12282 matches found
CVE-2026-28111 WordPress Forminator plugin <= 1.56.0 - Privilege Escalation vulnerability
Contributor Privilege Escalation in Forminator = 1.56.0 versions...
EUVD-2026-53940
Unauthenticated Cross Site Scripting XSS in JetEngine = 3.8.13.1 versions...
EUVD-2026-53939
Unauthenticated Privilege Escalation in Kadence WooCommerce Email Designer = 1.5.19 versions...
EUVD-2026-53938
Unauthenticated Broken Access Control in Ultimate Store Kit Elementor Addons = 3.0.5 versions...
EUVD-2026-53937
Unauthenticated Broken Access Control in Simple Membership = 4.7.8 versions...
WordPress GeekyBot plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh in WordPress Plugin GeekyBot versions = 1.2.6...
WordPress Agricola theme <= 1.21.0 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Bonds in WordPress Theme Agricola versions = 1.21.0...
WordPress Abelle theme <= 1.22 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by johska in WordPress Theme Abelle versions = 1.22...
CVE-2025-15028
The FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission fields in all versions up to, and including, 1.9.2 due to insufficient input sanitization and output escaping. This...
CVE-2025-9266
CVE-2025-9266 affects the WordPress Accelerate theme up to version 1.5.3. The root cause is a missing capability check in enqueue_scripts(), enabling authenticated users with Subscriber-level access and above to install and activate the ThemeGrill Demo Importer plugin. The impact is unauthorized ...
WordPress Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin <= 1.56.1 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by daroo in WordPress Plugin Forminator versions = 1.56.1...
WordPress Featured Video Plus plugin <= 2.3.3 - Sensitive Data Exposure vulnerability
Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Featured Video Plus versions = 2.3.3...
CVE-2024-10302
The CVE affects the user self-signup flow in multiple WSO2 products, where inadequate validation lets unvalidated input enter user claims. This can lead to downstream processing of malicious or malformed data, with potential content manipulation, redirection, UI inconsistencies, unauthorized acti...
EUVD-2024-55708
The user self-signup flow in multiple WSO2 products fails to adequately validate user-supplied input. This weakness allows arbitrary unvalidated data to be included within user claims, which are then used by downstream processes. Allowing unvalidated input into user claims can lead to various...
WordPress Lenxel WP theme <= 1.0.31 - Unauthenticated Account Takeover vulnerability
Unauthenticated Account Takeover vulnerability discovered by moonge in WordPress Theme Lenxel WP versions = 1.0.31...
CVE-2026-19007 mf-yang openclaw-cn reply-elevated.ts isApprovedElevatedSender privileges management
A vulnerability was determined in mf-yang openclaw-cn up to 0.2.1. This vulnerability affects the function isApprovedElevatedSender of the file src/auto-reply/reply/reply-elevated.ts. This manipulation causes improper privilege management. It is possible to initiate the attack remotely. The explo...
CVE-2026-18510 TranslatePress <= 3.2.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content URL-encoded gettext markers in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping. This make...
CVE-2026-18998
A vulnerability was determined in cosmicstack-labs mercury-agent up to 1.1.12. Impacted is the function SubAgent.run of the file src/core/sub-agent.ts of the component delegatetask Tool. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The...
CVE-2026-18997 cosmicstack-labs mercury-agent bg agent.ts Agent.handleBgCommand authorization
A vulnerability was found in cosmicstack-labs mercury-agent up to 1.1.12. This issue affects the function Agent.handleBgCommand of the file src/core/agent.ts of the component bg Command Handler. Performing a manipulation results in incorrect authorization. It is possible to initiate the attack...