421 Church Admin <= 5.1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'email' Parameter
The Church Admin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, and including, 5.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and...
EUVD-2026-96097
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom text attribute user-defined field name' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output...
CVE-2026-103520
The HivePress – Business Directory, Listings & Classified Ads Plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 1.7.31 . The root cause is insufficient input sanitization and output escaping of the 'custom text attribute (user-defined field na...
CVE-2026-103520 HivePress <= 1.7.31 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Attribute Value in Administrator-configured HTML Format
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom text attribute user-defined field name' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output...
EUVD-2026-96094
The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'videoid' parameter in all versions up to, and including, 7.9.4 due to insufficient input sanitization and output escaping. Thi...
CVE-2026-14379
The GamiPress – Gamification plugin for WordPress (versions up to and including 7.9.4 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping associated with the 'video_id' parameter . This flaw allows authenticated attackers wi...
CVE-2026-14379 GamiPress <= 7.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'video_id' Parameter
The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'videoid' parameter in all versions up to, and including, 7.9.4 due to insufficient input sanitization and output escaping. Thi...
EUVD-2026-96091
The AI Puffer – Chat. Create. Automate. formerly AI Power plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.4.89. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
CVE-2026-104742
The AI Puffer (formerly AI Power) plugin for WordPress is vulnerable to an authorization bypass in versions up to and including 2.4.89 . The root cause is the plugin's failure to properly verify user permissions during the ajax_save_semantic_search_settings AJAX action. This allows authenticated ...
EUVD-2026-96089
The AI Puffer – Chat. Create. Automate. formerly AI Power plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.4.89. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
CVE-2026-97630
The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Unquoted popup Shortcode Attribute in all versions up to, and including, 7.5.54.7212 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...
CVE-2026-96648
The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Cell 'data' Value via updateRows Action in all versions up to, and including, 1.15.1 due to insufficient input sanitization and output escaping. This makes it possible for...