Lucene search
+L

1375029 matches found

NVD
NVD
added 1 hour ago3 views

CVE-2026-16145

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action' parameter in all versions up to, and including, 5.1 due to insufficient input sanitization and output escaping. This makes it possible for...

7.2CVSS
SaveExploits0References5
NVD
NVD
added 1 hour ago3 views

CVE-2026-16586

The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cgmultiplefilesforpost' - 'cgRealId' in all versions up to, and including, 30.0.7 due to insufficient escaping ...

6.5CVSS
SaveExploits0References12
NVD
NVD
added 1 hour ago3 views

CVE-2026-15948

The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'firstname' parameter in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for...

6.4CVSS
SaveExploits0References5
NVD
NVD
added 1 hour ago3 views

CVE-2026-13360

The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'regionArray' parameter in all versions up to, and including, 4.3.5 due to insufficient input sanitization and output escaping. This makes it possible for...

7.2CVSS
SaveExploits0References8
GithubExploit
GithubExploit
added 1 hour ago4 views

GPEWebDefender

GPEWebDefender A web-attack monitor. It sits next to ngin...

6AI score
SaveExploits0
Cvelist
Cvelist
added 1 hour ago4 views

CVE-2026-16145 Invisible Anti-Spam & CAPTCHA <= 5.1 - Unauthenticated Stored Cross-Site Scripting via 'action' Parameter

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action' parameter in all versions up to, and including, 5.1 due to insufficient input sanitization and output escaping. This makes it possible for...

7.2CVSS
SaveExploits0References5
EUVD
EUVD
added 1 hour ago4 views

EUVD-2026-58863

The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'regionArray' parameter in all versions up to, and including, 4.3.5 due to insufficient input sanitization and output escaping. This makes it possible for...

7.2CVSS5.5AI score
SaveExploits0References8
Cvelist
Cvelist
added 1 hour ago4 views

CVE-2026-13360 Cookie Banner for GDPR / CCPA <= 4.3.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'regionArray' Parameter

The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'regionArray' parameter in all versions up to, and including, 4.3.5 due to insufficient input sanitization and output escaping. This makes it possible for...

7.2CVSS
SaveExploits0References8
EUVD
EUVD
added 1 hour ago4 views

EUVD-2026-58864

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action' parameter in all versions up to, and including, 5.1 due to insufficient input sanitization and output escaping. This makes it possible for...

7.2CVSS5.6AI score
SaveExploits0References5
Cvelist
Cvelist
added 1 hour ago5 views

CVE-2026-15948 Hydra Booking <= 1.2.2 - Authenticated (Host+) Stored Cross-Site Scripting via 'first_name' Parameter

The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'firstname' parameter in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for...

6.4CVSS
SaveExploits0References5
EUVD
EUVD
added 1 hour ago4 views

EUVD-2026-58861

The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'firstname' parameter in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for...

6.4CVSS5.6AI score
SaveExploits0References5
Cvelist
Cvelist
added 1 hour ago5 views

CVE-2026-16586 Contest Gallery <= 30.0.6 - Authenticated (Author+) Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cg_multiple_files_for_post' -> 'cgRealId'

The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cgmultiplefilesforpost' - 'cgRealId' in all versions up to, and including, 30.0.7 due to insufficient escaping ...

6.5CVSS
SaveExploits0References12
EUVD
EUVD
added 1 hour ago4 views

EUVD-2026-58858

The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cgmultiplefilesforpost' - 'cgRealId' in all versions up to, and including, 30.0.7 due to insufficient escaping ...

6.5CVSS5.9AI score
SaveExploits0References12
NVD
NVD
added 2 hours ago2 views

CVE-2026-8840

The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.36. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated...

5.3CVSS
SaveExploits0References9
GithubExploit
GithubExploit
added 2 hours ago4 views

Exploit for CVE-2026-13610

CVE-2026-13610 — KiviCare – Clinic & Patient Management System...

5.4AI score0.00149EPSS
SaveExploits1
EUVD
EUVD
added 2 hours ago7 views

EUVD-2026-58839

The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.36. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated...

5.3CVSS5.4AI score
SaveExploits0References9
Cvelist
Cvelist
added 2 hours ago8 views

CVE-2026-8840 Booking calendar, Appointment Booking System <= 3.2.36 - Missing Authorization to Unauthenticated Arbitrary Modification via wpdevart_payment AJAX Action

The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.36. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated...

5.3CVSS
SaveExploits0References9
Fedora
Fedora
added 4 hours ago3 views

[SECURITY] Fedora 43 Update: chromium-151.0.7922.137-1.fc43

Chromium is an open-source web browser, powered by WebKit Blink...

8.8CVSS5.2AI score0.00344EPSS
SaveExploits0
Fedora
Fedora
added 4 hours ago3 views

[SECURITY] Fedora 43 Update: pdns-5.0.7-1.fc43

The PowerDNS Nameserver is a modern, advanced and high performance authoritative-only name server. It is written from scratch and conforms to all relevant DNS standards documents. Furthermore, PowerDNS interfaces with almost any database...

5.4AI score
SaveExploits0
Fedora
Fedora
added 4 hours ago3 views

[SECURITY] Fedora 43 Update: php-pear-PHP-CodeSniffer-4.0.4-1.fc43

PHPCodeSniffer provides functionality to verify that code conforms to certain standards, such as PEAR, or user-defined...

5.5AI score
SaveExploits0
Rows per page
Query Builder