6070 matches found
CVE-2026-77788 Rank Math SEO < 1.0.277 - Author+ Arbitrary Post and User Metadata Overwrite via updateSchemas
The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the metadata row being updated belongs to the object the user was authorised against, allowing users with the Author role and above to overwrite arbitrary post and user metadata, including that belonging to higher-privileged...
WordPress Rank Math SEO plugin < 1.0.277 - Author+ Arbitrary Post and User Metadata Overwrite vulnerability
Author+ Arbitrary Post and User Metadata Overwrite vulnerability discovered by Usama Arshad in WordPress Plugin Rank Math SEO versions 1.0.277...
CVE-2026-77784
Rank Math SEO (WordPress plugin) versions before 1.0.277 suffer from an authorization bypass in the mark_page_as function: the plugin does not verify that the requesting user is permitted to edit the target object before updating its SEO indexing metadata (Robots and Pillar Content settings). An ...
CVE-2025-15664
The Ultimate Before After Image Slider & Gallery (BEAF) WordPress plugin versions before 4.7.19 are affected by an Author+ Stored XSS . The root cause is that the slider's before-label value is not properly escaped before the plugin's bundled client-side script re-injects it into the DOM. An atta...
EUVD-2025-210822
The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's before-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser ...
CVE-2025-15664 BEAF < 4.7.19 - Author+ Stored XSS via Before Label
The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's before-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser ...
WordPress Ultimate Before After Image Slider & Gallery plugin < 4.7.19 - Author+ Stored XSS vulnerability
Author+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin BEAF versions 4.7.19...
CVE-2025-15663
The Ultimate Before After Image Slider & Gallery (BEAF) WordPress plugin, in versions before 4.7.19 , suffers from a Stored XSS due to improper escaping of the slider's after-label value before the bundled client-side script re-injects it into the DOM. Users with the Author role or above can stor...
CVE-2025-15663 BEAF < 4.7.19 - Author+ Stored XSS via After Label
The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's after-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser o...
EUVD-2025-210823
The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's after-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser o...
WordPress Ultimate Before After Image Slider & Gallery plugin < 4.7.19 - Author+ Stored XSS vulnerability
Author+ Stored XSS vulnerability discovered by Krugov Artyom in WordPress Plugin BEAF versions 4.7.19...
PT-2026-84620
The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the requesting user is permitted to read the specific post referenced in a request before returning its content and SEO metadata, allowing users with the Author role and above to read the title, body and metadata of other user...
CVE-2018-18694
creationtimestamp| type| source ---|---|--- 2026-09-01 20:02:12+00:00| seen| https://t.me/hackingAttack/29057 2026-09-01 20:02:15+00:00| seen| https://t.me/hackingAttack/27123 2026-09-01 20:02:17+00:00| seen| https://t.me/hackingAttack/27117 2026-09-01 20:02:17+00:00| seen|...
CVE-2026-18488
The Blocksy Companion WordPress plugin (versions up to and including 2.1.51 ) is vulnerable to authenticated Stored XSS via the tagName block attribute in the blocksy/dynamic-data block, caused by insufficient input sanitization and output escaping. Attackers with Author-level access or higher ca...
EUVD-2026-68987
The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tagName' Block Attribute blocksy/dynamic-data in all versions up to, and including, 2.1.51 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...
WordPress Blocksy Companion plugin <= 2.1.51 - Authenticated (Author+) Stored Cross-Site Scripting via 'tagName' Block Attribute (blocksy/dynamic-data) vulnerability
Authenticated Author+ Stored Cross-Site Scripting via 'tagName' Block Attribute blocksy/dynamic-data vulnerability discovered by haofanjiukunle in WordPress Plugin Blocksy Companion versions = 2.1.51...
CVE-2026-81757
Author Remote Code Execution RCE in Rank Math SEO = 1.0.276 versions...
CVE-2026-81757
CVE-2026-81757 is a Remote Code Execution (RCE) vulnerability in the Rank Math SEO WordPress plugin, affecting versions ≤ 1.0.276 . The flaw is exploitable by users with Author -level permissions, meaning a low-privilege authenticated user can escalate to full code execution on the server. The CV...