Lucene search
+L

3256 matches found

CVE
CVE
•added 2026/09/18 7:39 a.m.•15 views

CVE-2026-17586

The VK All in One Expansion Unit WordPress plugin (versions up to and including 9.118.0 ) is vulnerable to Stored Cross-Site Scripting via the vkExUnit_cta_img_position post meta field. The root cause is insufficient input sanitization and output escaping: the sanitize_text_field callback on save...

6.4CVSS6AI score0.00307EPSS
SaveExploits0References10
Cvelist
Cvelist
•added 2026/09/18 7:39 a.m.•34 views

CVE-2026-17586 VK All in One Expansion Unit <= 9.118.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'vkExUnit_cta_img_position' Post Meta

The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'vkExUnitctaimgposition' Post Meta in all versions up to, and including, 9.118.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

6.4CVSS0.00307EPSS
SaveExploits0References10
NVD
NVD
•added 2026/09/18 6:16 a.m.•8 views

CVE-2026-84903

The King Addons for Elementor WordPress plugin before 51.1.81 does not perform any capability, post-status, or password check before rendering the content of a user-supplied post, allowing users with Contributor-level access and above to read the content of private, draft, pending, and...

2.7CVSS0.00316EPSS
SaveExploits0References1
CVE
CVE
•added 2026/09/18 6:11 a.m.•12 views

CVE-2026-88994

The All Bootstrap Blocks WordPress plugin (versions 1.3.20 through 1.3.31 ) contains a Local File Inclusion (LFI) vulnerability in its Lightspeed subsystem. A block attribute is used to build a filesystem path that is included at render time without validation, allowing users with contributor-lev...

6.6CVSS6AI score0.00386EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/18 6:11 a.m.•10 views

EUVD-2026-82687

The All Bootstrap Blocks WordPress plugin through 1.3.31 does not validate a block attribute before using it to build a filesystem path that is included at render time, allowing users with contributor-level access and above to include arbitrary local files, disclose their contents, and execute PH...

6.6CVSS6AI score0.00386EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/18 6:00 a.m.•8 views

EUVD-2026-82661

The King Addons for Elementor WordPress plugin before 51.1.81 does not perform an object-level authorization check when importing template content into a page, allowing users with contributor-level access and above to overwrite the Elementor content of arbitrary posts and pages, including those...

6.8CVSS5.9AI score0.00431EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/18 2:27 a.m.•18 views

EUVD-2026-82643

The RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'pointermenuitem' Block Attribute in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for...

6.4CVSS6AI score0.00212EPSS
SaveExploits0References4
EUVD
EUVD
•added 2026/09/18 12:31 a.m.•12 views

EUVD-2026-82607

The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘rootAttributes’ parameter in all versions up to, and including, 2.8.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

6.4CVSS6AI score0.00261EPSS
SaveExploits0References3
CVE
CVE
•added 2026/09/17 1:24 p.m.•19 views

CVE-2026-74000

CVE-2026-74000 affects the WordPress Simple Membership plugin in versions ≤ 4.8.2 . The vulnerability is a Broken Access Control flaw discovered by Ananda Dhakal (Patchstack). The CVSS 3.1 score is 5.3 (Medium) with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N , indicating a network-exploitable...

5.3CVSS5.7AI score0.00294EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/17 1:24 p.m.•10 views

EUVD-2026-81498

Contributor Cross Site Scripting XSS in JetSearch = 3.6.3 versions...

6.5CVSS5.7AI score0.00224EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/17 1:24 p.m.•7 views

EUVD-2026-81497

Contributor Cross Site Scripting XSS in JetBlocks For Elementor = 1.5.2 versions...

6.5CVSS5.7AI score0.00224EPSS
SaveExploits0References1
CVE
CVE
•added 2026/09/17 1:24 p.m.•18 views

CVE-2026-66576

CVE-2026-66576 is a Contributor-level Cross Site Scripting (XSS) vulnerability in the JetBlocks For Elementor WordPress plugin, affecting versions 1.5.2 and earlier . The flaw was discovered by nh4tvd (reported via Patchstack). The vulnerability carries a CVSS 3.1 base score of 6.5 (MEDIUM) with ...

6.5CVSS5.7AI score0.00224EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/17 6:00 a.m.•11 views

EUVD-2026-81358

The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Contributor-level access and above to read the site's PayPal and Stripe credentials, including their secret keys...

4.9CVSS5.8AI score0.00377EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
•added 2026/09/17 6:00 a.m.•12 views

CVE-2026-91019 Event Booking Manager for WooCommerce < 5.6.0 - Contributor+ Payment Gateway Credential Disclosure

The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Contributor-level access and above to read the site's PayPal and Stripe credentials, including their secret keys...

5.8AI score0.00377EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
•added 2026/09/16 6:00 a.m.•8 views

CVE-2026-76558 WP Import Export Lite < 3.9.33 - Contributor+ Stored DOM XSS via Custom Field Names

The WP Import Export Lite WordPress plugin before 3.9.33 does not escape custom field names retrieved from the database before inserting them into the DOM of one of its administration screens, allowing users with a role as low as contributor to perform Stored XSS attacks which will trigger in the...

5.8AI score0.00431EPSS
SaveExploits0References1
NVD
NVD
•added 2026/09/15 1:16 p.m.•9 views

CVE-2026-15609

The Bridge - Creative Multipurpose WordPress Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'circleline' Shortcode Attribute in all versions up to, and including, 30.8.9.1 due to insufficient input sanitization and output escaping. This makes it possible for...

6.4CVSS0.0019EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/15 12:00 a.m.•18 views

PT-2026-91870

The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'etn shedule objective' schedule slot Parameter in all versions up to, and including, 4.1.23 due to insufficient input sanitization and output...

6.4CVSS5.9AI score0.0025EPSS
SaveExploits0References17
Patchstack
Patchstack
•added 2026/09/14 5:23 p.m.•7 views

WordPress Eventin plugin <= 4.1.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'etn_shedule_objective' schedule_slot Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'etnsheduleobjective' scheduleslot Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin WP Event Solution versions = 4.1.23...

6.4CVSS5.7AI score0.0025EPSS
SaveExploits0References1Affected Software1
Patchstack
Patchstack
•added 2026/09/12 6:00 a.m.•15 views

WordPress WP Highlight Box plugin <= 1.0 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Pablo González and Francisco José Ramírez in WordPress Plugin WP Highlight Box versions = 1.0...

5.7AI score0.00431EPSS
SaveExploits0References1Affected Software1
Snyk
Snyk
•added 2026/09/11 7:07 p.m.•4 views

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection in the task synthesis, which interpolates configuration properties and auto-discovered file names into the generated .projen/tasks.json without escaping shell metacharacters, affecting properties including extraArgs,...

8.4CVSS6AI score0.00234EPSS
SaveExploits0References2
Rows per page
Query Builder