151173 matches found
CVE-2026-81571
The Brave WordPress plugin versions prior to 0.8.8 fail to sanitize a URL parameter (UTM) used to pre-fill a form field before passing it to WordPress's shortcode engine . This allows unauthenticated attackers to trigger execution of any shortcode registered on the target site, resulting in serve...
CVE-2026-78153 Restrict User Access 2.6 - 2.8 - Unauthenticated Content Protection Bypass via REST API Route Normalization
The Restrict User Access WordPress plugin before 2.8.1 does not normalise the REST API route before checking it against the routes its content protection covers, allowing unauthenticated users to bypass that protection and read restricted content and enumerate users...
CVE-2026-78153
The Restrict User Access WordPress plugin versions before 2.8.1 fail to normalise the REST API route before comparing it against protected routes. This route normalization flaw allows unauthenticated attackers to bypass content protection, read restricted content, and enumerate users via the REST...
EUVD-2026-70042
The Restrict User Access WordPress plugin before 2.8.1 does not normalise the REST API route before checking it against the routes its content protection covers, allowing unauthenticated users to bypass that protection and read restricted content and enumerate users...
CVE-2026-77794 RegistrationMagic 6.0.0.0 - 6.0.9.8 - Unauthenticated Payment Bypass via Zero Quantity
The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate a client-supplied quantity multiplier when calculating the total price of a paid registration, allowing unauthenticated users to register without paying and obtain an activated account holding the role the form grants...
CVE-2026-77794 RegistrationMagic 6.0.0.0 - 6.0.9.8 - Unauthenticated Payment Bypass via Zero Quantity
The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate a client-supplied quantity multiplier when calculating the total price of a paid registration, allowing unauthenticated users to register without paying and obtain an activated account holding the role the form grants...
EUVD-2026-70041
The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate a client-supplied quantity multiplier when calculating the total price of a paid registration, allowing unauthenticated users to register without paying and obtain an activated account holding the role the form grants...
CVE-2026-77794
RegistrationMagic (WordPress plugin, versions 6.0.0.0–6.0.9.8) fails to validate a client-supplied quantity multiplier when calculating the total price of a paid registration. An unauthenticated attacker can supply a zero quantity to make the computed price zero, bypassing payment entirely and ob...
CVE-2026-77793 RegistrationMagic < 6.0.9.9 - Unauthenticated Payment Bypass via Omitted Price Field
The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate the total price of a paid registration server-side, allowing unauthenticated users to complete a paid registration without paying and obtain an activated account...
EUVD-2026-70040
The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate the total price of a paid registration server-side, allowing unauthenticated users to complete a paid registration without paying and obtain an activated account...
CVE-2026-77793 RegistrationMagic < 6.0.9.9 - Unauthenticated Payment Bypass via Omitted Price Field
The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate the total price of a paid registration server-side, allowing unauthenticated users to complete a paid registration without paying and obtain an activated account...
CVE-2026-77793
RegistrationMagic is a WordPress plugin that manages event registrations. Versions prior to 6.0.9.9 fail to validate the total price of a paid registration server-side; an attacker can simply omit the price field in the request to complete a paid registration without paying, obtaining an activate...
CVE-2026-4357 Embed HTML5 Game <= 1.3 - Unauthenticated Arbitrary File Upload
The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who can upload files via the plugin, as well as what can be uploaded, making it possible for unauthenticated attackers to upload PHP backdoors on affected sites...
EUVD-2026-70038
The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who can upload files via the plugin, as well as what can be uploaded, making it possible for unauthenticated attackers to upload PHP backdoors on affected sites...
CVE-2026-4357
The Embed HTML5 Game WordPress plugin (through version 1.3 ) fails to properly restrict both who can upload files and what file types are permitted via the plugin. This allows unauthenticated attackers to upload PHP backdoors on affected sites, potentially leading to full compromise. The vulnerab...
CVE-2026-4357 Embed HTML5 Game <= 1.3 - Unauthenticated Arbitrary File Upload
The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who can upload files via the plugin, as well as what can be uploaded, making it possible for unauthenticated attackers to upload PHP backdoors on affected sites...
CVE-2026-2688 CM HIPAA Forms < 3.2.0 - Unauthenticated Authorization Bypass
The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authentication bypass via a hardcoded parameter alongside all AJAX requests. The server explicitly checks for this value to skip nonce validation entirely. This allows unauthenticated attackers to access protected AJAX endpoints...
EUVD-2026-70037
The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authentication bypass via a hardcoded parameter alongside all AJAX requests. The server explicitly checks for this value to skip nonce validation entirely. This allows unauthenticated attackers to access protected AJAX endpoints...
CVE-2026-17563
User Frontend WordPress plugin (versions before 4.3.11 ) enforces its subscription-purchase requirement only when rendering a frontend form, not when processing the actual post submission. This allows unauthenticated users to create—and, depending on form configuration, immediately publish —posts...
CVE-2026-17563 WP User Frontend < 4.3.11 - Unauthenticated Post Creation via Subscription-Gated Form
The User Frontend WordPress plugin before 4.3.11 does not enforce its subscription-purchase requirement when processing frontend post submissions, only when rendering the form, allowing unauthenticated users to create and, depending on the form's configuration, immediately publish posts through...