2375 matches found
CVE-2026-18109: Improper Neutralization of Input During Web Page Generation
The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 2.10.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...
CVE-2026-16253
The Total Upkeep WordPress plugin before 1.17.3 does not adequately protect the secret that authorizes its backup-restore functionality and exposes it to unauthenticated users, allowing them to disclose sensitive backup information and to force a full site restore that overwrites the live site's...
EUVD-2026-57087
The Total Upkeep WordPress plugin before 1.17.3 does not adequately protect the secret that authorizes its backup-restore functionality and exposes it to unauthenticated users, allowing them to disclose sensitive backup information and to force a full site restore that overwrites the live site's...
CVE-2026-16253
The Total Upkeep WordPress plugin (versions prior to 1.17.3 ) contains a vulnerability where the secret authorizing its backup-restore functionality is inadequately protected and exposed to unauthenticated users . This issue is a regression of CVE-2020-36848 , where previous protections failed to...
CVE-2026-16253
The Total Upkeep WordPress plugin before 1.17.3 does not adequately protect the secret that authorizes its backup-restore functionality and exposes it to unauthenticated users, allowing them to disclose sensitive backup information and to force a full site restore that overwrites the live site's...
CVE-2026-16253 Total Upkeep < 1.17.3 - Unauthenticated Sensitive Data Disclosure and Forced Site Restore via Predictable cron_secret
The Total Upkeep WordPress plugin before 1.17.3 does not adequately protect the secret that authorizes its backup-restore functionality and exposes it to unauthenticated users, allowing them to disclose sensitive backup information and to force a full site restore that overwrites the live site's...
CVE-2026-16253 Total Upkeep < 1.17.3 - Unauthenticated Sensitive Data Disclosure and Forced Site Restore via Predictable cron_secret
The Total Upkeep WordPress plugin before 1.17.3 does not adequately protect the secret that authorizes its backup-restore functionality and exposes it to unauthenticated users, allowing them to disclose sensitive backup information and to force a full site restore that overwrites the live site's...
PT-2026-71012
Name of the Vulnerable Software and Affected Versions Total Upkeep WordPress plugin versions prior to 1.17.3 Description An issue exists where the secret used to authorize backup-restore functionality is not adequately protected and is exposed to unauthenticated users. This allows an attacker to...
CVE-2026-16253: Exposure of Sensitive Information to an Unauthorized Actor
The Total Upkeep WordPress plugin before 1.17.3 does not adequately protect the secret that authorizes its backup-restore functionality and exposes it to unauthenticated users, allowing them to disclose sensitive backup information and to force a full site restore that overwrites the live site's...
CVE-2026-68257
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix 32-bit overflow in CWSR total size calculation totalcwsrsize was computed in 32-bit before being used as a BO/SVM allocation size. With large ctxsaverestoreareasize and debugmemorysize multiplied by the XCC count,...
EUVD-2026-55388
In the Linux kernel, the following vulnerability has been resolved: dropmonitor: fix size calculations for 64-bit attributes netdmpacketreportfill and netdmhwpacketreportfill use nlaputu6464bit to append 64-bit attributes NETDMATTRPC and NETDMATTRTIMESTAMP. On 32-bit architectures without...
CVE-2026-68257
The CVE-2026-68257 vulnerability affects the Linux kernel drm/amdkfd component where a 32-bit overflow in the CWSR total size calculation could yield an undersized BO/SVM allocation. The root cause is that total_cwsr_size was computed in 32-bit before being used, and large ctx_save_restore_area_s...
CVE-2026-17016
The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not validate the amount actually paid against the order total in its PayPal Data Transfer return handler, allowing a customer to pay less than the order total and still have the order marked as fully...
CVE-2026-17021
The Salon Booking System WordPress plugin (Free Version) before version 10.30.34 is vulnerable to an unauthenticated arbitrary booking total tampering vulnerability. This security flaw exists because the plugin does not properly restrict access to certain booking-modification AJAX actions and fai...
CVE-2026-17021 Salon Booking System – Free Version < 10.30.34 - Unauthenticated Arbitrary Booking Total Tampering
The Salon Booking System WordPress plugin before 10.30.34 does not properly restrict access to some of its booking-modification AJAX actions and does not verify ownership of the targeted booking, allowing unauthenticated users to tamper with the stored total of arbitrary bookings...
EUVD-2026-55027
The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not validate the amount actually paid against the order total in its PayPal Data Transfer return handler, allowing a customer to pay less than the order total and still have the order marked as fully...
CVE-2026-17016
The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not validate the amount actually paid against the order total in its PayPal Data Transfer return handler, allowing a customer to pay less than the order total and still have the order marked as fully...
CVE-2026-17016
The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin, versions through 3.1.0 , contains a vulnerability in its PayPal Data Transfer return handler. The component fails to validate whether the amount actually paid matches the order total. This allows a customer to pay les...
CVE-2026-15152 WP Hotel Booking < 2.3.2 - Unauthenticated PayPal Payment Bypass
The WP Hotel Booking WordPress plugin before 2.3.2 does not verify that a payment notification corresponds to a payment made to the site's own merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to have their bookings marked as fully paid without a...