140499 matches found
CVE-2026-28152 WordPress Tonda Core plugin < 2.6 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Tonda Core 2.6 versions...
CVE-2026-28152
CVE-2026-28152 is an unauthenticated Local File Inclusion (LFI) vulnerability in the WordPress plugin Tonda Core , affecting versions below 2.6 . Discovered by Tran Nguyen Bao Khanh (VCI – VNPT Cyber Immunity), the flaw allows an unauthenticated remote attacker to include local files, resulting i...
EUVD-2026-64790
Unauthenticated Local File Inclusion in Tonda 2.6 versions...
EUVD-2026-64791
Unauthenticated Local File Inclusion in Tonda Core 2.6 versions...
CVE-2026-28151 WordPress Tonda theme < 2.6 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Tonda 2.6 versions...
CVE-2026-66671 WordPress Verdure Core plugin <= 1.2 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Verdure Core = 1.2 versions...
CVE-2026-66671
An unauthenticated Local File Inclusion (LFI) vulnerability affects the WordPress plugin Verdure Core in versions
EUVD-2026-64789
Unauthenticated Local File Inclusion in Verdure Core = 1.2 versions...
EUVD-2026-64787
Unauthenticated Cross Site Request Forgery CSRF in Hash Form = 1.4.0 versions...
CVE-2026-78280
CVE-2026-78280 is an unauthenticated Cross-Site Request Forgery (CSRF) vulnerability in the WordPress Hash Form plugin , affecting versions 1.4.0 and earlier . The flaw was discovered by sanghyeok Kim and reported via Patchstack. Per the CVSS 3.1 vector, an attacker with network access and low co...
CVE-2026-78280 WordPress Hash Form plugin <= 1.4.0 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery CSRF in Hash Form = 1.4.0 versions...
CVE-2026-78279 WordPress Fluent Support Pro plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery CSRF in Fluent Support Pro = 2.3.1 versions...
EUVD-2026-64786
Unauthenticated Cross Site Request Forgery CSRF in Fluent Support Pro = 2.3.1 versions...
CVE-2026-78279
CVE-2026-78279 is an unauthenticated Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Fluent Support Pro , affecting versions ≤ 2.3.1 . The vulnerability was discovered by Ananda Dhakal (Patchstack). A CVSS 3.1 score of 5.4 (Medium) is assigned, with a network vector, low a...
EUVD-2026-64833
Unauthenticated Broken Access Control in Booking and Rental Manager = 2.7.5 versions...
CVE-2026-78258 WordPress Booking and Rental Manager plugin <= 2.7.5 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Booking and Rental Manager = 2.7.5 versions...
CVE-2026-78258
CVE-2026-78258 is an unauthenticated Broken Access Control vulnerability in the Booking and Rental Manager WordPress plugin (for WooCommerce), affecting versions 2.7.5 and earlier . The flaw allows remote attackers to access data without proper authorization, resulting in a low confidentiality im...
CVE-2026-66623 WordPress Social Media & Share Icons plugin <= 2.9.9 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Social Media & Share Icons = 2.9.9 versions...
CVE-2026-66623
CVE-2026-66623 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Social Media & Share Icons (also known as Ultimate Social Media Icons), affecting versions 2.9.9 and below . The vulnerability was discovered by Bonds and carries a CVSS 3.1 score of 7.1 (HIGH) ,...