1038 matches found
CVE-2025-8574
The Database Cleaner plugin for WordPress is vulnerable to arbitrary table deletion in all versions up to, and including, 1.4.7. This is due to a lack of restriction on database tables that can be deleted. This makes it possible for authenticated attackers, with Administrator-level access and...
EUVD-2025-211228
The Database Cleaner plugin for WordPress is vulnerable to arbitrary table deletion in all versions up to, and including, 1.4.7. This is due to a lack of restriction on database tables that can be deleted. This makes it possible for authenticated attackers, with Administrator-level access and...
CVE-2025-8574 Database Cleaner <= 1.4.7 - Authenticated (Administrator+) Arbitrary Table Deletion
The Database Cleaner plugin for WordPress is vulnerable to arbitrary table deletion in all versions up to, and including, 1.4.7. This is due to a lack of restriction on database tables that can be deleted. This makes it possible for authenticated attackers, with Administrator-level access and...
CVE-2025-8574
The Database Cleaner plugin for WordPress is vulnerable to arbitrary table deletion in all versions up to and including 1.4.7 . The root cause is a lack of restriction on which database tables can be deleted. This allows authenticated attackers with Administrator-level access and above to delete ...
CVE-2026-110732
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.8.6 This is due to the MCP module's OAuth 2.1 Dynamic Client Registration endpoint /wp-json/mcp/v1/oauth/register being registered with...
EUVD-2026-113739
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.8.6 This is due to the MCP module's OAuth 2.1 Dynamic Client Registration endpoint /wp-json/mcp/v1/oauth/register being registered with...
CVE-2025-8574: tigroumeow: The Database Cleaner plugin for WordPress is vulnerable to arbitrary table deletion in all versions up to, and…
The Database Cleaner plugin for WordPress is vulnerable to arbitrary table deletion in all versions up to, and including, 1.4.7. This is due to a lack of restriction on database tables that can be deleted. This makes it possible for authenticated attackers, with Administrator-level access and...
CVE-2026-110268
The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.2 via the 'themeslug' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to perform actions on files outsid...
CVE-2026-110268 Post Export Import with Media <= 1.17.2 - Authenticated (Administrator+) Path Traversal via 'theme_slug' Parameter
The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.2 via the 'themeslug' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to perform actions on files outsid...
CVE-2026-110268 Post Export Import with Media <= 1.17.2 - Authenticated (Administrator+) Path Traversal via 'theme_slug' Parameter
The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.2 via the 'themeslug' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to perform actions on files outsid...
CVE-2026-110268
The Post Export Import with Media plugin for WordPress is vulnerable to a Directory Traversal (CWE-22) vulnerability in all versions up to and including 1.17.2 . The flaw exists in the 'theme_slug' parameter, allowing authenticated attackers with administrator-level access or higher to access or ...
EUVD-2026-103219
The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.2 via the 'themeslug' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to perform actions on files outsid...
PT-2026-116360
Name of the Vulnerable Software and Affected Versions Post Export Import with Media versions prior to 1.17.3 Description The Post Export Import with Media plugin for WordPress contains a Directory Traversal flaw. This issue allows authenticated users with administrator-level access or higher to...
CVE-2026-110268: Improper Limitation of a Pathname to a Restricted Directory
The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.2 via the 'themeslug' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to perform actions on files outsid...
CVE-2026-111178
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to generic SQL Injection via the 'dataorderby' parameter in all versions up to, and including, 2.1.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...
EUVD-2026-102800
The WP Mail Logging plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.17.0 via the 'emailaddress' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to extract complete logged mail ro...
CVE-2026-109401
The WP Mail Logging plugin for WordPress (versions up to and including 1.17.0 ) is vulnerable to Sensitive Information Exposure due to a LIKE wildcard flaw in the email_address parameter. An authenticated attacker with administrator-level access or higher can exploit this by initiating a personal...
CVE-2026-111178 WP Booking System <= 2.1.0.1 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to generic SQL Injection via the 'dataorderby' parameter in all versions up to, and including, 2.1.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...
CVE-2026-111178
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 2.1.0.1 . The root cause is insufficient escaping and lack of proper preparation on the user-supplied 'data[orderby]' parameter. This allows authenticated attackers wit...
CVE-2026-111178 WP Booking System <= 2.1.0.1 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to generic SQL Injection via the 'dataorderby' parameter in all versions up to, and including, 2.1.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...