14352 matches found
CVE-2026-33607: Uncontrolled Resource Consumption
An attacker that has valid credentials can use IMAP LIST command to consume CPU. This can cause degradation or denial of service for IMAP. Monitor system for abnormal CPU usage and kill the offending process and lock account. Alternatively install fixed version. No publicly available exploits are...
CVE-2026-6128: Improper Neutralization of Input During Web Page Generation
The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ai1wmbackupspath' parameter in all versions up to, and including, 2.84. This is due to insufficient input sanitization and output escaping on user-supplied attributes combine...
CVE-2026-81761: Missing Authorization
Subscriber Broken Access Control in WpEvently = 5.5.0 versions...
CVE-2026-79995: Authorization Bypass Through User-Controlled Key
The User Registration & Membership WordPress plugin before 5.2.5 does not verify that the account whose pending email change is being cancelled belongs to the user making the request, allowing authenticated users with Subscriber-level access and above to cancel any other user's in-progress email...
PT-2026-83152
Subscriber Broken Access Control in WpEvently = 5.5.0 versions...
CVE-2026-18983: Unrestricted Upload of File with Dangerous Type
The One User Avatar | User Profile Picture plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.5.4 via the wpuaactionprocessoptionupdate function. This is due to insufficient file type validation in wphandleupload called without a MIME...
PT-2026-83147
Subscriber Insecure Direct Object References IDOR in WP Job Portal = 2.5.9 versions...
WordPress AI Engine plugin 3.3.3-3.7.2 - 3.7.1 - Subscriber+ Arbitrary File Read vulnerability
WordPress AI Engine plugin 3.3.3-3.7.2 - 3.7.1 - Subscriber+ Arbitrary File Read vulnerability discovered by Jashid Sany in WordPress Plugin AI Engine versions 3.3.3-3.7.1...
WordPress Workeera plugin < 1.0.6 - Subscriber+ Arbitrary File Read vulnerability
Subscriber+ Arbitrary File Read vulnerability discovered by Artus KG and Shhriyash in WordPress Plugin Workeera versions 1.0.6...
WordPress Workeera plugin < 1.0.6 - Subscriber+ Arbitrary File Deletion vulnerability
Subscriber+ Arbitrary File Deletion vulnerability discovered by Artus KG and Shhriyash in WordPress Plugin Workeera versions 1.0.6...
WordPress Workeera plugin < 1.0.6 - Subscriber+ Arbitrary File Upload vulnerability
Subscriber+ Arbitrary File Upload vulnerability discovered by Erwan LR WPScan in WordPress Plugin Workeera versions 1.0.6...
WordPress All-in-One Video Gallery plugin < 4.9.2 - Subscriber+ Server-Side Request Forgery via 'vdl' Parameter vulnerability
Subscriber+ Server-Side Request Forgery via 'vdl' Parameter vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin All-in-One Video Gallery versions 4.9.2...
WordPress Block User Account plugin < 2.0.1 - Subscriber+ Account Block Bypass via Application Passwords vulnerability
Subscriber+ Account Block Bypass via Application Passwords vulnerability discovered by Farid Narimanov in WordPress Plugin Block User Account versions 2.0.1...
WordPress Salon booking system plugin <= 10.31.1 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Salon booking system versions = 10.31.1...
WordPress Bit File Manager plugin < 6.9.1 - Subscriber+ Sensitive Data Disclosure via bitapps_fm_connector vulnerability
Subscriber+ Sensitive Data Disclosure via bitappsfmconnector vulnerability discovered by JING QIAN in WordPress Plugin Bit File Manager versions 6.9.1...
WordPress MLS Import plugin < 7.0.4 - Subscriber+ Sensitive Information Disclosure via mlsimport_logger_per_item vulnerability
Subscriber+ Sensitive Information Disclosure via mlsimportloggerperitem vulnerability discovered by Shikhali Jamalzade in WordPress Plugin MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings versions 7.0.4...
CVE-2026-81274
Subscriber Broken Access Control in Ditty = 3.1.67 versions...
CVE-2026-81279
Subscriber Broken Access Control in Push Notification for Post and BuddyPress = 3.20 versions...