11723 matches found
CVE-2026-16811 ShopLentor <= 3.4.5 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient...
EUVD-2026-49658
Unauthenticated Broken Access Control in Ad Invalid Click Protector AICP = 1.3.0 versions...
CVE-2026-65441
Unauthenticated Cross Site Scripting XSS in GiveWP = 4.16.3 versions...
CVE-2026-65445
Unauthenticated Broken Access Control in Ad Invalid Click Protector AICP = 1.3.0 versions...
CVE-2026-65448
Unauthenticated Cross Site Scripting XSS in Anti Spam and list cleaner AcyChecker = 1.8.1 versions...
CVE-2026-65448
Unauthenticated Cross Site Scripting XSS in Anti Spam and list cleaner - AcyChecker = 1.8.1 versions...
CVE-2026-66473
The vulnerability CVE-2026-66473 affects the WordPress Xendit Payment plugin, versions up to and including 7.1.0. It is described as Unauthenticated Broken Access Control, indicating that unauthenticated users may access restricted functionality or data within the plugin. The available sources id...
CVE-2026-66474
Unauthenticated Cross Site Request Forgery CSRF in Insert Headers and Footers Code – HT Script = 1.1.8 versions...
CVE-2026-66433
Contributor Cross Site Scripting XSS in Location Weather = 3.0.6 versions...
CVE-2026-65568
Contributor Broken Access Control in Visual Composer Website Builder = 45.15.0 versions...
CVE-2026-66428
Unauthenticated Cross Site Request Forgery CSRF in WP Google Review Slider = 18.4 versions...
CVE-2026-59539
Subscriber Insecure Direct Object References IDOR in Paid Member Subscriptions = 3.0.7 versions...
CVE-2026-59535
Unauthenticated Broken Access Control in Thrive Product Manager = 10.9.2 versions...
CVE-2026-59533
Unauthenticated SQL Injection in Relevanssi Light = 1.2.2 versions...
CVE-2026-66477
CVE-2026-66477 affects WordPress Gillion theme versions up to 4.13. The vulnerability is an unauthenticated Broken Access Control in the theme’s access logic, potentially allowing access to restricted resources by unauthenticated users. CVSSv3.1 base score 5.3 (Medium) with AV:N/AC:L/PR:N/UI:N/S:...
EUVD-2026-49251
Administrator Arbitrary File Deletion in Easy Digital Downloads = 3.6.9 versions...
CVE-2026-66475
Shop manager Cross Site Scripting XSS in Checkout Field Editor for WooCommerce - Checkout Manager = 3.0.5 versions...
CVE-2026-66474 WordPress Insert Headers and Footers Code – HT Script plugin <= 1.1.8 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery CSRF in Insert Headers and Footers Code – HT Script = 1.1.8 versions...