911 matches found
CVE-2026-65515
Unauthenticated Cross Site Scripting XSS in AffiliateWP = 2.35.0 versions...
CVE-2026-65577
WordPress Advice theme,
CVE-2026-65574 WordPress Abogado theme <= 1.18 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Abogado = 1.18 versions...
CVE-2026-65543 WordPress Vimeo plugin <= 1.2.2 - Sensitive Data Exposure vulnerability
Subscriber Sensitive Data Exposure in Vimeo = 1.2.2 versions...
CVE-2026-65541
The CVE concerns WordPress Plugin “Staff Training” versions
CVE-2026-65507
Summary: CVE-2026-65507 affects the WordPress AIWU plugin versions <= 1.5.6 and is described as an unauthenticated privilege escalation. What is affected: WordPress AIWU plugin (
EUVD-2026-53961
Unauthenticated Bypass Vulnerability in Element Pack Elementor Addons = 8.7.13 versions...
EUVD-2026-53942
Unauthenticated PHP Object Injection in Ajax Search Lite = 4.14.4 versions...
CVE-2026-18895
A vulnerability was found in UTT HiPER 1250GW up to 3.2.7-210907-180535. Impacted is the function strcpy of the file /goform/APSecurity5g. Performing a manipulation of the argument cipher results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been...
CVE-2026-66433
Contributor Cross Site Scripting XSS in Location Weather = 3.0.6 versions...
CVE-2026-66428
Unauthenticated Cross Site Request Forgery CSRF in WP Google Review Slider = 18.4 versions...
EUVD-2026-49228
Subscriber Broken Access Control in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg = 1.5.1 versions...
CVE-2026-59535
CVE-2026-59535 affects WordPress Thrive Product Manager plugin
EUVD-2026-48137
Unauthenticated Cross Site Request Forgery CSRF in افزونه حمل و نقل ووکامرس پست پیشتاز و سفارشی، پیک موتوری = 4.4.5 versions...
CVE-2026-15794 Grid/List View for WooCommerce <= 3.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'position' Shortcode Attribute
The Grid/List View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'position' Shortcode Attribute in all versions up to, and including, 3.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2026-15827 GutenKit <= 2.4.12 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Mailchimp REST Endpoints
The GutenKit Blocks plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /wp-json/gutenkit/v1/mailchimp/get/lists and /wp-json/gutenkit/v1/mailchimp/get/interests REST API endpoints in versions up to, and including, 2.4.12. Both endpoints are...
EUVD-2026-45172
A vulnerability was identified in poco-ai poco-claw up to 0.5.4. This issue affects the function runtask of the file executor/app/api/v1/task.py. The manipulation of the argument callbackurl leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit is...
CVE-2026-15690
A vulnerability was identified in open62541 up to 1.5.5. Affected by this issue is the function responseReadNamespacesArray of the file src/client/uaclientconnect.c of the component Shared Client Library. Such manipulation of the argument ServerNamespaceArray leads to null pointer dereference. Th...
CVE-2026-57815
CVE-2026-57815 documents a path traversal vulnerability in the WordPress plugin Forminator (WPMU DEV Your All-in-One WordPress Platform Forminator) affecting version range up to and including 1.55.0.2. The issue is described as Improper Limitation of a Pathname to a Restricted Directory, enabling...
CVE-2026-61968 WordPress myCred plugin <= 3.1.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in Saad Iqbal myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through = 3.1.2...