16413 matches found
PT-2026-78309
Name of the Vulnerable Software and Affected Versions EWWW Image Optimizer versions prior to 8.7.4 Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. An attacker can embed a...
CVE-2025-11729
The WordPress PPWP plugin (≤1.9.15) has an improper capability check in its can_access function, allowing authenticated Contributors and above to retrieve the master password and bypass protection on any password-protected post or page. CVSS 4.3 (Medium). The plugin's changelog shows a fix was ap...
CVE-2025-11729 PPWP: Password Protect Pages, Posts & Full or Partial Content <= 1.9.15 - Improper Authorization To Authenticated (Contributor+) Master Password Exposure
The PPWP: Password Protect Pages, Posts & Full or Partial Content plugin for WordPress is vulnerable to unauthorized access of data due to a improper capability check on the canaccess function in all versions up to, and including, 1.9.15. This makes it possible for authenticated attackers, with...
CVE-2026-74003
Contributor Broken Access Control in RomethemeForm For Elementor = 1.2.6 versions...
CVE-2026-68565
Contributor Cross Site Scripting XSS in GeoDirectory = 2.8.172 versions...
CVE-2026-66646
Contributor Cross Site Scripting XSS in WP Tab Widget = 1.2.11 versions...
CVE-2026-66643
Contributor Cross Site Scripting XSS in Wufoo Shortcode = 1.55 versions...
CVE-2026-66644
Contributor Cross Site Scripting XSS in Typing Effect = 1.3.7 versions...
CVE-2026-66641
Contributor Cross Site Scripting XSS in Video Conferencing with Zoom = 4.6.8 versions...
CVE-2026-66636
Contributor Cross Site Scripting XSS in Wise Chat = 3.4 versions...
CVE-2026-66637
Contributor Cross Site Scripting XSS in Featured Video Plus = 2.3.3 versions...
CVE-2026-66638
Contributor Cross Site Scripting XSS in Frontend Admin by DynamiApps = 3.29.10 versions...
CVE-2026-66640
Contributor Cross Site Scripting XSS in Login With Ajax = 4.5.1 versions...
CVE-2026-66627
Contributor Arbitrary File Upload in GP Premium = 2.5.5 versions...
CVE-2026-32474
Contributor Arbitrary File Upload in Templatiq = 0.2.5 versions...
CVE-2026-32444
Contributor Remote Code Execution RCE in Cwicly = 1.4.4 versions...
CVE-2026-32463
Contributor Arbitrary File Upload in Sync Post With Other Site = 1.9.3 versions...
CVE-2026-74006 WordPress WP Table Builder plugin <= 2.2.0 - Broken Access Control vulnerability
Contributor Broken Access Control in WP Table Builder = 2.2.0 versions...
