Lucene search
+L

589670 matches found

EUVD
EUVD
added 4 days ago8 views

EUVD-2026-53728

The EONSR AEO Agent WordPress plugin through 3.7.9 does not perform any authorisation check on one of its REST API routes and disables HTML sanitisation before saving the post, allowing unauthenticated attackers to create administrator-attributed published posts containing arbitrary web scripts...

6.1CVSS5.8AI score0.00162EPSS
SaveExploits0References1
Cvelist
Cvelist
added 4 days ago32 views

CVE-2026-11588 EONSR AEO Agent <= 3.7.9 - Unauthenticated Stored XSS via Scheduled Post Creation

The EONSR AEO Agent WordPress plugin through 3.7.9 does not perform any authorisation check on one of its REST API routes and disables HTML sanitisation before saving the post, allowing unauthenticated attackers to create administrator-attributed published posts containing arbitrary web scripts...

0.00162EPSS
SaveExploits0References1
Cvelist
Cvelist
added 4 days ago31 views

CVE-2026-14829 Checkimate <= 1.0.13 - Unauthenticated License Deactivation via Hardcoded Secret

The Checkimate — WooCommerce Checkout, Abandoned Cart Recovery & Order Bumps WordPress plugin through 1.0.13 does not properly restrict access to its license-management functionality, relying on a shared secret computed entirely from publicly available information, allowing unauthenticated...

0.00193EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 4 days ago8 views

CVE-2026-16537

The Slick Slider WordPress plugin before 0.5.3 does not sanitize and escape a shortcode attribute value before outputting it in an HTML attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute when a user views the affected post...

5.4CVSS5.6AI score0.00133EPSS
SaveExploits0References1
CVE
CVE
added 4 days ago37 views

CVE-2026-11588

The CVE-2026-11588 entry concerns the EONSR AEO Agent WordPress plugin up to version 3.7.9. The issue arises because there is no authorization check on a REST API route and HTML sanitisation is disabled before saving a post, enabling unauthenticated attackers to create administrator-attributed pu...

6.1CVSS5.8AI score0.00162EPSS
SaveExploits0References1
EUVD
EUVD
added 4 days ago7 views

EUVD-2026-53729

The Checkimate — WooCommerce Checkout, Abandoned Cart Recovery & Order Bumps WordPress plugin through 1.0.13 does not properly restrict access to its license-management functionality, relying on a shared secret computed entirely from publicly available information, allowing unauthenticated...

8.2CVSS5.5AI score0.00193EPSS
SaveExploits0References1
CVE
CVE
added 4 days ago40 views

CVE-2026-14829

The CVE concerns the Checkimate — WooCommerce Checkout, Abandoned Cart Recovery & Order Bumps WordPress plugin (

8.2CVSS5.5AI score0.00193EPSS
SaveExploits0References1
OSV
OSV
added 4 days ago5 views

CVE-2026-19006 mf-yang openclaw-cn Ggateway Exec Approval Flow bash-tools.exec.ts authorization

A vulnerability was found in mf-yang openclaw-cn 2026.2.5. This affects an unknown part of the file src/agents/bash-tools.exec.ts of the component Ggateway Exec Approval Flow. The manipulation results in incorrect authorization. The attack may be performed from remote. The exploit has been made...

5.3CVSS5AI score
SaveExploits0References8
Cvelist
Cvelist
added 4 days ago36 views

CVE-2026-18050 Events Manager < 7.4 - Unauthenticated Pending Upload Disclosure via events-manager/v1/uploads

The Events Manager WordPress plugin before 7.4 does not perform any authorization check on a REST route that serves temporarily stored file uploads, allowing unauthenticated users to retrieve another user's in-progress upload when its temporary identifier is known. The identifier is high-entropy,...

0.00256EPSS
SaveExploits0References1
EUVD
EUVD
added 4 days ago8 views

EUVD-2026-53725

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.2 does not verify that the caller owns the Stripe payment intent referenced by two unauthenticated payment-form AJAX actions, allowing an unauthenticated visitor — using a nonce that is embedded in every public page containing a...

