3864 matches found
EUVD-2026-60899
Contributor Arbitrary File Upload in Sync Post With Other Site = 1.9.3 versions...
CVE-2026-32463 WordPress Sync Post With Other Site plugin <= 1.9.3 - Arbitrary File Upload vulnerability
Contributor Arbitrary File Upload in Sync Post With Other Site = 1.9.3 versions...
CVE-2026-32463 WordPress Sync Post With Other Site plugin <= 1.9.3 - Arbitrary File Upload vulnerability
Contributor Arbitrary File Upload in Sync Post With Other Site = 1.9.3 versions...
CVE-2026-32463
Contributor Arbitrary File Upload in Sync Post With Other Site = 1.9.3 versions...
WordPress Login With Ajax plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Login With Ajax versions = 4.5.1...
WordPress Video Conferencing with Zoom plugin <= 4.6.8 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Video Conferencing with Zoom versions = 4.6.8...
CVE-2026-32463: Unrestricted Upload of File with Dangerous Type
Contributor Arbitrary File Upload in Sync Post With Other Site = 1.9.3 versions...
PT-2026-77041
Contributor Arbitrary File Upload in Sync Post With Other Site = 1.9.3 versions...
PT-2026-77069
Contributor Cross Site Scripting XSS in Video Conferencing with Zoom = 4.6.8 versions...
CVE-2026-66641: Improper Neutralization of Input During Web Page Generation
Contributor Cross Site Scripting XSS in Video Conferencing with Zoom = 4.6.8 versions...
CVE-2026-66640: Improper Neutralization of Input During Web Page Generation
Contributor Cross Site Scripting XSS in Login With Ajax = 4.5.1 versions...
PT-2026-77068
Name of the Vulnerable Software and Affected Versions Login With Ajax versions prior to 4.5.2 Description Cross Site Scripting XSS exists in the contributor section, allowing an attacker to execute malicious scripts in the browser of other users. Recommendations Update to a version newer than 4.5...
CVE-2026-52886 Notepad++: session.xml backupFilePath starts_with Bypass
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, Notepad++ validates the backupFilePath attribute from session.xml with std::wstring::startswith against the expected backup directory without path normalization, allowing parent-directory sequences during snapshot-mode...
CVE-2026-15056: Improper Limitation of a Pathname to a Restricted Directory
The StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.1 via the parsefilepath function. This makes it possible for authenticated attackers, with vendor-level...
CVE-2026-13167: Missing Authorization
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.5.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This...
CVE-2026-16586: Improper Neutralization of Special Elements used in an SQL Command
The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cgmultiplefilesforpost' - 'cgRealId' in all versions up to, and including, 30.0.7 due to insufficient escaping ...
CVE-2026-66270: Unrestricted Upload of File with Dangerous Type
Dell Wyse Management Suite WMS, versions prior to 2605.0.2, contain an Unrestricted Upload of File with Dangerous Type vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote Code Execution...
CVE-2026-28185
Unauthenticated Broken Authentication in Log in with Google = 1.4.2 versions...