88425 matches found
CVE-2026-27365
The WordPress PublishPress Series plugin (versions through 2.17.0) has a stored XSS flaw from improper input neutralization during page generation. Patchstack rates it MEDIUM (CVSS 5.9) requiring high privileges and user interaction. No exploitation data is provided. Upgrade to a patched version ...
CVE-2026-66589
The B2BKing WordPress plugin (versions through 5.2.30) has a Missing Authorization flaw in its access control, allowing low-privilege users to bypass security levels. CVSS 5.4 MEDIUM reflects low confidentiality and integrity impact. No patch version or exploit details are provided in the documen...
EUVD-2026-62211
Missing Authorization vulnerability in Kings Plugins B2BKing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects B2BKing: from n/a through 5.2.30...
EUVD-2026-62210
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in David Lingren Media LIbrary Assistant allows Stored XSS. This issue affects Media LIbrary Assistant: from n/a through 3.39...
CVE-2026-66591
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in David Lingren Media LIbrary Assistant allows Stored XSS. This issue affects Media LIbrary Assistant: from n/a through 3.39...
CVE-2026-66602
Cross-Site Request Forgery CSRF vulnerability in DevItems HashBar – WordPress Notification Bar allows Cross Site Request Forgery. This issue affects HashBar – WordPress Notification Bar: from n/a through 2.0.0...
WordPress WPC Admin Columns plugin < 2.3.4 - Subscriber+ Arbitrary User/Post/Term Meta Disclosure vulnerability
Subscriber+ Arbitrary User/Post/Term Meta Disclosure vulnerability discovered by Farid Narimanov in WordPress Plugin WPC Admin Columns versions 2.3.4...
WordPress WP Photo Album Plus plugin < 9.2.07.002 - Reflected XSS via lbstart vulnerability
Reflected XSS via lbstart vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin WP Photo Album Plus versions 9.2.07.002...
CVE-2026-19500
The Entries component in Brainstorm Force SureForms version, less than 2.1.3, does not enforce adequate limits on user-controlled form fields or submitted content during processing and rendering, which allows a remote attacker to exhaust server resources, prevent administrators from accessing the...
CVE-2026-73358
Unauthenticated Cross Site Scripting XSS in Affiliates Manager = 2.9.53 versions...
CVE-2026-73366
Unauthenticated PHP Object Injection in Easy Google Maps = 1.13.0 versions...
CVE-2026-73350
Unauthenticated Broken Authentication in SupportCandy = 3.5.1 versions...
CVE-2026-73341
Unauthenticated PHP Object Injection in RegistrationMagic = 6.0.9.7 versions...
CVE-2026-73187
Unauthenticated SQL Injection in Sticky Chat Widget = 1.4.2 versions...
CVE-2026-68567
Unauthenticated Cross Site Scripting XSS in Convert Pro = 1.0.1 versions...
CVE-2026-66644
Contributor Cross Site Scripting XSS in Typing Effect = 1.3.7 versions...
CVE-2026-66635
Unauthenticated Cross Site Request Forgery CSRF in Slider by 10Web = 1.2.62 versions...
CVE-2026-66638
Contributor Cross Site Scripting XSS in Frontend Admin by DynamiApps = 3.29.10 versions...