7.5CVSS5.5AI score0.00202EPSS
SaveExploits0References1
EUVD
EUVD
added 4 days ago8 views

EUVD-2026-53727

The Events Manager WordPress plugin before 7.4 does not perform any authorization check on a REST route that serves temporarily stored file uploads, allowing unauthenticated users to retrieve another user's in-progress upload when its temporary identifier is known. The identifier is high-entropy,...

7.5CVSS5.4AI score0.00256EPSS
SaveExploits0References1
CVE
CVE
added 4 days ago40 views

CVE-2026-18050

CVE-2026-18050 affects the WordPress plugin Events Manager up to version 7.3. It describes an unauthenticated disclosure vulnerability on a REST route that serves temporarily stored file uploads, where an attacker can retrieve another user’s in-progress upload if they know the temporary identifie...

7.5CVSS5.4AI score0.00256EPSS
SaveExploits0References1
Cvelist
Cvelist
added 4 days ago31 views

CVE-2026-16268 Newsletters < 4.16 - Unauthenticated Server-Side Request Forgery via SNS Bounce Handler

The Newsletters WordPress plugin before 4.16 does not authenticate or validate a bounce-processing request before fetching a user-supplied URL on the server side, allowing unauthenticated attackers to make the site issue requests to arbitrary internal or external hosts...

0.00193EPSS
SaveExploits0References1
Cvelist
Cvelist
added 4 days ago32 views

CVE-2026-14240 Tourmaster < 5.4.9 - Unauthenticated Sensitive Data Disclosure via Order Export

The tourmaster WordPress plugin before 5.4.9 writes its order/booking export to a fixed, predictable file inside its publicly accessible directory with no access control, allowing unauthenticated users to download the exported customers' personal information once an administrator has run an expor...

0.00206EPSS
SaveExploits0References1
Cvelist
Cvelist
added 4 days ago31 views

CVE-2026-14547 Estatik Real Estate Plugin < 4.3.3 - Unauthenticated Arbitrary-Recipient Mail Relay via Request Form

The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not properly enforce its anti-spam check or restrict the recipient routing of its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To, effectively...

0.00182EPSS
SaveExploits0References1
EUVD
EUVD
added 4 days ago7 views

EUVD-2026-53720

The tourmaster WordPress plugin before 5.4.9 writes its order/booking export to a fixed, predictable file inside its publicly accessible directory with no access control, allowing unauthenticated users to download the exported customers' personal information once an administrator has run an expor...

5.3CVSS5.5AI score0.00206EPSS
SaveExploits0References1
EUVD
EUVD
added 4 days ago7 views

EUVD-2026-53724

The ProfileGrid WordPress plugin before 6.0.0.0 does not perform authorization checks before returning a group's member list, and registers the handler for unauthenticated users, allowing any unauthenticated visitor to disclose the members and their identifiers of any group, including private or...

5.3CVSS5.5AI score0.0021EPSS
SaveExploits0References1
EUVD
EUVD
added 4 days ago7 views

EUVD-2026-53723

The Newsletters WordPress plugin before 4.16 does not authenticate or validate a bounce-processing request before fetching a user-supplied URL on the server side, allowing unauthenticated attackers to make the site issue requests to arbitrary internal or external hosts...

8.2CVSS5.5AI score0.00193EPSS
SaveExploits0References1
CVE
CVE
added 4 days ago32 views

CVE-2026-16054

CVE-2026-16054 affects the Drag and Drop Multiple File Upload for WooCommerce WordPress plugin prior to 1.1.8. The issue permits unauthenticated users to obtain a valid nonce that gates the plugin’s file-deletion routine, enabling anonymous attackers to delete files staged in the upload directory...

9.1CVSS5.5AI score0.00274EPSS
SaveExploits0References1
CVE
CVE
added 4 days ago38 views

CVE-2026-16290

ProfileGrid WordPress plugin prior to version 6.0.0.0 exposes a group member list without proper authorization checks. The vulnerability allows any unauthenticated visitor to disclose members and their identifiers for any group, including private/closed ones, by registering the handler for unauth...

5.3CVSS5.5AI score0.0021EPSS
SaveExploits0References1
Rows per page
Query Builder