125708 matches found
CVE-2026-18062
The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Identity Block Inner Image Content in all versions up to, and including, 3.7.8.1 due to insufficient input sanitization and output escaping. This makes it possible...
CVE-2026-17605
The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.56 via the getpaidpaymentformelement function. This makes it possible for authenticated attackers, with administrator-level acces...
CVE-2026-17580
The Advanced Views – Display Custom Fields ACF, Pods, MetaBox, Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.1 via the registerrestroutes. This makes it...
CVE-2026-16685
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'icon' Shortcode Attribute in all versions up to, and including, 3.3.66 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...
CVE-2026-15649
The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wit...
CVE-2026-15450
The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in versions up to, and including, 9.2.3. This is due to the deletefile AJAX handler retrieving a file path from the database and passing it directly to unlink with no...
CVE-2026-15601
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Path Traversal Zip Slip in all versions up to, and including, 6.0.13 via the extractzipfile function. This makes it possible for authenticated attackers, with custom-level access and above, to...
CVE-2026-15662
The Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bgcolor' parameter in all versions up to, and including, 2.48 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-16635
The Pronamic Pay plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.1.0 This is due to the maybeupdateuserrole function passing an attacker-controlled Gravity Forms field value $lead$feed-userrolefieldid directly into WPUser::setrole without any...
CVE-2026-16635 Pronamic Pay <= 10.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms 'Update user role' Field
The Pronamic Pay plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.1.0 This is due to the maybeupdateuserrole function passing an attacker-controlled Gravity Forms field value $lead$feed-userrolefieldid directly into WPUser::setrole without any...
CVE-2026-16635
The CVE concerns the Pronamic Pay plugin for WordPress (up to version 10.1.0). The vulnerability lies in the maybe_update_user_role() function, which passes an attacker-controlled Gravity Forms field value ($lead[$feed->user_role_field_id]) directly into WP_User::set_role() without allowlist v...
CVE-2026-15644 Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute
The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
CVE-2026-15644
The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
EUVD-2026-51793
The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
EUVD-2026-51792
The CubeWP Framework plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 1.1.30. This is due to insufficient input sanitization in the cubewpremoverelation AJAX function, specifically the use of wpunslash on the relationid parameter before interpolating it...
CVE-2026-15644
The CVE concerns the Powerkit WordPress plugin (Powerkit – Supercharge your WordPress Site) with a Stored Cross-Site Scripting vulnerability via the 'style' shortcode attribute. Affects all versions up to 3.1.0 due to insufficient input sanitization and output escaping. Exploitation is possible b...
CVE-2026-6453
The CVE-2026-6453 issue affects the CubeWP Framework WordPress plugin (all versions ≤ 1.1.30). The root cause is insufficient input sanitization in cubewp_remove_relation() where wp_unslash() is applied to the relation_id parameter and then interpolated directly into a raw SQL query without using...
CVE-2026-6453
The CubeWP Framework plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 1.1.30. This is due to insufficient input sanitization in the cubewpremoverelation AJAX function, specifically the use of wpunslash on the relationid parameter before interpolating it...
CVE-2026-6453 CubeWP Framework <= 1.1.30 - Authenticated (Subscriber+) SQL Injection via 'relation_id' Parameter
The CubeWP Framework plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 1.1.30. This is due to insufficient input sanitization in the cubewpremoverelation AJAX function, specifically the use of wpunslash on the relationid parameter before interpolating it...
CVE-2026-17555
WPvivid Backup & Migration for WordPress contains an SQL Injection in the export_data path, fixed in or prior to version 0.9.131. The root cause is insufficient escaping and lack of prepared statements: user-supplied data is parsed in prepare_export_post(), sanitized, JSON-decoded, and then attac...