21812 matches found
PT-2026-79551
Name of the Vulnerable Software and Affected Versions Image Photo Gallery Final Tiles Grid versions prior to 3.6.13 Description Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access and above to perform Stored Cross-Site Scripting. This is...
PT-2026-79744
Name of the Vulnerable Software and Affected Versions PPWP – Password Protect Pages versions prior to 1.9.19 Description The plugin is susceptible to PHP Object Injection, a condition where untrusted input is deserialized, allowing an attacker to inject PHP objects. This issue occurs through the...
PT-2026-79553
Name of the Vulnerable Software and Affected Versions GreenShift – Animation and Page Builder Blocks versions prior to 12.9.0 Description The GreenShift – Animation and Page Builder Blocks plugin for WordPress allows unauthorized modification of data. The issue stems from a missing capability che...
CVE-2026-76613
Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40 - An SQL injection allowed any contributor-level user to inject own content into SQL queries...
CVE-2026-76613
YOOtheme Pro (a Joomla extension by yootheme.com) versions 1.0.0 through 5.0.40 are affected by an authenticated, privileged SQL injection vulnerability. Any user with contributor-level access can inject arbitrary content into SQL queries, resulting in high impact on the confidentiality, integrit...
CVE-2026-76613 Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40
Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40 - An SQL injection allowed any contributor-level user to inject own content into SQL queries...
CVE-2026-76613 Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40
Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40 - An SQL injection allowed any contributor-level user to inject own content into SQL queries...
EUVD-2026-63937
Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40 - An SQL injection allowed any contributor-level user to inject own content into SQL queries...
CVE-2026-13176 Eventin < 4.1.21 - Contributor+ Server-Side Request Forgery
The Eventin WordPress plugin before 4.1.21 does not validate a user-supplied webhook URL stored on events nor verify event ownership, allowing users with contributor-level access and above to trigger blind server-side requests to arbitrary hosts...
CVE-2026-13176 Eventin < 4.1.21 - Contributor+ Server-Side Request Forgery
The Eventin WordPress plugin before 4.1.21 does not validate a user-supplied webhook URL stored on events nor verify event ownership, allowing users with contributor-level access and above to trigger blind server-side requests to arbitrary hosts...
EUVD-2026-63907
The Eventin WordPress plugin before 4.1.21 does not validate a user-supplied webhook URL stored on events nor verify event ownership, allowing users with contributor-level access and above to trigger blind server-side requests to arbitrary hosts...
WordPress Easy Appointments plugin < 4.0.1 - Contributor+ Sensitive Information Disclosure via REST Appointments Listing vulnerability
Contributor+ Sensitive Information Disclosure via REST Appointments Listing vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Easy Appointments versions 4.0.1...
WordPress Quiz And Survey Master plugin < 11.2.4 - Contributor+ Cross-Quiz Email and Results Configuration Disclosure via IDOR vulnerability
Contributor+ Cross-Quiz Email and Results Configuration Disclosure via IDOR vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Quiz And Survey Master versions 11.2.4...
WordPress Eventin plugin < 4.1.21 - Contributor+ Schedule Deletion and Modification via IDOR vulnerability
Contributor+ Schedule Deletion and Modification via IDOR vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin WP Event SOlution versions 4.1.21...
WordPress Eventin plugin < 4.1.21 - Contributor+ Speaker Account Deletion via IDOR vulnerability
Contributor+ Speaker Account Deletion via IDOR vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin WP Event SOlution versions 4.1.21...
WordPress Eventin plugin < 4.1.21 - Contributor+ User Role and Meta Modification via Speaker Creation vulnerability
Contributor+ User Role and Meta Modification via Speaker Creation vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin WP Event SOlution versions 4.1.21...
WordPress Eventin plugin < 4.1.21 - Contributor+ Arbitrary Event Modification, Deletion and Ownership Takeover via IDOR vulnerability
Contributor+ Arbitrary Event Modification, Deletion and Ownership Takeover via IDOR vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin WP Event SOlution versions 4.1.21...
PT-2026-79381
Name of the Vulnerable Software and Affected Versions YOOtheme Pro versions 1.0.0 through 5.0.40 Description An SQL injection exists that allows any user with contributor-level privileges to inject arbitrary content into SQL queries. SQL injection is a technique where malicious SQL statements are...
CVE-2026-13176: Server-Side Request Forgery (SSRF)
The Eventin WordPress plugin before 4.1.21 does not validate a user-supplied webhook URL stored on events nor verify event ownership, allowing users with contributor-level access and above to trigger blind server-side requests to arbitrary hosts...
CVE-2026-76613: Improper Neutralization of Special Elements used in an SQL Command
Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40 - An SQL injection allowed any contributor-level user to inject own content into SQL queries...