4611 matches found
Event Booking Manager for WooCommerce <= 5.3.6 - PHP Object Injection
Event Booking Manager for WooCommerce WordPress plugin = 5.3.6 contains an insecure deserialization vulnerability caused by deserialization of user-controlled input in event content fields, letting users with Contributor-level access inject PHP objects, potentially leading to arbitrary file...
CVE-2026-125948
The Recipe Card Blocks Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'steps.text' parameter in all versions up to, and including, 3.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2026-122227
The Easy Property Listings plugin for WordPress is vulnerable to generic SQL Injection via the 'posttype' parameter in all versions up to, and including, 3.5.28 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...
CVE-2026-118587
The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all versions up to, and including, 11.18.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wit...
CVE-2026-116509
The Quiz and Survey Master QSM – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to generic SQL Injection via the 'qpages' parameter in all versions up to, and including, 11.2.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
EUVD-2026-124999
The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all versions up to, and including, 11.18.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wit...
CVE-2026-126029
The WPZOOM Addons for Elementor – Starter Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 1.4.20 . The root cause is insufficient input sanitization and output escaping specifically affecting the actions[save_builder][dat...
CVE-2026-122227
The Easy Property Listings plugin for WordPress is vulnerable to SQL Injection in versions up to and including 3.5.28 . The vulnerability exists in the 'post_type' shortcode attribute due to insufficient escaping of user-supplied parameters and a lack of sufficient preparation in the existing SQL...
EUVD-2026-124993
The Easy Property Listings plugin for WordPress is vulnerable to generic SQL Injection via the 'posttype' parameter in all versions up to, and including, 3.5.28 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...
CVE-2026-122227 Easy Property Listings <= 3.5.28 - Authenticated (Contributor+) SQL Injection via 'post_type' Shortcode Attribute
The Easy Property Listings plugin for WordPress is vulnerable to generic SQL Injection via the 'posttype' parameter in all versions up to, and including, 3.5.28 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...
EUVD-2026-124990
The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postcategory' parameter in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2026-116509
The Quiz and Survey Master (QSM) plugin for WordPress (versions up to and including 11.2.9 ) is vulnerable to a generic SQL Injection via the 'qpages' parameter. The root cause is insufficient escaping of user-supplied input and a lack of sufficient preparation on the existing SQL query. Authenti...
CVE-2026-120573
The WPeMatico RSS Feed Fetcher plugin for WordPress (versions
CVE-2026-116509 Quiz and Survey Master (QSM) <= 11.2.9 - Authenticated (Contributor+) SQL Injection via 'qpages' Parameter
The Quiz and Survey Master QSM – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to generic SQL Injection via the 'qpages' parameter in all versions up to, and including, 11.2.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
EUVD-2026-124989
The Quiz and Survey Master QSM – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to generic SQL Injection via the 'qpages' parameter in all versions up to, and including, 11.2.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
CVE-2026-125948 Recipe Card Blocks Lite <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'steps' Block Attribute
The Recipe Card Blocks Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'steps.text' parameter in all versions up to, and including, 3.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2026-125948
The Recipe Card Blocks Lite plugin for WordPress (versions
EUVD-2026-124984
The Recipe Card Blocks Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'steps.text' parameter in all versions up to, and including, 3.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
EUVD-2026-124976
The Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 4.2.6.1 via the postcontent parameter. This is due to asymmetric parsing between the save-time strip filter...
CVE-2026-116615 Widget Options <= 4.2.6.1 - Authenticated (Contributor+) Code Injection via 'post_content' Parameter
The Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 4.2.6.1 via the postcontent parameter. This is due to asymmetric parsing between the save-time strip filter...