88753 matches found
CVE-2026-66454
Unauthenticated Broken Access Control in WP Social Avatar = 1.5 versions...
CVE-2026-66443
Unauthenticated Sensitive Data Exposure in REST API Log = 1.7.1 versions...
CVE-2026-66441
Unauthenticated Broken Access Control in MultiVendorX = 5.0.10 versions...
CVE-2026-66444
Subscriber Sensitive Data Exposure in Payment Forms for Paystack = 4.0.5 versions...
CVE-2026-65582
Subscriber Arbitrary File Download in AI Hub = 1.3.10 versions...
CVE-2026-66429
Unauthenticated Cross Site Scripting XSS in Visitor Traffic Real Time Statistics Pro = 11.10 versions...
CVE-2026-66430
Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro = 11.10 versions...
CVE-2026-28189
Unauthenticated Arbitrary File Deletion in Participants Database = 2.7.8.4 versions...
CVE-2026-28186
Subscriber Broken Access Control in Travelfic Toolkit = 1.5.1 versions...
CVE-2026-28174
Customer Sensitive Data Exposure in WP Event SOlution = 4.1.18 versions...
CVE-2026-28175
Unauthenticated Cross Site Scripting XSS in Visitors Traffic Real Time Statistics = 8.11 versions...
CVE-2026-28149
Unauthenticated PHP Object Injection in Headless Single Sign On = 1.6 versions...
CVE-2026-28159
Subscriber Broken Access Control in Service Finder Booking = 6.2 versions...
CVE-2026-28003
Unauthenticated Cross Site Scripting XSS in Maspik – Spam blacklist = 2.9.1 versions...
CVE-2026-27999
Subscriber Broken Access Control in Tourfic = 2.23.1 versions...
CVE-2026-27543
Unauthenticated Privilege Escalation in MStore API = 4.20.0 versions...
CVE-2026-27538
Unauthenticated SQL Injection in WP Directory Kit = 1.5.4 versions...
CVE-2026-27380
Editor PHP Object Injection in Car Rental Manager = 1.3.9 versions...
CVE-2026-28002
CVE-2026-28002 affects the WordPress Booktics plugin up to version 1.0.22. The issue is an SQL Injection (blind) caused by improper neutralization of special elements in SQL commands, enabling potential unauthorized data access. No exploitation details or patches are provided in the documents; re...
