58865 matches found
CVE-2026-73378
An unauthenticated Cross-Site Scripting (XSS) vulnerability exists in the WordPress "Contact Form by Supsystic" plugin versions below 1.10.0, allowing remote attackers to inject malicious scripts that execute in users' browsers. CVSS 3.1 scores it HIGH (7.1). Upgrade to version 1.10.0 or later. N...
CVE-2026-73377
The Ultimate Maps by Supsystic WordPress plugin (versions below 1.5.0) has an unauthenticated broken access control flaw allowing remote attackers to perform unauthorized actions with high integrity impact; no exploitation is reported in the provided documents.
CVE-2026-73377 WordPress Ultimate Maps by Supsystic plugin < 1.5.0 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Ultimate Maps by Supsystic 1.5.0 versions...
EUVD-2026-60791
Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic 1.5.0 versions...
CVE-2026-73367 WordPress Easy Google Maps plugin < 1.14.2 - Remote File Inclusion vulnerability
Unauthenticated Remote File Inclusion in Easy Google Maps 1.14.2 versions...
CVE-2026-73366
Unauthenticated PHP Object Injection in Easy Google Maps = 1.13.0 versions...
CVE-2026-73366 WordPress Easy Google Maps plugin <= 1.13.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Easy Google Maps = 1.13.0 versions...
CVE-2026-73366
The WordPress Easy Google Maps plugin (≤1.13.0) has an unauthenticated PHP Object Injection vulnerability, exploitable remotely without credentials, scoring CVSS 9.8 (Critical). No in-the-wild exploitation or patch details are provided in the documents.
CVE-2026-73365
Unauthenticated SQL Injection in JetAppointment = 2.5.2 versions...
CVE-2026-73365 WordPress JetAppointment plugin <= 2.5.2 - SQL Injection vulnerability
Unauthenticated SQL Injection in JetAppointment = 2.5.2 versions...
CVE-2026-73360 WordPress Chaty Pro plugin <= 3.5.8 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Chaty Pro = 3.5.8 versions...
EUVD-2026-60776
Unauthenticated Broken Access Control in GiveWP 4.16.6 versions...
EUVD-2026-60775
Customer SQL Injection in License Manager for WooCommerce = 3.0.18 versions...
CVE-2026-73342
Unauthenticated Cross Site Scripting XSS in WP Multilang = 2.4.31 versions...
CVE-2026-73339 WordPress Modern Events Calendar plugin < 7.35.0 - SQL Injection vulnerability
Unauthenticated SQL Injection in Modern Events Calendar 7.35.0 versions...
CVE-2026-73189
Subscriber Insecure Direct Object References IDOR in WP Crowdfunding 2.2.1 versions...
EUVD-2026-60939
Subscriber Insecure Direct Object References IDOR in WP Crowdfunding 2.2.1 versions...
CVE-2026-73187
The WordPress Sticky Chat Widget plugin (versions ≤ 1.4.2) contains an unauthenticated SQL Injection vulnerability, discovered by Nguyen Ba Khanh of HPT Vietnam Corporation. CVSS 3.1 scores it 9.3 (Critical) for network-exploitable high confidentiality impact. CISA SSVC rates it automatable with ...