21911 matches found
CVE-2026-13173: Missing Authorization
The Eventin WordPress plugin before 4.1.21 does not verify the current user's permission to edit other users before assigning roles and updating user metadata during speaker creation, allowing users with contributor-level access and above to modify other users' roles and metadata...
CVE-2026-19406: Exposure of Sensitive Information to an Unauthorized Actor
The Easy Appointments WordPress plugin before 4.0.1 does not restrict one of its appointment-listing REST endpoints to the records belonging to the requesting user, allowing users with contributor-level access to read all bookings on the site, including customer names, schedules, and statuses...
CVE-2026-14825: Authorization Bypass Through User-Controlled Key
The Quiz and Survey Master QSM WordPress plugin before 11.2.4 does not perform a per-object ownership check before saving a quiz's front-end text settings, allowing users with contributor-level access and above to modify the text settings of quizzes created by other users...
CVE-2026-13175: Authorization Bypass Through User-Controlled Key
The Eventin WordPress plugin before 4.1.21 does not verify ownership before allowing schedule records to be modified or deleted, allowing users with contributor-level access and above to alter or delete schedule entries created by other users...
CVE-2025-11729
The WordPress PPWP plugin (≤1.9.15) has an improper capability check in its can_access function, allowing authenticated Contributors and above to retrieve the master password and bypass protection on any password-protected post or page. CVSS 4.3 (Medium). The plugin's changelog shows a fix was ap...
CVE-2025-11729 PPWP: Password Protect Pages, Posts & Full or Partial Content <= 1.9.15 - Improper Authorization To Authenticated (Contributor+) Master Password Exposure
The PPWP: Password Protect Pages, Posts & Full or Partial Content plugin for WordPress is vulnerable to unauthorized access of data due to a improper capability check on the canaccess function in all versions up to, and including, 1.9.15. This makes it possible for authenticated attackers, with...
CVE-2026-74003
Contributor Broken Access Control in RomethemeForm For Elementor = 1.2.6 versions...
CVE-2026-68565
Contributor Cross Site Scripting XSS in GeoDirectory = 2.8.172 versions...
CVE-2026-66643
Contributor Cross Site Scripting XSS in Wufoo Shortcode = 1.55 versions...
CVE-2026-66644
Contributor Cross Site Scripting XSS in Typing Effect = 1.3.7 versions...
CVE-2026-66646
Contributor Cross Site Scripting XSS in WP Tab Widget = 1.2.11 versions...
CVE-2026-66636
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Marcin Wise Chat wise-chat allows Stored XSS.This issue affects Wise Chat: from n/a through 3.4.3...
CVE-2026-66637
Contributor Cross Site Scripting XSS in Featured Video Plus = 2.3.3 versions...
CVE-2026-66640
Contributor Cross Site Scripting XSS in Login With Ajax = 4.5.1 versions...
CVE-2026-66641
Contributor Cross Site Scripting XSS in Video Conferencing with Zoom = 4.6.8 versions...
CVE-2026-66638
Contributor Cross Site Scripting XSS in Frontend Admin by DynamiApps = 3.29.10 versions...
CVE-2026-66627
Unrestricted Upload of File with Dangerous Type vulnerability in EDGE22 Studios Ltd. GP Premium allows Remote Code Inclusion. This issue affects GP Premium: from n/a through 2.5.5...
CVE-2026-32474
Contributor Arbitrary File Upload in Templatiq = 0.2.5 versions...