88745 matches found
CVE-2026-14433
The CVE-2026-14433 entry describes a Stored Cross-Site Scripting (XSS) vulnerability in the Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress. The flaw affects the REST API via the business_id parameter and is present in all versions up to and including 4.6.0, due t...
CVE-2026-14433
The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'businessid' parameter in all versions up to, and including, 4.6.0 due to insufficient input sanitization and output escaping. This makes it possible for...
PT-2026-72155
The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action' parameter in all versions up to, and including, 5.1 due to insufficient input sanitization and output escaping. This makes it possible for...
PT-2026-72154
The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to generic SQL Injection via the 'key' parameter in all versions up to, and including, 5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...
PT-2026-72156
The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to generic SQL Injection via Pattern JSON Keys/Values in all versions up to, and including, 5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation...
PT-2026-72887
The WPML Multilingual CMS plugin for WordPress is vulnerable to SQL Injection via the 'sorting' parameter in all versions up to, and including, 4.9.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible fo...
PT-2026-72876
The Wholesale Market plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.2.2 via the ced wholesale request send AJAX action. The ced wholesale request send callback handler only verifies a nonce which is exposed to any authenticated user through wp...
PT-2026-72157
The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cg multiple files for post' - 'cgRealId' in all versions up to, and including, 30.0.7 due to insufficient...
PT-2026-72152
The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first name' parameter in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for...
PT-2026-72150
The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'regionArray' parameter in all versions up to, and including, 4.3.5 due to insufficient input sanitization and output escaping. This makes it possible for...
PT-2026-72148
The Image Uploader for Welcart plugin for WordPress is vulnerable to generic SQL Injection via the 'post title' parameter in all versions up to, and including, 1.4.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This make...
PT-2026-72158
The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Button Module 'button' Button Code Setting in all versions up to, and including, 2.10.2.2 due to insufficient input sanitization and output escaping. This makes it...
40,000 WordPress Sites affected by Authentication Bypass Vulnerability in User Profile Builder WordPress Plugin
On July 14th, 2026, we received a submission for an Authentication Bypass vulnerability in User Profile Builder, a WordPress plugin with more than 40,000 active installations. This vulnerability makes it possible for unauthenticated attackers to log in as the user with ID 1, which is typically th...
WordPress Essential Real Estate plugin <= 5.3.3 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Steven Julian in WordPress Plugin Essential Real Estate versions = 5.3.3...
WordPress Theme Test Drive plugin <= 2.9.1 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by Steven Julian in WordPress Plugin Theme Test Drive versions = 2.9.1...
WordPress Vavo Core plugin <= 2.3.0 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Vavo Core versions = 2.3.0...
WordPress WP Sort Order plugin <= 1.3.5 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by hhhai in WordPress Plugin WP Sort Order versions = 1.3.5...
WordPress User Registration plugin <= 5.2.6 - Broken Authentication vulnerability
Broken Authentication vulnerability discovered by DmTomHe in WordPress Plugin User Registration versions = 5.2.6...
WordPress Site Reviews plugin <= 8.2.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Jorgson in WordPress Plugin Site Reviews versions = 8.2.0...