21913 matches found
WordPress Serious Slider plugin <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'theme' Shortcode Attribute vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via 'theme' Shortcode Attribute vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Serious Slider versions = 1.4.0...
WordPress Royal Addons for Elementor plugin <= 1.7.1064 - Authenticated (Contributor+) Server-Side Request Forgery via Form Builder Widget 'webhook_url' Setting vulnerability
Authenticated Contributor+ Server-Side Request Forgery via Form Builder Widget 'webhookurl' Setting vulnerability discovered by TarPeg007 - Independent Security Researcher in WordPress Plugin Royal Elementor Addons versions = 1.7.1064...
WordPress Quiz and Survey Master (QSM) plugin <= 11.2.1 - Authenticated (Contributor+) SQL Injection via 'randon_category' Quiz Option vulnerability
Authenticated Contributor+ SQL Injection via 'randoncategory' Quiz Option vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Quiz And Survey Master versions = 11.2.1...
WordPress Quiz and Survey Master (QSM) plugin <= 11.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'question_title' Parameter vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via 'questiontitle' Parameter vulnerability discovered by Jonah Burgess CryptoCat in WordPress Plugin Quiz And Survey Master versions = 11.2.1...
WordPress Podlove Podcast Publisher plugin <= 4.5.3 - Authenticated (Contributor+) PHP Object Injection to Arbitrary File Deletion via 'unfurl_data' Parameter vulnerability
Authenticated Contributor+ PHP Object Injection to Arbitrary File Deletion via 'unfurldata' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Podlove Podcast Publisher versions = 4.5.3...
WordPress Password Protect WordPress Lite plugin <= 1.9.20 - Insecure Direct Object Reference to Authenticated (Contributor+) Password Protected Post Password Update vulnerability
Insecure Direct Object Reference to Authenticated Contributor+ Password Protected Post Password Update vulnerability discovered by Dmitrii Ignatyev - CleanTalk Inc in WordPress Plugin PPWP versions = 1.9.20...
WordPress Kubio AI Page Builder plugin <= 2.8.5 - Missing Authorization to Authenticated (Contributor+) Front-Page/Menu/Template Configuration Reversion via kubio_restore_front_page AJAX Action vulnerability
Missing Authorization to Authenticated Contributor+ Front-Page/Menu/Template Configuration Reversion via kubiorestorefrontpage AJAX Action vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Kubio AI Page Builder versions = 2.8.5...
WordPress Fullscreen Galleria plugin <= 1.6.12 - Authenticated (Contributor+) SQL Injection via 'href' Attribute in Post Content vulnerability
Authenticated Contributor+ SQL Injection via 'href' Attribute in Post Content vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Fullscreen Galleria versions = 1.6.12...
WordPress Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin plugin <= 1.6.12.10 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure vulnerability
WordPress Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin plugin = 1.6.12.10 - Authenticated Contributor+ Insecure Direct Object Reference to Sensitive Information Exposure vulnerability discovered by Michael Iden Mickhat - Hack The Box in WordPress Plugin Simply Schedu...
WordPress ECS plugin < 4.3.8 - Contributor+ Stored XSS via Dynamic Repeater Bindings vulnerability
Contributor+ Stored XSS via Dynamic Repeater Bindings vulnerability discovered by Shivamani Vastrala in WordPress Plugin ECS – Ele Custom Skin for Elementor versions 4.3.8...
WordPress Templately plugin <= 3.7.1 - Authenticated (Contributor+) Arbitrary File Upload to Remote Code Execution via Gutenberg Cloud Import Attachment Filename Mismatch vulnerability
Authenticated Contributor+ Arbitrary File Upload to Remote Code Execution via Gutenberg Cloud Import Attachment Filename Mismatch vulnerability discovered by Dmitrii Ignatyev - CleanTalk Inc in WordPress Plugin Templately versions = 3.7.1...
PT-2026-77128
Contributor Broken Access Control in WP Table Builder = 2.2.0 versions...
PT-2026-77059
Contributor Arbitrary File Upload in GP Premium = 2.5.5 versions...
PT-2026-77064
Name of the Vulnerable Software and Affected Versions Wise Chat versions prior to 3.5 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts into...
PT-2026-77068
Name of the Vulnerable Software and Affected Versions Login With Ajax versions prior to 4.5.2 Description Cross Site Scripting XSS exists in the contributor section, allowing an attacker to execute malicious scripts in the browser of other users. Recommendations Update to a version newer than 4.5...
PT-2026-77073
Name of the Vulnerable Software and Affected Versions WP Tab Widget versions prior to 1.2.12 Description Cross Site Scripting XSS allows an attacker with contributor privileges to execute malicious scripts in the browser of other users. Recommendations Update to a version newer than 1.2.11...
PT-2026-77071
Contributor Cross Site Scripting XSS in Typing Effect = 1.3.7 versions...
PT-2026-77050
Name of the Vulnerable Software and Affected Versions Templatiq versions prior to 0.2.6 Description An issue allows contributors to perform arbitrary file uploads, which could lead to the upload of unauthorized files to the system. Recommendations Update to a version newer than 0.2.5...