63702 matches found
CVE-2026-57370 WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.9.1 - Reflected Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Visitor Traffic Real Time Statistics Pro = 11.9.1 versions...
CVE-2026-27422
The CVE-2026-27422 entry concerns the WordPress YT Player plugin (versions
EUVD-2026-48159
Unauthenticated Broken Access Control in WP Fast Total Search = 1.81.282 versions...
EUVD-2026-48157
Unauthenticated Broken Access Control in MarketKing = 2.1.40 versions...
CVE-2026-27399
CVE-2026-27399 concerns the WordPress MarketKing plugin, versions ≤ 2.1.40. The connected documents describe an Unauthenticated Broken Access Control vulnerability in MarketKing, meaning an unauthenticated attacker can bypass access controls. The exact impact details (which data or actions are ex...
CVE-2026-27399 WordPress MarketKing plugin <= 2.1.40 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in MarketKing = 2.1.40 versions...
EUVD-2026-48152
Unauthenticated Broken Access Control in Ditty = 3.1.66 versions...
CVE-2026-27372 WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in PeproDev Ultimate Invoice = 2.2.6 versions...
CVE-2026-27372
The CVE concerns WordPress plugin PeproDev Ultimate Invoice (admin URL not needed) for affected versions
CVE-2026-27355
CVE-2026-27355 affects WordPress Ditty plugin versions
EUVD-2026-48150
Unauthenticated Broken Access Control in WP Go Maps = 10.1.04 versions...
CVE-2026-24537
CVE-2026-24537 — Unauthenticated Cross Site Request Forgery (CSRF) in the WordPress plugin WP Accessibility Helper (WAH) , versions
Exploit for Eval Injection in Langflow
CVE-2026-33017 — Langflow Unauthenticated Remote Code Executio...
CVE-2026-65758
Joomla Extension - tassos.gr - Sensitive data exposure in Convert Forms extension 2.5.0-5.2.2 - The front-end Submissions view did not enforce access control. An unauthenticated visitor could therefore list a form's submissions...
CVE-2026-15017
The MDJM Event Management plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8.4. This is due to missing capability checks and nonce verification in the MDJMPermissions::setpermissions and MDJMEmployeeManager::init functions, combined with the...
CVE-2026-15015
The MountDev AI MCP Connector for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.6.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers...
CVE-2026-15348
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 7.0.4 via the wpdmppdl parameter. This is due to the download function — hooked to the unauthenticated WordPress wp action — decoding the...
CVE-2026-15011
The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable to Code Injection via the 'path' parameter in all versions up to, and including, 6.0.5 due to the use of dynamic function invocation on an attacker-controlled value with insufficient validation. This makes it possibl...
CVE-2026-14282
The GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more plugin for WordPress is vulnerable to arbitrary file uploads in versions up to, and including, 1.12.2. This is due to insufficient file type validation in the savevideofile function hooked...