92918 matches found
PT-2026-86314
The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post content class attribute of .dvcss element' parameter in all versions up to, and including, 2.4.30 due to insufficient input sanitization and output...
CVE-2026-19632
CVE-2026-19632 — TranslatePress ≤ 3.3.1 Unauthenticated Account Takeover PoC Mass account-takeover tool for CVE-2026-19632 , an unauthenticated account takeover in the TranslatePress – Multilingual WordPress plugin ≤ 3.3.1 caused by password reset link disclosure. One command per target list — th...
WordPress Gravity Forms plugin <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via Post Body Field Value vulnerability
Unauthenticated Stored Cross-Site Scripting via Post Body Field Value vulnerability discovered by daroo in WordPress Plugin Gravity Forms versions = 2.10.5...
WordPress W3 Total Cache plugin <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via LazyLoad Background Mutator vulnerability
Unauthenticated Stored Cross-Site Scripting via LazyLoad Background Mutator vulnerability discovered by theviper17y in WordPress Plugin W3 Total Cache versions = 2.10.5...
WordPress Ninja Forms plugin <= 3.15.1 - Unauthenticated Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key vulnerability
Unauthenticated Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key vulnerability discovered by Jonah Burgess CryptoCat in WordPress Plugin Ninja Forms versions = 3.15.1...
WordPress Hummingbird - Speed Optimization, Caching, Minify, Compress & CDN plugin <= 3.21.0 - Unauthenticated Remote Code Execution via Cookie Name in Page Cache Debug Log vulnerability
WordPress Hummingbird - Speed Optimization, Caching, Minify, Compress & CDN plugin = 3.21.0 - Unauthenticated Remote Code Execution via Cookie Name in Page Cache Debug Log vulnerability discovered by Kuba in WordPress Plugin Hummingbird versions = 3.21.0...
WordPress Dear Flipbook plugin <= 2.4.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via '.dvcss' Element Class Attribute vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via '.dvcss' Element Class Attribute vulnerability discovered by tipsen in WordPress Plugin DearFlip versions = 2.4.30...
WordPress Theme My Login plugin <= 7.1.15 - Authenticated (Subscriber+) Missing Authorization to Unauthorized Multisite Subsite Creation via 'gimmeanotherblog' Signup Stage vulnerability
Authenticated Subscriber+ Missing Authorization to Unauthorized Multisite Subsite Creation via 'gimmeanotherblog' Signup Stage vulnerability discovered by Maksim Hayder trjan - Iron Digital Labs LLC in WordPress Plugin Theme My Login versions = 7.1.15...
WordPress MStore API plugin <= 4.20.0 - Unauthenticated Authentication Bypass via 'id_token' Parameter JWT Forgery vulnerability
Unauthenticated Authentication Bypass via 'idtoken' Parameter JWT Forgery vulnerability discovered by t4g0 in WordPress Plugin MStore API versions = 4.20.0...
WordPress Dear Flipbook plugin <= 2.4.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via '.df-element' Element Inner HTML vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via '.df-element' Element Inner HTML vulnerability discovered by tipsen in WordPress Plugin DearFlip versions = 2.4.30...
WordPress Welcart e-Commerce plugin <= 2.12.1 - Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callback vulnerability
Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callback vulnerability discovered by daroo in WordPress Plugin Welcart e-Commerce versions = 2.12.1...
WordPress Events Manager - Calendar, Bookings, Tickets, and more! plugin <= 7.3.3 - Unauthenticated Stored Cross-Site Scripting via Event Attributes vulnerability
WordPress Events Manager - Calendar, Bookings, Tickets, and more! plugin = 7.3.3 - Unauthenticated Stored Cross-Site Scripting via Event Attributes vulnerability discovered by shark3y in WordPress Plugin Events Manager versions = 7.3.3...
CVE-2026-12483
The LearnDash LMS plugin for WordPress is vulnerable to Unrestricted File Type Upload in versions up to and including 5.1.5. This is due to insufficient input validation in the 'learndashfileuploadprocess' function, which iterates through an entire array and validates only the first file. This...
CVE-2026-12483 LearnDash LMS <= 5.1.5 - Authenticated (Subscriber+) Arbitrary File Upload via Assignment Upload Handler
The LearnDash LMS plugin for WordPress is vulnerable to Unrestricted File Type Upload in versions up to and including 5.1.5. This is due to insufficient input validation in the 'learndashfileuploadprocess' function, which iterates through an entire array and validates only the first file. This...
EUVD-2026-71098
The LearnDash LMS plugin for WordPress is vulnerable to Unrestricted File Type Upload in versions up to and including 5.1.5. This is due to insufficient input validation in the 'learndashfileuploadprocess' function, which iterates through an entire array and validates only the first file. This...
CVE-2026-12483
The LearnDash LMS plugin for WordPress (versions ≤ 5.1.5 ) is vulnerable to an Unrestricted File Type Upload caused by insufficient input validation in the learndash_fileupload_process function, which validates only the first file in a multi-file array. Authenticated users with subscriber-level a...
WordPress Restaurant Menu and Food Ordering plugin < 2.4.12 - Unauthenticated Payment Bypass vulnerability
Unauthenticated Payment Bypass vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Restaurant Menu by MotoPress versions 2.4.12...
CVE-2026-84045
The E-cab Taxi Booking Manager for Woocommerce WordPress plugin before 2.0.5 does not validate a client-supplied trip distance and base-price value on the server before pricing a booking, allowing unauthenticated attackers to manipulate the order total down to zero and place real taxi-booking...