140485 matches found
CVE-2026-28166 WordPress Tourmaster plugin <= 5.4.9 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Tourmaster = 5.4.9 versions...
CVE-2026-28165 WordPress Digits plugin <= 9.2 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Digits = 9.2 versions...
EUVD-2026-64793
Unauthenticated Cross Site Scripting XSS in Events Made Easy = 3.2.5 versions...
CVE-2026-28162 WordPress Events Made Easy plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Events Made Easy = 3.2.5 versions...
CVE-2026-28162
CVE-2026-28162 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Events Made Easy (versions ≤ 3.2.5 ). The vulnerability allows a remote unauthenticated attacker to inject and execute arbitrary script in another user's browser, with a CVSS 3.1 base score of 7....
CVE-2026-28153 WordPress Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More plugin <= 1.7.1 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Notification Master Real-Time WordPress Notifications With Email, SMS, Webhooks & More = 1.7.1 versions...
CVE-2026-28153
Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More plugin (versions
EUVD-2026-64792
Unauthenticated Broken Access Control in Notification Master Real-Time WordPress Notifications With Email, SMS, Webhooks & More = 1.7.1 versions...
CVE-2026-28151
Unauthenticated Local File Inclusion in the WordPress Theme Tonda (versions
CVE-2026-28152 WordPress Tonda Core plugin < 2.6 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Tonda Core 2.6 versions...
CVE-2026-28152
CVE-2026-28152 is an unauthenticated Local File Inclusion (LFI) vulnerability in the WordPress plugin Tonda Core , affecting versions below 2.6 . Discovered by Tran Nguyen Bao Khanh (VCI – VNPT Cyber Immunity), the flaw allows an unauthenticated remote attacker to include local files, resulting i...
EUVD-2026-64790
Unauthenticated Local File Inclusion in Tonda 2.6 versions...
EUVD-2026-64791
Unauthenticated Local File Inclusion in Tonda Core 2.6 versions...
CVE-2026-28151 WordPress Tonda theme < 2.6 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Tonda 2.6 versions...
CVE-2026-66671 WordPress Verdure Core plugin <= 1.2 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Verdure Core = 1.2 versions...
CVE-2026-66671
An unauthenticated Local File Inclusion (LFI) vulnerability affects the WordPress plugin Verdure Core in versions
EUVD-2026-64789
Unauthenticated Local File Inclusion in Verdure Core = 1.2 versions...
EUVD-2026-64787
Unauthenticated Cross Site Request Forgery CSRF in Hash Form = 1.4.0 versions...
CVE-2026-78280
CVE-2026-78280 is an unauthenticated Cross-Site Request Forgery (CSRF) vulnerability in the WordPress Hash Form plugin , affecting versions 1.4.0 and earlier . The flaw was discovered by sanghyeok Kim and reported via Patchstack. Per the CVSS 3.1 vector, an attacker with network access and low co...