86120 matches found
CVE-2026-5524 Divi Form Builder <= 5.1.8 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via 'acceptFileTypes' Parameter
The Divi Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload leading to Remote Code Execution in all versions up to and including 5.1.8. This is due to insufficient file extension validation in the doimageupload function where user-supplied input from the acceptFileTypes POST...
CVE-2026-57765
Contributor SQL Injection in WP EasyCart = 5.9.0 versions...
CVE-2026-57350
Unauthenticated Cross Site Scripting XSS in WP Debugging = 2.12.2 versions...
CVE-2025-69134
Unauthenticated Arbitrary Content Deletion in OpenAI Chatbot for WordPress – Helper = 1.1.4 versions...
WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin Booking calendar, Appointment Booking System versions = 3.2.36...
CVE-2026-57760 WordPress Sendcloud Shipping plugin <= 1.0.29 - Broken Access Control vulnerability
Missing Authorization vulnerability in Sendcloud Sendcloud Shipping allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Sendcloud Shipping: from n/a through 1.0.29...
CVE-2026-57765
Contributor SQL Injection in WP EasyCart = 5.9.0 versions...
CVE-2026-57764
CVE-2026-57764 : Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Surbma | Yoast SEO Breadcrumb Shortcode, affecting versions
CVE-2026-57762
CVE-2026-57762: A Cross Site Scripting (XSS) vulnerability affects WordPress Simple URLs plugin versions
CVE-2026-57761
Unauthenticated Cross Site Request Forgery CSRF in SEOWP = 3.12.2 versions...
CVE-2026-57757 WordPress pCloud WP Backup plugin <= 2.0.2 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery CSRF in pCloud WP Backup = 2.0.2 versions...
CVE-2026-57755
CVE-2026-57755 describes a Contributor Cross Site Scripting (XSS) vulnerability in the WordPress plugin Mosaic Gallery – Advanced Gallery, affected versions
CVE-2026-57752
The CVE-2026-57752 entry covers a Contributor SQL Injection in the WordPress iNET Webkit plugin version 1.2.4. The vulnerability is described without attack details; CVSS 3.1 base score 8.5 (Network attack, Low complexity, Privileges Required: Low, User Interaction: None, Confidentiality Impact: ...
CVE-2026-57748 WordPress Shopify plugin <= 1.0.0 - Local File Inclusion vulnerability
Contributor Local File Inclusion in Shopify = 1.0.0 versions...
CVE-2026-57749 WordPress SportsPress Pro plugin <= 2.7.29 - Local File Inclusion vulnerability
Contributor Local File Inclusion in SportsPress Pro = 2.7.29 versions...
CVE-2026-57748
CVE-2026-57748 describes a Local File Inclusion vulnerability in the WordPress Shopify plugin for Shopify integrations, affecting versions up to 1.0.0. The available sources confirm the vulnerability class and affected product/version, but do not provide explicit root-cause details beyond LFI, ex...
CVE-2026-57688
The CVE concerns the WordPress POS Entegratör plugin (versions
CVE-2026-57683 WordPress WP Fast Total Search plugin <= 1.80.280 - SQL Injection vulnerability
Unauthenticated SQL Injection in WP Fast Total Search = 1.80.280 versions...
CVE-2026-57682
The CVE-2026-57682 entry affects the WordPress plugin “Simple Link Directory” version ≤ 15.0.5, with an unauthenticated Cross Site Scripting (XSS) vulnerability. The connected records confirm the vulnerability type (XSS) and affected version, but do not provide concrete root-cause details, exploi...