604601 matches found
EUVD-2026-63301
Subscriber Broken Access Control in Homlisti = 3.1.2 versions...
CVE-2026-66647 WordPress Homlisti theme <= 3.1.2 - Broken Access Control vulnerability
Subscriber Broken Access Control in Homlisti = 3.1.2 versions...
CVE-2026-66616 WordPress Form Maker by 10Web plugin <= 1.15.46 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Form Maker by 10Web = 1.15.46 versions...
CVE-2026-66607 WordPress Advance Product Search plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Advance Product Search = 1.4.8 versions...
EUVD-2026-63343
Unauthenticated Cross Site Scripting XSS in GeoDirectory = 2.8.173 versions...
CVE-2026-66601
Subscriber-level authenticated users can inject arbitrary JavaScript into the Media Library Assistant plugin (≤3.39) admin interface, enabling session hijacking or data theft. CVSS 6.5 (MEDIUM). Update to version 3.40 or later; no in-the-wild exploitation reported. See: https://patchstack.com/dat...
CVE-2026-66595 WordPress WP Data Access plugin <= 5.5.80 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in WP Data Access = 5.5.80 versions...
EUVD-2026-63338
Unauthenticated Broken Access Control in WP Data Access = 5.5.80 versions...
CVE-2026-66595
The WordPress WP Data Access plugin (versions ≤ 5.5.80) has an unauthenticated broken access control flaw allowing remote, no-auth access to restricted functionality with HIGH confidentiality impact (CVSS 5.9). No patch version or exploitation details are provided; monitor Patchstack's advisory f...
CVE-2026-66593
CVE-2026-66593 is an unauthenticated SQL injection vulnerability in the WordPress plugin Security & Malware scan by CleanTalk , affecting versions ≤ 2.184 . The flaw allows a remote attacker to execute arbitrary SQL queries without authentication, leading to high confidentiality impact and low av...
CVE-2026-66592 WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.11 - SQL Injection vulnerability
Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress = 4.7.11 versions...
CVE-2026-66583 WordPress Forminator plugin <= 1.57.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Forminator = 1.57.0 versions...
CVE-2025-53999 WordPress Altair theme <= 5.2.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Altair = 5.2.2 versions...
CVE-2025-53999
The WordPress Altair theme (versions up to 5.2.2) has an unauthenticated broken access control flaw (CVSS 6.5, medium), exploitable remotely without credentials. An attacker can alter or disrupt functionality (low integrity/availability impact) but cannot read sensitive data. No fix version or ex...
EUVD-2025-210757
Unauthenticated Broken Access Control in Altair = 5.2.2 versions...
CVE-2025-15688 WordPress Capella theme <= 2.5.5 - SQL Injection vulnerability
Unauthenticated SQL Injection in Capella = 2.5.5 versions...
EUVD-2025-210756
Unauthenticated Privilege Escalation in Capella = 2.5.5 versions...
CVE-2025-15689
The WordPress Capella theme (≤2.5.5) allows unauthenticated remote privilege escalation with no user interaction, rated CVSS 9.8 critical. No root cause, patch version, or exploit details are provided in the documents; see the Patchstack advisory for further information. Exploitation status is no...