24766 matches found
CVE-2026-89064 All-in-One WP Migration and Backup <= 7.110 - Unauthenticated Insufficient Credential Protection via Authorization Basic Header
The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110. This is due to the Ai1wmMainController::init method — registered on the admininit hook, which fires unauthenticated on admin-ajax.php and...
CVE-2026-89064 All-in-One WP Migration and Backup <= 7.110 - Unauthenticated Insufficient Credential Protection via Authorization Basic Header
The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110. This is due to the Ai1wmMainController::init method — registered on the admininit hook, which fires unauthenticated on admin-ajax.php and...
EUVD-2026-81315
The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110. This is due to the Ai1wmMainController::init method — registered on the admininit hook, which fires unauthenticated on admin-ajax.php and...
CVE-2026-89064
All-in-One WP Migration and Backup for WordPress (≤ 7.110 ) contains an unauthenticated Insufficient Credential Protection flaw discovered by Jakub Herman. The Ai1wm_Main_Controller::init() method, registered on the admin_init hook, reads $_SERVER['PHP_AUTH_USER'] and $_SERVER['PHP_AUTH_PW'] from...
CVE-2026-89064: Insufficiently Protected Credentials
The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110. This is due to the Ai1wmMainController::init method — registered on the admininit hook, which fires unauthenticated on admin-ajax.php and...
PT-2026-94157
Name of the Vulnerable Software and Affected Versions Paid Downloads versions prior to 3.16 Description The Paid Downloads plugin for WordPress allows unauthenticated arbitrary file upload through the admin request handler function. This occurs because the function lacks proper authorization and...
CVE-2026-66628: Improper Neutralization of Special Elements used in an SQL Command
Shop manager SQL Injection in WP-Lister Lite for eBay = 3.8.11 versions...
CVE-2026-90887: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in WP Inventory Manager = 2.5.4 versions...
PT-2026-94275
Shop manager SQL Injection in WP-Lister Lite for eBay = 3.8.11 versions...
PT-2026-94137
Name of the Vulnerable Software and Affected Versions All-in-One WP Migration and Backup versions prior to 7.111 Description The plugin contains an issue related to insufficient credential protection. The Ai1wm Main Controller::init function, which is registered on the admin init hook and execute...
PT-2026-94303
Unauthenticated Cross Site Scripting XSS in WP Inventory Manager = 2.5.4 versions...
CVE-2026-66618: Improper Neutralization of Special Elements used in an SQL Command
Administrator SQL Injection in WP Maps = 4.9.9 versions...
PT-2026-94270
Administrator SQL Injection in WP Maps = 4.9.9 versions...
WordPress WP Import Export Lite plugin < 3.9.33 - Authenticated Arbitrary Directory Deletion vulnerability
Authenticated Arbitrary Directory Deletion vulnerability discovered by mak3breadMinseong Kim in WordPress Plugin WP Import Export Lite versions 3.9.33...
WordPress WP Import Export Lite plugin < 3.9.33 - Authenticated Arbitrary File Upload vulnerability
Authenticated Arbitrary File Upload vulnerability discovered by mak3breadMinseong Kim in WordPress Plugin WP Import Export Lite versions 3.9.33...
WordPress WP Import Export Lite plugin < 3.9.33 - Authenticated RCE vulnerability
Authenticated RCE vulnerability discovered by Erwan LR WPScan in WordPress Plugin WP Import Export Lite versions 3.9.33...
WordPress WP Import Export Lite plugin < 3.9.34 - Authenticated RCE vulnerability
Authenticated RCE vulnerability discovered by mak3breadMinseong Kim in WordPress Plugin WP Import Export Lite versions 3.9.34...
WordPress All-in-One WP Migration and Backup plugin <= 7.110 - Unauthenticated Insufficient Credential Protection vulnerability
Unauthenticated Insufficient Credential Protection vulnerability discovered by Jakub Herman in WordPress Plugin All-in-One WP Migration versions = 7.110...
CVE-2026-92465
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Themeum WP Mega Menu allows Blind SQL Injection. This issue affects WP Mega Menu: from n/a through 1.4.2...
