90304 matches found
WordPress UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin <= 1.2.69 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability
Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Jonah Burgess CryptoCat in WordPress Plugin UsersWP versions = 1.2.69...
WordPress TrueBooker – Appointment Booking and Scheduler System plugin <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset vulnerability
Missing Authorization to Unauthenticated Arbitrary Password Reset vulnerability discovered by thevietronin in WordPress Plugin TrueBooker versions = 1.2.3...
CVE-2026-14548
The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to overwrite the administrator-configured translation API token with an arbitrary value...
CVE-2026-14548
The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to overwrite the administrator-configured translation API token with an arbitrary value...
CVE-2026-16974
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the postmeta Shortcode in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for...
EUVD-2026-55934
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the postmeta Shortcode in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-16974
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the postmeta Shortcode in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for...
PT-2026-70056
Name of the Vulnerable Software and Affected Versions Kirki – Freeform Page Builder, Website Builder & Customizer versions prior to 6.2.1 Description Insufficient input sanitization and output escaping in the post meta Shortcode allow authenticated attackers with Contributor-level access or highe...
Planyo Online Reservation System 3.0 SSRF / Arbitrary File Read
Planyo Online Reservation System versions 3.0 and below suffer from an arbitrary file read vulnerability that is leveraged by a server-side request forgery flaw. Exploit Title: PlanyoOnlineReservationSystem 3.0 - Arbitrary File Read via SSRF Date: 12-07-2026 Exploit Author: Balachandar Gowrisanka...
PT-2026-70886
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6 via the top-level script function. This is due to the plugin stores its encrypted options file as options-migrate key.txt in...
PT-2026-70888
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete revision function in all versions up to, and including, 2.8.169. This makes it possible for...
PT-2026-70887
The Formidable Digital Signatures plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the delete file function in all versions up to, and including, 3.0.6. This makes it possible for unauthenticated attackers to delete files on the server by supplying a...
Blocksy Companion 2.1.46 Shell Upload
Blocksy Companion version 2.1.46 suffers from an unauthenticated arbitrary file upload and double-extension bypass that allows for shell uploads. !/usr/bin/env python3 Exploit Title: Blocksy Companion 2.1.46 - RCE CVE: CVE-2026-58480 Date: 2026-07-13 Exploit Author: Mohammed Idrees Banyamer Autho...
CVE-2026-73033
Sucuri Security WordPress plugin through version 2.7.3 contains a path traversal vulnerability in the pageIntegritySubmission method in src/integrity.lib.php that allows authenticated administrators to delete arbitrary files by supplying directory traversal sequences in the sucuriscanintegrity...
EUVD-2026-55803
Sucuri Security WordPress plugin through version 2.7.3 contains a path traversal vulnerability in the pageIntegritySubmission method in src/integrity.lib.php that allows authenticated administrators to delete arbitrary files by supplying directory traversal sequences in the sucuriscanintegrity...
CVE-2026-73033 Sucuri WordPress Plugin 2.7.3 Path Traversal via integrity.lib.php
Sucuri Security WordPress plugin through version 2.7.3 contains a path traversal vulnerability in the pageIntegritySubmission method in src/integrity.lib.php that allows authenticated administrators to delete arbitrary files by supplying directory traversal sequences in the sucuriscanintegrity...
WordPress Kirki – Freeform Page Builder, Website Builder & Customizer plugin <= 6.2.0 - Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Freeform Page Builder, Website Builder & Customizer plugin = 6.2.0 - Freeform Page Builder, Website Builder & Customizer = 6.2.0 - Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Navapon Premkasem 71C4 71C4 in WordPress Plugin Kirki versions = 6.2.0...
WordPress Anti Spam and list cleaner – AcyChecker plugin <= 2.0.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by vnth4nhnt in WordPress Plugin Anti Spam and list cleaner AcyChecker versions = 2.0.0...
WordPress Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin <= 2.10.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Asim Alshaya in WordPress Plugin Colissimo Officiel : Méthodes de livraison pour WooCommerce versions = 2.10.0...