14657 matches found
CVE-2026-12738: Missing Authorization
The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
PT-2026-57400
The Affilia – Affiliate Program & Referral Tracking for WordPress plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 3.3.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
PT-2026-57372
The UnderConstructionPage PRO plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.76. This is due to the plugin accepting arbitrary local file paths in the template thumbnail parameter and copying their contents into a publicly accessible uploads file...
CVE-2026-13353: Improper Control of Generation of Code
The WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.0.1 via the 'MappedFields' parameter. This is due to missing capability checks on the AJAX handlers for installaddon,...
CVE-2026-15010: Improper Neutralization of Input During Web Page Generation
The bbp Style Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 6.4.5 via the Topic Form Additional Fields feature. This is due to insufficient input sanitization in bsptopicfieldsformsave which writes $POST'bsptopicfieldslabeln' directly to...
WordPress WP Easy Pay – Payment and Donation form Builder for Square plugin <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Status Modification vulnerability
Missing Authorization to Authenticated Subscriber+ Arbitrary Post Status Modification vulnerability discovered by PRISM in WordPress Plugin WP EasyPay versions = 4.5.0...
WordPress Agentic Help Desk plugin for WordPress – Live Chat, AI Chatbot & Ticketing – ThriveDesk plugin <= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Cache Deletion vulnerability
Missing Authorization to Authenticated Subscriber+ Cache Deletion vulnerability discovered by Legion Hunter in WordPress Plugin ThriveDesk versions = 2.1.7...
WordPress Affiliate Program & Referral Tracking for WooCommerce & WordPress – Affilia plugin <= 3.3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Status Modification vulnerability
Missing Authorization to Authenticated Subscriber+ Arbitrary Status Modification vulnerability discovered by loris4py in WordPress Plugin Affiliate Program & Referral Tracking for WooCommerce & WordPress – Affilia versions = 3.3.3...
WordPress Notification for Telegram plugin <= 3.5.1 - Missing Authorization to Authenticated (Subscriber+) Cron Modification vulnerability
Missing Authorization to Authenticated Subscriber+ Cron Modification vulnerability discovered by Pattama Tangpoonponwiwat Kwan in WordPress Plugin Notification for Telegram versions = 3.5.1...
WordPress Points and Rewards for WooCommerce plugin <= 2.10.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification vulnerability
Missing Authorization to Authenticated Subscriber+ Arbitrary Modification vulnerability discovered by Latz in WordPress Plugin Points and Rewards for WooCommerce versions = 2.10.1...
CVE-2026-9857
The CVE concerns the WordPress Invoice123 plugin (versions
CVE-2026-9857 Invoice123 <= 1.7.0 - Missing Authorization to Authenticated (Subscriber+) Setting Modification via s123_submit_api_key & s123_submit_invoice_settings AJAX actions
The Invoice123 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access...
CVE-2026-9857 Invoice123 <= 1.7.0 - Missing Authorization to Authenticated (Subscriber+) Setting Modification via s123_submit_api_key & s123_submit_invoice_settings AJAX actions
The Invoice123 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access...
CVE-2026-9857
The Invoice123 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access...
CVE-2026-1946
The GW AI Website Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the gwaiwebugravitywritedisconnecthandler function in all versions up to, and including, 1.0.1. This makes it possible for authenticated attackers, with...
CVE-2026-15026
The Import and export users and customers plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.0 via the emailtemplateselected. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the...
CVE-2026-12955
The GDPR Cookie Consent plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the gdprcookieconsentajaxsaveschedulescan function the wpajaxgccsaveschedulescan AJAX action in versions up to, and including, 4.3.6...
CVE-2026-15026 Import and export users and customers <= 2.4.0 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via email_template_selected AJAX Action
The Import and export users and customers plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.0 via the emailtemplateselected. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the...
EUVD-2026-42851
The Import and export users and customers plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.0 via the emailtemplateselected. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the...