14284 matches found
CVE-2026-15823
The Builderall Cheetah For Wp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disable function in versions up to, and including, 3.0.2. The wpajaxbacheetahdisable AJAX handler is registered without any capability or nonce...
CVE-2026-14873
The Bulk Password Reset plugin for WordPress is affected in all versions up to and including 1.3.3 by a privilege escalation vulnerability. The plugin fails to properly validate a user's identity before updating account details, allowing an authenticated attacker with subscriber-level access or a...
CVE-2026-14873 Bulk Password Reset <= 1.3.3 - Authenticated (Subscriber+) Arbitrary Password Reset
The Bulk Password Reset plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.3. This is due to the plugin not properly validating a user's identity prior to updating their details like arbitrary user passwords, including...
CVE-2026-15823 Builderall for WordPress <= 3.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'ba_cheetah_data[post_id]' Parameter
The Builderall Cheetah For Wp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disable function in versions up to, and including, 3.0.2. The wpajaxbacheetahdisable AJAX handler is registered without any capability or nonce...
CVE-2026-15823 Builderall for WordPress <= 3.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'ba_cheetah_data[post_id]' Parameter
The Builderall Cheetah For Wp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disable function in versions up to, and including, 3.0.2. The wpajaxbacheetahdisable AJAX handler is registered without any capability or nonce...
CVE-2026-15823
The Builderall Cheetah For Wp WordPress plugin (versions ≤ 3.0.2 ) contains a missing authorization flaw in the wp_ajax_ba_cheetah_disable AJAX handler. The disable() function is registered without a capability or nonce check, and the target post ID is read directly from user-controlled $_POST['b...
CVE-2026-87870
The Ninja Forms - Scheduled Exports plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API Parameters interval, format, emailTo in all versions up to, and including, 3.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
CVE-2026-87870 Ninja Forms - Scheduled Exports <= 3.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via REST API Parameters
The Ninja Forms - Scheduled Exports plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API Parameters interval, format, emailTo in all versions up to, and including, 3.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
CVE-2026-5399: Improper Neutralization of Input During Web Page Generation
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User Profile settings in versions up to and including 4.5.13.1. This is due to insufficient input sanitization in the usermetasave function which only sanitizes array values, not scalar...
CVE-2026-81791: Improper Neutralization of Input During Web Page Generation
Subscriber Cross Site Scripting XSS in EventON = 2.5.7 versions...
CVE-2026-15823: Missing Authorization
The Builderall Cheetah For Wp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disable function in versions up to, and including, 3.0.2. The wpajaxbacheetahdisable AJAX handler is registered without any capability or nonce...
CVE-2026-81782: Improper Neutralization of Input During Web Page Generation
Subscriber Cross Site Scripting XSS in WP Docs = 2.3.1 versions...
PT-2026-89429
Subscriber Cross Site Scripting XSS in WP Docs = 2.3.1 versions...
PT-2026-89437
Subscriber Cross Site Scripting XSS in EventON = 2.5.7 versions...
CVE-2026-81788: Missing Authorization
Subscriber Broken Access Control in IMPress for IDX Broker = 3.3.0 versions...
CVE-2026-14873: Missing Authorization
The Bulk Password Reset plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.3. This is due to the plugin not properly validating a user's identity prior to updating their details like arbitrary user passwords, including...
CVE-2026-81803: Improper Control of Generation of Code
Subscriber Remote Code Execution RCE in RepairBuddy = 4.1224 versions...
PT-2026-89445
Subscriber Remote Code Execution RCE in RepairBuddy = 4.1224 versions...