24424 matches found
PT-2026-97180
Name of the Vulnerable Software and Affected Versions WP Recipe Maker versions prior to 10.8.2 Description An authorization check is missing in a REST route, and the route does not restrict the data it stores. This allows unauthenticated users to write unlimited data into the metadata of any user...
PT-2026-97179
Name of the Vulnerable Software and Affected Versions WP Recipe Maker versions prior to 10.8.2 Description An authorization check is missing in an AJAX action, which allows any authenticated user, including those with subscriber privileges, to retrieve the IDs and titles of unpublished lists...
PT-2026-97479
Subscriber Arbitrary File Deletion in WP User Frontend = 4.3.11 versions...
PT-2026-97478
Name of the Vulnerable Software and Affected Versions WP User Frontend versions prior to 4.3.12 Description An unauthenticated bypass issue exists that allows users to circumvent security restrictions without providing valid credentials. Recommendations Update to a version newer than 4.3.11...
CVE-2026-87900: Improper Neutralization of Argument Delimiters in a Command
Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts...
CVE-2026-95523: Authentication Bypass by Spoofing
Subscriber Bypass Vulnerability in WP User Frontend = 4.3.11 versions...
CVE-2026-94176: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Mang Board WP = 2.4.1 versions...
CVE-2026-93368: Improper Neutralization of Special Elements used in an SQL Command
The Rename wp-login.php to anything you want plugin for WordPress is vulnerable to time-based SQL Injection via 'log' Username Parameter in all versions up to, and including, 2.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...
CVE-2026-86601: Improper Neutralization of Special Elements in Output Used by a Downstream Component
The WP Recipe Maker WordPress plugin before 10.8.2 does not remove shortcodes from comment content before expanding it while building a page's structured metadata, allowing unauthenticated users to have arbitrary shortcodes executed server side and to read the content of unpublished recipes...
CVE-2026-95525: Improper Limitation of a Pathname to a Restricted Directory
Subscriber Arbitrary File Deletion in WP User Frontend = 4.3.11 versions...
CVE-2026-95524: Authentication Bypass by Spoofing
Unauthenticated Bypass Vulnerability in WP User Frontend = 4.3.11 versions...
CVE-2026-94079: Missing Authorization
Unauthenticated Broken Access Control in WP User Manager = 2.9.19 versions...
CVE-2026-82843: Improper Authentication
The WP OAuth Server Login with WordPress WordPress plugin before 6.4.0 does not bind the OpenID Connect identity assertion it issues to the authorization grant being exchanged, returning instead the assertion belonging to whichever user authenticated most recently, which allows users with the...
CVE-2026-86608: Uncontrolled Resource Consumption
The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its REST routes, nor does it bound what that route stores, allowing unauthenticated users to write unlimited data into any user's metadata and to permanently prevent that account, including an...
CVE-2026-86603: Exposure of Sensitive Information to an Unauthorized Actor
The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to retrieve the IDs and titles of other users' unpublished lists...
CVE-2026-93774: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in WP Photo Album Plus = 9.3.02.002 versions...
WordPress 7.1.1 Local File Inclusion Scanner
WordPress versions 4.7.0 through 7.1.1 contain an unauthenticated page-template path traversal issue that can include readable local PHP files. This tool probes the wp-links-opml.php inclusion oracle without attempting command execution...
PT-2026-97457
Contributor SQL Injection in WP EasyCart = 5.9.4 versions...