13617 matches found
CVE-2026-88999 Redux Framework <= 4.5.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion via 'attachment_id' Parameter
The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...
EUVD-2026-90501
The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...
CVE-2026-91109
The Simply Schedule Appointments plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) in versions up to and including 1.6.12.31 . The root cause is a lack of validation on a user-controlled key within the 'complete_group' parameter. Authenticated attackers with subscri...
EUVD-2026-90466
The Simply Schedule Appointments plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.31 via the 'completegroup' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...
CVE-2026-92537 Newsletter <= 9.3.9 - Unauthenticated Insufficiently Protected Credentials via '/tnp/l/' Click-Tracking REST Endpoint (Raw Subscriber Token Cookie Disclosure)
The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Insufficiently Protected Credentials in all versions up to, and including, 9.3.9 The plugin's public click-tracking REST route /tnp/l/ is registered with permissioncallback = 'returntrue' and, upon receiving...
CVE-2026-92537 Newsletter <= 9.3.9 - Unauthenticated Insufficiently Protected Credentials via '/tnp/l/' Click-Tracking REST Endpoint (Raw Subscriber Token Cookie Disclosure)
The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Insufficiently Protected Credentials in all versions up to, and including, 9.3.9 The plugin's public click-tracking REST route /tnp/l/ is registered with permissioncallback = 'returntrue' and, upon receiving...
EUVD-2025-209818
The Broadstreet plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.53.1 via the getsponsoredmeta AJAX action. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract data from password protect...
CVE-2026-19807: Improper Privilege Management
The ByteCoreStack – MCP Connector for AI Tools plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.3 This is due to the wpupdateusermeta MCP tool in executetool gating writes solely with currentusercan'edituser', $uid — a check that WordPress core'...
CVE-2026-102376
Subscriber Cross Site Scripting XSS in Branda = 3.4.32 versions...
CVE-2026-102375 WordPress Optimole plugin <= 4.2.14 - Broken Access Control vulnerability
Subscriber Broken Access Control in Optimole = 4.2.14 versions...
CVE-2026-102375 WordPress Optimole plugin <= 4.2.14 - Broken Access Control vulnerability
Subscriber Broken Access Control in Optimole = 4.2.14 versions...
CVE-2025-14172-Nuclei-Template
📄 Nuclei Template for CVE-2025-14172 🚀 Overview This repository features a Nuclei template specifically designed to detect a Missing Authorization Vulnerability CVE-2025-14172 in the WP Page Permalink Extension WordPress plugin. This issue allows authenticated attackers to remotely flush the site...
CVE-2026-97270
Subscriber Cross Site Scripting XSS in CMB2 = 2.13.0 versions...
CVE-2026-97243
Subscriber Broken Access Control in AllAble Connector = 0.13.4 versions...
CVE-2026-97079
Subscriber Insecure Direct Object References IDOR in Webba Booking = 6.5.0 versions...
CVE-2026-96825
Subscriber Bypass Vulnerability in All In One WP Security & Firewall = 5.4.8 versions...
CVE-2026-96819
Subscriber Cross Site Scripting XSS in oik = 4.15.4 versions...
CVE-2026-96338
Subscriber Cross Site Scripting XSS in Profile Builder = 4.0.2 versions...