24424 matches found
PT-2026-97166
Name of the Vulnerable Software and Affected Versions WP OAuth Server Login with WordPress versions prior to 6.4.0 Description The plugin fails to bind the OpenID Connect identity assertion to the authorization grant being exchanged. Instead, it returns the assertion of the most recently...
PT-2026-97335
π¨π¨π¨ γSuccessful exploitation can lead to an authenticated cPanel user being able to perform database modifications in other accounts.γ Security: CVE-2026-87900 Vulnerability in WP Toolkit Database Creation - September 22, 2026 β cPanel https://t.co/xNBroc138B...
PT-2026-97178
Name of the Vulnerable Software and Affected Versions WP Recipe Maker versions prior to 10.8.2 Description An issue exists where the plugin fails to perform a capability check in an AJAX action. This allows any authenticated user, including those with subscriber-level privileges, to read the full...
CVE-2026-94124: Improper Neutralization of Special Elements used in an SQL Command
Contributor SQL Injection in WP EasyCart = 5.9.4 versions...
CVE-2026-86602: Exposure of Sensitive Information to an Unauthorized Actor
The WP Recipe Maker WordPress plugin before 10.8.2 does not perform any capability check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the full content of unpublished recipes...
PT-2026-97453
Name of the Vulnerable Software and Affected Versions WP Photo Album Plus versions prior to 9.3.02.003 Description An unauthenticated Cross Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication...
PT-2026-97241
Name of the Vulnerable Software and Affected Versions Rename wp-login.php to anything you want versions prior to 2.0.2 Description The plugin is subject to time-based SQL Injection, a technique where an attacker sends a query that forces the database to wait a specific amount of time before...
PT-2026-97269
The WP Recipe Maker WordPress plugin before 10.8.2 does not remove shortcodes from comment content before expanding it while building a page's structured metadata, allowing unauthenticated users to have arbitrary shortcodes executed server side and to read the content of unpublished recipes...
Exploit for CVE-2026-87902
CVE-2026-87902 β Unauthenticated local file inclusion in WordP...
WordPress WP User Manager plugin <= 2.9.19 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP User Manager versions = 2.9.19...
WordPress WP Yelp Review Slider plugin <= 9.2 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Ivaylo in WordPress Plugin WP Yelp Review Slider versions = 9.2...
WordPress WP Customer Reviews plugin <= 3.7.8 - Reflected Cross-Site Scripting vulnerability
Reflected Cross-Site Scripting vulnerability discovered by Quang in WordPress Plugin WP Customer Reviews versions = 3.7.8...
WordPress WP Import Export Lite plugin < 3.9.35 - Authenticated Privilege Escalation vulnerability
Authenticated Privilege Escalation vulnerability discovered by mak3breadMinseong Kim in WordPress Plugin WP Import Export Lite versions 3.9.35...
CVE-2026-9231
The WP Travel Engine β Tour Booking Plugin β Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.8.0 via the wtegettemplate function. This makes it possible for authenticated attackers, with contributor-level access and above, ...
CVE-2026-9231 WP Travel Engine <= 6.8.0 - Authenticated (Contributor+) Local File Inclusion via 'template' Shortcode Attribute
The WP Travel Engine β Tour Booking Plugin β Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.8.0 via the wtegettemplate function. This makes it possible for authenticated attackers, with contributor-level access and above, ...
EUVD-2026-84333
The WP Travel Engine β Tour Booking Plugin β Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.8.0 via the wtegettemplate function. This makes it possible for authenticated attackers, with contributor-level access and above, ...
CVE-2026-9231 WP Travel Engine <= 6.8.0 - Authenticated (Contributor+) Local File Inclusion via 'template' Shortcode Attribute
The WP Travel Engine β Tour Booking Plugin β Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.8.0 via the wtegettemplate function. This makes it possible for authenticated attackers, with contributor-level access and above, ...
CVE-2026-9231
The WP Travel Engine β Tour Booking Plugin β Tour Operator Software for WordPress is vulnerable to Local File Inclusion (LFI) in all versions up to and including 6.8.0 . The root cause lies in the wte_get_template function, which allows authenticated attackers with contributor-level access or hig...
CVE-2026-9004
The WP-CRM System β Manage Clients and Projects plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.6 via the 'contactid' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract...
CVE-2026-93778
The WP Yelp Review Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Yelp Review Text imported via wpyelpdownloadsource in all versions up to, and including, 9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...