16407 matches found
EUVD-2026-64834
Contributor Server Side Request Forgery SSRF in Shared Files = 1.7.69 versions...
CVE-2026-78269 WordPress Shared Files plugin <= 1.7.69 - Server Side Request Forgery (SSRF) vulnerability
Contributor Server Side Request Forgery SSRF in Shared Files = 1.7.69 versions...
CVE-2026-78269
CVE-2026-78269 is a Server Side Request Forgery (SSRF) vulnerability in the WordPress Shared Files plugin (versions
gitcolombo
Gitcolombo OSINT tool that extracts identities — names, emails, and links between seemingly unrelated accounts — from git repositories and GitHub. Python CLI gitcolombo.py — clones repos, walks git log, and can call the GitHub API for richer signals. Web version gitcolombo.html — a single static...
CVE-2026-77003
The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as low as Contributor to publish posts and pages on the site without holding the publish capability...
CVE-2026-77003 Content Mask 1.8.0 - 1.8.5.4 - Contributor Publish Capability Bypass via create_new_content_mask
The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as low as Contributor to publish posts and pages on the site without holding the publish capability...
CVE-2026-77003 Content Mask 1.8.0 - 1.8.5.4 - Contributor Publish Capability Bypass via create_new_content_mask
The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as low as Contributor to publish posts and pages on the site without holding the publish capability...
EUVD-2026-64637
The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as low as Contributor to publish posts and pages on the site without holding the publish capability...
EUVD-2026-64607
The PPWP – Password Protect Pages plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.18 via deserialization of untrusted input from the 'postprotectionroles' vulnerable parameter. This makes it possible for authenticated attackers, with...
PT-2026-79761
The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as low as Contributor to publish posts and pages on the site without holding the publish capability...
CVE-2026-0551 PPWP – Password Protect Pages <= 1.9.18 - Authenticated (Contributor+) PHP Object Injection via post_protection_roles
The PPWP – Password Protect Pages plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.18 via deserialization of untrusted input from the 'postprotectionroles' vulnerable parameter. This makes it possible for authenticated attackers, with...
WordPress PPWP – Password Protect Pages plugin <= 1.9.18 - Authenticated (Contributor+) PHP Object Injection vulnerability
Authenticated Contributor+ PHP Object Injection vulnerability discovered by Webbernaut in WordPress Plugin PPWP versions = 1.9.18...
CVE-2026-4559
The Image Photo Gallery Final Tiles Grid plugin for WordPress (all versions up to and including 3.6.12 ) is vulnerable to Stored Cross-Site Scripting via the delay shortcode attribute. The root cause is insufficient input sanitization and output escaping, allowing authenticated attackers with Con...
EUVD-2026-64297
The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'delay' shortcode attribute in all versions up to, and including, 3.6.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...
CVE-2026-5093
The GreenShift – Animation and Page Builder Blocks plugin for WordPress (versions up to and including 12.8.9 ) is vulnerable to unauthorized modification of data due to a missing capability check on the gspb_update_global_wp_settings function. The function only verifies the edit_posts capability ...
CVE-2026-5093 Greenshift <= 12.8.9 - Authenticated (Contributor+) Theme Settings Modification via 'gspb_update_global_wp_settings'
The GreenShift – Animation and Page Builder Blocks plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 12.8.9. This is due to a missing capability check on the 'gspbupdateglobalwpsettings' function that only verifies the 'editposts' capability...
EUVD-2026-64275
The Post Duplicator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the duplicatepost function in all versions up to, and including, 3.0.11. This is due to the function not verifying that the user has editothersposts capability before...
CVE-2026-4244 Post Duplicator <= 3.0.11 - Missing Authorization to Authenticated (Contributor+) Post Duplication with Arbitrary Author Attribution
The Post Duplicator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the duplicatepost function in all versions up to, and including, 3.0.11. This is due to the function not verifying that the user has editothersposts capability before...
CVE-2026-4244
The Post Duplicator plugin for WordPress (all versions up to and including 3.0.11 ) is vulnerable to unauthorized data modification due to a missing capability check in the duplicate_post() function. The function does not verify that the caller holds the edit_others_posts capability before accept...
CVE-2026-4245 Post Duplicator <= 3.0.11 - Authorization Bypass to Authenticated (Contributor+) Post Duplication
The Post Duplicator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.11. This is due to the duplicatepostpermissions permission callback only verifying the duplicateposts capability without checking whether the requesting user holds publishposts...