1912 matches found
WordPress Under Construction plugin <= 5.82 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Under Construction versions = 5.82...
CVE-2026-40920
Apache Ranger versions
CVE-2026-12570
Removed by vendor...
CVE-2026-19284
A security vulnerability has been detected in MauricioMilano coder-api up to 1.1.0. Affected is the function createProject of the file src/core/projects.ts of the component Projects Endpoint. The manipulation leads to command injection. The attack must be carried out locally. The project was...
CVE-2026-11907
The Stream plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.2.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and...
CVE-2026-12801 Ultra Addons for Contact Form 7 <= 3.5.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider Attributes
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Range Slider 'data-label' and 'data-separator' attributes in all versions up to, and including, 3.5.43 due to insufficient input sanitization and output escaping. This makes it possible f...
CVE-2026-65576
Unauthenticated PHP Object Injection in Adrena = 1.2.14 versions...
CVE-2026-65543
Subscriber Sensitive Data Exposure in Vimeo = 1.2.2 versions...
EUVD-2026-53897
Unauthenticated Cross Site Request Forgery CSRF in Plugins Garbage Collector Database Cleanup = 0.14 versions...
CVE-2026-66685
Unauthenticated Sensitive Data Exposure in Featured Video Plus = 2.3.3 versions...
CVE-2026-66665
Unauthenticated Arbitrary File Upload in Type Hub = 2.0.6 versions...
CVE-2026-66447
Unauthenticated SQL Injection in WordPress File Upload = 5.1.7 versions...
EUVD-2026-53879
Unauthenticated PHP Object Injection in AI ANN = 1.29.0 versions...
EUVD-2026-53992
Unauthenticated PHP Object Injection in Abogado = 1.18 versions...
EUVD-2026-53987
Subscriber SQL Injection in WP Job Portal = 2.5.6 versions...
EUVD-2026-53984
Shop manager Privilege Escalation in Order Delivery Date for WooCommerce = 4.6.0 versions...
CVE-2026-65542
CVE-2026-65542 concerns the WordPress WordPress Super Socializer plugin, affected versions
CVE-2025-9266
CVE-2025-9266 affects the WordPress Accelerate theme up to version 1.5.3. The root cause is a missing capability check in enqueue_scripts(), enabling authenticated users with Subscriber-level access and above to install and activate the ThemeGrill Demo Importer plugin. The impact is unauthorized ...
WordPress Featured Video Plus plugin <= 2.3.3 - Sensitive Data Exposure vulnerability
Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Featured Video Plus versions = 2.3.3...