23842 matches found
CVE-2026-94538 WP File Download <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion/Modification via 'task' Parameter to Multiple Functions
The WP File Download plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.3.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...
CVE-2026-94538
The WP File Download plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.3.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...
CVE-2026-15178
The Fluent Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.2.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Custom-level access an...
CVE-2026-15178 Fluent Forms <= 6.2.5 - Missing Authorization to Authenticated (Custom+) Sensitive Data Exposure and Modification
The Fluent Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.2.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Custom-level access an...
EUVD-2026-96122
The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform a per-object authorization check before deleting an attachment, allowing users with the Contributor role and above to permanently delete certain media attachments belonging to other users, including administrators...
EUVD-2026-96091
The AI Puffer – Chat. Create. Automate. formerly AI Power plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.4.89. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
EUVD-2026-96051
The Avada Fusion Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16.1. This is due to the plugin not properly verifying authorization before dispatching a WordPress action hook whose name is taken from an attacker-supplied form-field valu...
EUVD-2026-96089
The AI Puffer – Chat. Create. Automate. formerly AI Power plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.4.89. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
EUVD-2026-96058
The Hello Plus plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Contributor-level access...
CVE-2026-105976
The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform proper authorization checks in a set of AJAX actions, allowing users with at least the Contributor role to read, modify and delete other users' galleries as well as site-wide gallery filters...
CVE-2026-104741
The AI Puffer – Chat. Create. Automate. formerly AI Power plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.4.89. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
CVE-2026-104742 AI Puffer <= 2.4.89 - Missing Authorization to Authenticated (Subscriber+) Semantic Search Settings Modification via ajax_save_semantic_search_settings AJAX action
The AI Puffer – Chat. Create. Automate. formerly AI Power plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.4.89. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
CVE-2026-104742
The AI Puffer (formerly AI Power) plugin for WordPress is vulnerable to an authorization bypass in versions up to and including 2.4.89 . The root cause is the plugin's failure to properly verify user permissions during the ajax_save_semantic_search_settings AJAX action. This allows authenticated ...
CVE-2026-104741 AI Puffer <= 2.4.89 - Missing Authorization to Authenticated (Subscriber+) Global Plugin Settings Modification via ajax_save_cpt_indexing_options AJAX Endpoint
The AI Puffer – Chat. Create. Automate. formerly AI Power plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.4.89. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
CVE-2026-104741
The AI Puffer (formerly AI Power) plugin for WordPress is vulnerable to an authorization bypass in all versions up to and including 2.4.89 . The root cause is the plugin's failure to properly verify user permissions when accessing the ajax_save_cpt_indexing_options AJAX endpoint. This allows auth...
CVE-2026-97670
The Avada (Fusion) Builder plugin for WordPress (versions
CVE-2026-5727
The Hello Plus plugin for WordPress is vulnerable to an authorization bypass in versions up to and including 1.7.7 . The root cause is the plugin's failure to properly verify user permissions when performing certain actions. This allows authenticated attackers with Contributor-level access (or hi...
My-CVEs
Una lista de vulnerabilidades que encontré. Algunas vulnerabilidades incluyen análisis técnicos detallados, exploits o incluso tutoriales de sesiones de fuzzing. Algunas vulnerabilidades no tienen CVE porque los mantenedores me ignoraron, o porque un mantenedor no estuvo de acuerdo en que fuera u...
Forklift_LPE
Escalada de Privilegios Local en Forklift 3.3.9 Al instalar Forklift, un nuevo helper llamado com.binarynights.ForkLiftHelper para Mac OS X se instala automáticamente en el directorio /Library/PrivilegedHelperTools/. El análisis de este helper, que maneja mensajes XPC, dio como resultado diferent...