WordPress InfiniteWP <1.9.4.5 - Authorization Bypass

WordPress InfiniteWP plugin before 1.9.4.5 for WordPress contains an authorization bypass vulnerability via a missing authorization check in iwpmmbsetrequest in init.php. An attacker who knows the username of an administrator can log in, thereby making it possible to obtain sensitive information,...

Elementor Website Builder - Remote Code Execution

The Elementor Website Builder plugin for WordPress versions 3.6.0 to 3.6.2 are vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the /core/app/modules/onboarding/module.php file. This makes it possible for attackers to modify site data and upload...

WordPress Perfect Survey <1.5.2 - SQL Injection

Perfect Survey WordPress plugin before 1.5.2 does not validate and escape the questionid GET parameter before using it in a SQL statement in the getquestion AJAX action, allowing unauthenticated users to perform SQL injection. id: CVE-2021-24762 info: name: WordPress Perfect Survey 1.5.2 - SQL...

WordPress Modern Events Calendar Lite <5.16.5 - Authenticated Arbitrary File Upload

WordPress Modern Events Calendar Lite plugin before 5.16.5 is susceptible to authenticated arbitrary file upload. The plugin does not properly check the imported file, allowing PHP files to be uploaded and/or executed by an administrator or other high-privilege user using the text/csv content-typ...

WP Time Capsule Plugin - Remote Code Execution

The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the the UploadHandler.php file and no direct file access prevention in all versions up to, and including, 1.22.21. This makes it possible for unauthenticat...

CVE-2026-62127

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in MediaRon LLC WP Plugin Info Card wp-plugin-info-card allows Stored XSS.This issue affects WP Plugin Info Card: from n/a through 6.3.5...

CVE-2026-62127

The WP Plugin Info Card (wp-plugin-info-card) by MediaRon LLC is vulnerable to Stored Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. This issue impacts versions from n/a through 6.3.5 . The vulnerability allows for the execution of malicious scripts...

EUVD-2026-94888

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in MediaRon LLC WP Plugin Info Card wp-plugin-info-card allows Stored XSS.This issue affects WP Plugin Info Card: from n/a through 6.3.5...

CVE-2026-62127 WordPress WP plugin Info Card plugin <= 6.3.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in MediaRon LLC WP Plugin Info Card wp-plugin-info-card allows Stored XSS.This issue affects WP Plugin Info Card: from n/a through 6.3.5...

WordPress WP plugin Info Card plugin <= 6.3.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by V1T in WordPress Plugin WP Plugin Info Card versions = 6.3.5...

CVE-2026-62127: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in MediaRon LLC WP Plugin Info Card wp-plugin-info-card allows Stored XSS.This issue affects WP Plugin Info Card: from n/a through 6.3.5...

WordPress WP plugin Web plugin <= 2.3.5 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by sorin vasile in WordPress Plugin WP Plugin Web versions = 2.3.5...

CVE-2026-80099: Improper Authentication

Several Newfold plugins are vulnerable to Authentication Bypass. The vulnerability exists because the plugins bundle the wp-module-data module. In the module, the authenticate method — registered on the restauthenticationerrors filter and therefore evaluated for every unauthenticated REST API...

CVE-2026-61982 WordPress SiteGuard WP Plugin plugin <= 1.8.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in SiteGuard WP Plugin = 1.8.6 versions...

CVE-2026-61982: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in SiteGuard WP Plugin = 1.8.6 versions...

PT-2026-68531

Name of the Vulnerable Software and Affected Versions SiteGuard WP Plugin versions prior to 1.8.7 Description Stored Cross-Site Scripting XSS occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages, which...

WordPress SVG Support - Full Path Disclosure Detection

The WordPress SVG Support plugin was detected to have publicly accessible PHP files without ABSPATH protection, which exposed sensitive server path information. Direct access to vendor/composer files triggered PHP fatal errors that revealed the full WordPress filesystem path. !/usr/bin/env python...

LottieFiles WordPress Plugin <= 3.0.0 - Missing Authorization Detection

LottieFiles LottieFiles = 3.0.0 contains a broken access control vulnerability caused by incorrectly configured access control security levels, letting attackers exploit missing authorization, exploit requires no special privileges. !/usr/bin/env python3 -- coding: utf-8 -- """LottieFiles...

Admin Menu Editor - Full Path Disclosure Detection

Admin Menu Editor WordPress plugin contains a full path disclosure vulnerability due to improper access restrictions in its source files, allowing unauthenticated attackers to retrieve full server paths and aiding exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """Admin Menu Editor...

WordPress Easy WP SMTP - Log Exposure Detection

Detected WordPress Easy WP SMTP plugin debug log file exposed via directory listing, potentially revealing sensitive email contents including password reset links. !/usr/bin/env python3 -- coding: utf-8 -- """Detected WordPress Easy WP SMTP plugin debug log file exposed via directory listing,...