21740 matches found
WordPress Core <= 7.1 - Contributor+ Arbitrary Post Overwrite vulnerability
Contributor+ Arbitrary Post Overwrite vulnerability discovered by Anthropic in WordPress core versions = 7.1...
PT-2026-95234
Name of the Vulnerable Software and Affected Versions King Addons for Elementor versions prior to 51.1.81 Description An issue exists where the software fails to perform an object-level authorization check during the import of template content into a page. This allows users with contributor-level...
PT-2026-95290
Name of the Vulnerable Software and Affected Versions WP Inventory Manager versions prior to 2.5.2 Description Authenticated attackers with Contributor-level access and above can perform SQL Injection through the where shortcode attribute of the wpinventory shortcode. The issue occurs in the...
CVE-2026-12106: Server-Side Request Forgery (SSRF)
The Auto Upload Images plugin for WordPress is vulnerable to Limited Server-Side Request Forgery in all versions up to, and including, 3.3.2 via the downloadImage function. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitra...
CVE-2026-88994: Improper Control of Filename for Include/Require Statement in PHP Program
The All Bootstrap Blocks WordPress plugin through 1.3.31 does not validate a block attribute before using it to build a filesystem path that is included at render time, allowing users with contributor-level access and above to include arbitrary local files, disclose their contents, and execute PH...
PT-2026-95344
Name of the Vulnerable Software and Affected Versions WP Recipe Maker versions prior to 10.8.2 Description Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access and above to perform Stored Cross-Site Scripting. This is achieved by injectin...
WP < 7.1.1 - Contributor+ Unpublished Post Title Disclosure
Description WordPress does not check that the user is allowed to access a post before returning its sample permalink in some cases, which could allow users with a role as low as contributor to retrieve the titles of other users' draft and pending posts...
CVE-2026-2585 Brizy – Page Builder <= 2.8.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'rootAttributes' Parameter
The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘rootAttributes’ parameter in all versions up to, and including, 2.8.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
WordPress WP Recipe Maker plugin <= 10.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Saulo Rafael miquinho miquinho in WordPress Plugin WP Recipe Maker versions = 10.8.1...
WordPress Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin <= 1.24.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by UKO in WordPress Plugin Popup Maker versions = 1.24.0...
WordPress Kubio AI Page Builder plugin <= 2.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Kubio AI Page Builder versions = 2.8.4...
WordPress Strong Testimonials plugin <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by pbsec in WordPress Plugin Strong Testimonials versions = 3.3.8...
WordPress Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid plugin <= 1.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Magazine Blocks versions = 1.8.6...
WordPress Download Manager plugin <= 3.3.68 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure vulnerability
Insecure Direct Object Reference to Authenticated Contributor+ Sensitive Information Disclosure vulnerability discovered by pbsec in WordPress Plugin Download Manager versions = 3.3.68...
CVE-2026-78294
Contributor Cross Site Scripting XSS in Geo Mashup = 1.13.21 versions...
CVE-2026-73999
Contributor Insecure Direct Object References IDOR in Cooked = 1.16.0 versions...
CVE-2026-74000
Contributor Broken Access Control in Simple Membership = 4.8.2 versions...
CVE-2026-66617
Contributor Cross Site Scripting XSS in PublishPress Series = 3.1.3 versions...