150 matches found
WordPress Wishlist Member X plugin <= 3.34.1 - Unauthenticated Account Takeover via 'mergewith' Parameter vulnerability
Unauthenticated Account Takeover via 'mergewith' Parameter vulnerability discovered by bashu - VN in WordPress Plugin WishList Member X versions = 3.34.1...
CVE-2026-12949
The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via Insufficient Verification of Data Authenticity in versions up to and including 3.34.1. This is due to the wpmregister function validating the registration cookie only against the GET reg parameter while accepting the...
CVE-2026-12949 Wishlist Member X <= 3.34.1 - Unauthenticated Account Takeover via 'mergewith' Parameter
The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via Insufficient Verification of Data Authenticity in versions up to and including 3.34.1. This is due to the wpmregister function validating the registration cookie only against the GET reg parameter while accepting the...
CVE-2026-12949 Wishlist Member X <= 3.34.1 - Unauthenticated Account Takeover via 'mergewith' Parameter
The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via Insufficient Verification of Data Authenticity in versions up to and including 3.34.1. This is due to the wpmregister function validating the registration cookie only against the GET reg parameter while accepting the...
CVE-2026-12949
The CVE concerns the Wishlist Member plugin for WordPress, affected in versions up to 3.34.1. The vulnerability arises in wpm_register() where the registration cookie is only validated against the GET reg parameter while POST mergewith and POST wpm_id are accepted without verifying that the refer...
EUVD-2026-58589
The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via Insufficient Verification of Data Authenticity in versions up to and including 3.34.1. This is due to the wpmregister function validating the registration cookie only against the GET reg parameter while accepting the...
CVE-2026-12949
The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via Insufficient Verification of Data Authenticity in versions up to and including 3.34.1. This is due to the wpmregister function validating the registration cookie only against the GET reg parameter while accepting the...
PT-2026-71963
The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via Insufficient Verification of Data Authenticity in versions up to and including 3.34.1. This is due to the wpm register function validating the registration cookie only against the GET reg parameter while accepting the...
CVE-2026-57384
Subscriber Cross Site Scripting XSS in WishList Member X = 3.32.0 versions...
EUVD-2026-48166
Subscriber Cross Site Scripting XSS in WishList Member X = 3.32.0 versions...
CVE-2026-57384
CVE-2026-57384 describes a Cross Site Scripting (XSS) vulnerability in the WordPress WishList Member X plugin, affecting versions
CVE-2026-57384 WordPress WishList Member X plugin <= 3.32.0 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting XSS in WishList Member X = 3.32.0 versions...
CVE-2026-57384 WordPress WishList Member X plugin <= 3.32.0 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting XSS in WishList Member X = 3.32.0 versions...
PT-2026-63824
Subscriber Cross Site Scripting XSS in WishList Member X = 3.32.0 versions...
WordPress WishList Member X plugin <= 3.32.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Austin Ginder in WordPress Plugin WishList Member X versions = 3.32.0...
EUVD-2026-37667
Subscriber Arbitrary File Upload in WishList Member X = 3.29.0 versions...
EUVD-2026-37663
Subscriber Broken Access Control in WishList Member X = 3.29.0 versions...
CVE-2026-25446
Subscriber Arbitrary File Upload in WishList Member X = 3.29.0 versions...