59841 matches found
CVE-2026-12124
The PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the serveTemplatePdfAjax function and the serveTemplatePdf REST route which is registered...
CVE-2026-14490
The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 0.0.7. The vulnerability exists because the plugin stores its HMAC signing key and per-step restore token as dotfiles inside a...
CVE-2026-15014 SMS Alert <= 3.9.7 - Unauthenticated Authentication Bypass to Account Takeover via 'billing_phone' Parameter
The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 3.9.7 via the billingphone parameter. This is due to the processRegistration...
CVE-2026-14924
CVE-2026-14924 affects the Tablesome Table WordPress plugin prior to version 1.1.31. The issue arises because one AJAX action does not perform authentication, capability, or nonce checks, allowing unauthenticated users to create new published posts and overwrite arbitrary existing posts and pages...
CVE-2026-14924
The Tablesome Table WordPress plugin before 1.1.31 does not perform any authentication, capability, or nonce checks in one of its AJAX actions, allowing unauthenticated users to create new published posts and to overwrite arbitrary existing posts and pages...
CVE-2026-14545
The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to set an arbitrary password on any account, including an administrator, and take over the site...
CVE-2026-15012 Demi <= 0.0.8 - Unauthenticated Information Exposure to Arbitrary Directory Copy
The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Copy in all versions up to, and including, 0.0.8 via the handlerestorestep function. This is due to missing HTTP access controls on the wp-content/uploads/demi-backup-state/...
CVE-2026-15012
The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Copy in all versions up to, and including, 0.0.8 via the handlerestorestep function. This is due to missing HTTP access controls on the wp-content/uploads/demi-backup-state/...
CVE-2026-15012 Demi <= 0.0.8 - Unauthenticated Information Exposure to Arbitrary Directory Copy
The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Copy in all versions up to, and including, 0.0.8 via the handlerestorestep function. This is due to missing HTTP access controls on the wp-content/uploads/demi-backup-state/...
CVE-2026-14490
The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 0.0.7. The vulnerability exists because the plugin stores its HMAC signing key and per-step restore token as dotfiles inside a...
CVE-2026-14490 Demi <= 0.0.6 - Unauthenticated Arbitrary Directory Deletion via demi_restore_step AJAX action
The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 0.0.7. The vulnerability exists because the plugin stores its HMAC signing key and per-step restore token as dotfiles inside a...
CVE-2026-14490
The CVE concerns the Demi – One Click Demo Import, WP Backup & Site Migration WordPress plugin. All versions up to 0.0.7 are affected due to the plugin storing its HMAC signing key and per-step restore token as dotfiles inside a publicly accessible uploads subdirectory without protection. The una...
EUVD-2026-49692
The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 0.0.7. The vulnerability exists because the plugin stores its HMAC signing key and per-step restore token as dotfiles inside a...
CVE-2026-15012
The CVE concerns the WordPress plugin Demi – One Click Demo Import, WP Backup & Site Migration . It is affected through an Arbitrary Directory Copy vulnerability in all versions up to and including 0.0.8, exploitable via the handle_restore_step function. The flaw arises from missing HTTP access c...
CVE-2026-12124 PDFDraft <= 1.1.0 - Missing Authorization to Unauthenticated Sensitive PDF Disclosure via 'slug' Parameter
The PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the serveTemplatePdfAjax function and the serveTemplatePdf REST route which is registered...
CVE-2026-12124
CVE-2026-12124 affects the PDFDraft WordPress plugin (versions up to and including 1.1.0). The issue is a missing capability check on serveTemplatePdfAjax() and a REST route registered with permission_callback => '__return_true' on /wp-json/pdfdraft/v1/embed-pdf/templates/{slug}/pdf, allowing ...
CVE-2026-12124 PDFDraft <= 1.1.0 - Missing Authorization to Unauthenticated Sensitive PDF Disclosure via 'slug' Parameter
The PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the serveTemplatePdfAjax function and the serveTemplatePdf REST route which is registered...
EUVD-2026-49657
Unauthenticated Cross Site Scripting XSS in Kali Forms = 2.4.18 versions...
EUVD-2026-49668
Unauthenticated Broken Access Control in Xendit Payment = 7.1.0 versions...
PT-2026-65388
The PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the serveTemplatePdfAjax function and the serveTemplatePdf REST route which is registered...