7745 matches found
EUVD-2026-82749
The WP Inventory Manager plugin for WordPress is vulnerable to SQL Injection via the 'where' shortcode attribute of the wpinventory shortcode in versions up to, and including, 2.5.1. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the...
EUVD-2026-82746
The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'vkExUnitctaimgposition' Post Meta in all versions up to, and including, 9.118.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...
CVE-2026-88994
The All Bootstrap Blocks WordPress plugin through 1.3.31 does not validate a block attribute before using it to build a filesystem path that is included at render time, allowing users with contributor-level access and above to include arbitrary local files, disclose their contents, and execute PH...
CVE-2026-84909
The Custom Twitter Feeds WordPress plugin (Tweets Widget / X Feed Widget) is vulnerable to Stored Cross-Site Scripting via the 'buttoncolor' shortcode attribute in all versions up to and including 2.8.0 , caused by insufficient input sanitization and output escaping . Authenticated attackers with...
EUVD-2026-82731
The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'buttoncolor' Shortcode Attribute in all versions up to, and including, 2.8.0 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-88993
The All Bootstrap Blocks WordPress plugin through 1.3.31 does not properly escape a block attribute before outputting it in HTML tag-name position, allowing users with Contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed...
CVE-2026-88994 All Bootstrap Blocks 1.3.20 - 1.3.31 - Contributor+ LFI via lightspeed Block Attributes
The All Bootstrap Blocks WordPress plugin through 1.3.31 does not validate a block attribute before using it to build a filesystem path that is included at render time, allowing users with contributor-level access and above to include arbitrary local files, disclose their contents, and execute PH...
EUVD-2026-82679
The All Bootstrap Blocks WordPress plugin through 1.3.31 does not properly escape a block attribute before outputting it in HTML tag-name position, allowing users with Contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed...
CVE-2026-88993
CVE-2026-88993 is a stored XSS vulnerability in the All Bootstrap Blocks WordPress plugin through version 1.3.31 . The root cause is improper escaping of a block attribute (identified as the areoi/button type attribute) before outputting it in an HTML tag-name position. Users with Contributor-lev...
EUVD-2026-82662
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform any capability, post-status, or password check before rendering the content of a user-supplied post, allowing users with Contributor-level access and above to read the content of private, draft, pending, and...
CVE-2026-84902
King Addons for Elementor (WordPress plugin) versions before 51.1.81 lack an object-level authorization check when importing template content into a page. Users with contributor-level access or higher can overwrite the Elementor content of arbitrary posts and pages —including those owned by admin...
CVE-2024-3293-Poc
CVE-2024-3293-Poc rtMedia для WordPress, BuddyPress и bbPress get \buddypress-media\app\helper\RTMediaModel.php:61 RTMediaModel-getmedia \buddypress-media\app\helper\RTMediaModel.php:227 RTMediaQuery-populatemedia \buddypress-media\app\main\routers\query\RTMediaQuery.php:869...
WordPress Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin <= 1.24.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by UKO in WordPress Plugin Popup Maker versions = 1.24.0...
WordPress Strong Testimonials plugin <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by pbsec in WordPress Plugin Strong Testimonials versions = 3.3.8...
CVE-2026-74000
Contributor Broken Access Control in Simple Membership = 4.8.2 versions...
CVE-2026-73999
Contributor Insecure Direct Object References IDOR in Cooked = 1.16.0 versions...
CVE-2026-66608
Contributor Server Side Request Forgery SSRF in Unlimited Elements For Elementor Free Widgets, Addons, Templates = 2.0.19 versions...
CVE-2026-66579
Contributor Cross Site Scripting XSS in JetElements For Elementor = 2.9.2.1 versions...