7738 matches found
CVE-2026-88993
The All Bootstrap Blocks WordPress plugin through 1.3.31 does not properly escape a block attribute before outputting it in HTML tag-name position, allowing users with Contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed...
CVE-2026-88994 All Bootstrap Blocks 1.3.20 - 1.3.31 - Contributor+ LFI via lightspeed Block Attributes
The All Bootstrap Blocks WordPress plugin through 1.3.31 does not validate a block attribute before using it to build a filesystem path that is included at render time, allowing users with contributor-level access and above to include arbitrary local files, disclose their contents, and execute PH...
EUVD-2026-82679
The All Bootstrap Blocks WordPress plugin through 1.3.31 does not properly escape a block attribute before outputting it in HTML tag-name position, allowing users with Contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed...
CVE-2026-88993
CVE-2026-88993 is a stored XSS vulnerability in the All Bootstrap Blocks WordPress plugin through version 1.3.31 . The root cause is improper escaping of a block attribute (identified as the areoi/button type attribute) before outputting it in an HTML tag-name position. Users with Contributor-lev...
EUVD-2026-82662
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform any capability, post-status, or password check before rendering the content of a user-supplied post, allowing users with Contributor-level access and above to read the content of private, draft, pending, and...
CVE-2026-84902
King Addons for Elementor (WordPress plugin) versions before 51.1.81 lack an object-level authorization check when importing template content into a page. Users with contributor-level access or higher can overwrite the Elementor content of arbitrary posts and pages —including those owned by admin...
CVE-2024-3293-Poc
CVE-2024-3293-Poc rtMedia for WordPress、BuddyPress 和 bbPress get \buddypress-media\app\helper\RTMediaModel.php:61 RTMediaModel-getmedia \buddypress-media\app\helper\RTMediaModel.php:227 RTMediaQuery-populatemedia \buddypress-media\app\main\routers\query\RTMediaQuery.php:869...
WordPress Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin <= 1.24.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by UKO in WordPress Plugin Popup Maker versions = 1.24.0...
WordPress Strong Testimonials plugin <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by pbsec in WordPress Plugin Strong Testimonials versions = 3.3.8...
CVE-2026-74000
Contributor Broken Access Control in Simple Membership = 4.8.2 versions...
CVE-2026-73999
Contributor Insecure Direct Object References IDOR in Cooked = 1.16.0 versions...
CVE-2026-66608
Contributor Server Side Request Forgery SSRF in Unlimited Elements For Elementor Free Widgets, Addons, Templates = 2.0.19 versions...
CVE-2026-66579
Contributor Cross Site Scripting XSS in JetElements For Elementor = 2.9.2.1 versions...
CVE-2026-66572
Contributor Cross Site Scripting XSS in JetBlog = 2.4.10 versions...
EUVD-2026-81503
Contributor Cross Site Scripting XSS in PublishPress Series = 3.1.3 versions...
CVE-2026-66617
A Contributor-level Cross Site Scripting (XSS) vulnerability affects the PublishPress Series WordPress plugin (aka "Organize Series") in versions
CVE-2026-66580 WordPress Product Feed Manager plugin <= 7.12.0 - SQL Injection vulnerability
Contributor SQL Injection in Product Feed Manager = 7.12.0 versions...
CVE-2026-66578
A Contributor-level Cross Site Scripting (XSS) vulnerability affects the PropertyHive WordPress plugin in versions 2.2.6 and earlier . A user with the Contributor role can inject arbitrary script that executes in another user's browser, with changed scope and low impact on confidentiality, integr...
CVE-2026-66577
CVE-2026-66577 is a Contributor Cross Site Scripting (XSS) vulnerability in the JetSearch WordPress plugin, affecting versions ≤ 3.6.3 . The vulnerability was discovered by nh4tvd and reported via Patchstack , which serves as the CNA. The CVSS 3.1 score is 6.5 (MEDIUM) , with a vector of AV:N/AC:...