1424 matches found
Academy LMS 6.0 - Cross-Site Scripting
Creative Item Academy LMS 6.0 was discovered to contain a cross-site scripting XSS vulnerability through query parameter. id: CVE-2023-38964 info: name: Academy LMS 6.0 - Cross-Site Scripting author: ritikchaddha severity: medium description: | Creative Item Academy LMS 6.0 was discovered to...
CVE-2026-85006
The HappyAddons for Elementor WordPress plugin versions prior to 3.50.0 is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is a failure to escape an icon value on one of its button widgets before it is outputted inside an HTML attribute. This allows users with Contributor-l...
CVE-2026-85006 Happy Addons for Elementor < 3.50.0 - Contributor+ Stored XSS via Creative Button Widget
The HappyAddons for Elementor WordPress plugin before 3.50.0 does not escape an icon value on one of its button widgets before outputting it inside an HTML attribute, allowing users with Contributor-level access and above to inject event-handler attributes that execute JavaScript in the browser o...
CVE-2026-85006 Happy Addons for Elementor < 3.50.0 - Contributor+ Stored XSS via Creative Button Widget
The HappyAddons for Elementor WordPress plugin before 3.50.0 does not escape an icon value on one of its button widgets before outputting it inside an HTML attribute, allowing users with Contributor-level access and above to inject event-handler attributes that execute JavaScript in the browser o...
privacyguides.org v2026.09.17
Your central privacy and security resource to protect yourself online. About Privacy Guides is a socially motivated website that provides information for protecting your data security and privacy. Our mission is to inform the public about the value of digital privacy, and global government...
CVE-2026-15609
The Bridge - Creative Multipurpose WordPress Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'circleline' Shortcode Attribute in all versions up to, and including, 30.8.9.1 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-15609 Bridge - Creative Multipurpose WordPress Theme <= 30.8.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'circle_line' Shortcode Attribute
The Bridge - Creative Multipurpose WordPress Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'circleline' Shortcode Attribute in all versions up to, and including, 30.8.9.1 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-15609: Improper Neutralization of Input During Web Page Generation
The Bridge - Creative Multipurpose WordPress Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'circleline' Shortcode Attribute in all versions up to, and including, 30.8.9.1 due to insufficient input sanitization and output escaping. This makes it possible for...
WordPress Creative Mail SQL Injection Vulnerability
WordPress is a free and open-source content management system CMS and blog platform built on PHP/MySQL. WordPress Creative Mail has a SQL injection vulnerability, which stems from improper handling of special elements in SQL commands. Attackers can exploit this vulnerability to obtain sensitive...
CVE-2026-3430
The Creative Mail WordPress plugin from 1.6.5 to 1.6.9 does not sanitize and escape a parameter before using in an SQL statement, leading to an unauthenticated SQL injection when the abandoned cart email is managed by creative mail...
CVE-2026-65547
Subscriber SQL Injection in Creative Mail = 1.6.9 versions...
CVE-2026-3430
CVE-2026-3430 affects the Creative Mail WordPress plugin versions 1.6.5–1.6.9. The issue is an unauthenticated SQL injection caused by not sanitizing/escaping a parameter before use in an SQL statement when handling abandoned cart emails. CVSS 3.1 metrics (from WPScan) indicate NETWORK attack vec...
CVE-2026-3430 Creative Mail 1.6.5 - 1.6.9 - Unauthenticated SQLi
The Creative Mail WordPress plugin from 1.6.5 to 1.6.9 does not sanitize and escape a parameter before using in an SQL statement, leading to an unauthenticated SQL injection when the abandoned cart email is managed by creative mail...
CVE-2026-3430 Creative Mail 1.6.5 - 1.6.9 - Unauthenticated SQLi
The Creative Mail WordPress plugin from 1.6.5 to 1.6.9 does not sanitize and escape a parameter before using in an SQL statement, leading to an unauthenticated SQL injection when the abandoned cart email is managed by creative mail...
EUVD-2026-54088
The Creative Mail WordPress plugin from 1.6.5 to 1.6.9 does not sanitize and escape a parameter before using in an SQL statement, leading to an unauthenticated SQL injection when the abandoned cart email is managed by creative mail...
CVE-2026-65547
CVE-2026-65547 is a SQL injection vulnerability in the WordPress Creative Mail plugin, affecting versions ≤ 1.6.9. The issue targets subscriber handling and is documented across multiple sources (NVD/CVELIST, patchstack, EUVD). No exploitation status or in-the-wild details are provided in the con...
CVE-2026-65547 WordPress Creative Mail plugin <= 1.6.9 - SQL Injection vulnerability
Subscriber SQL Injection in Creative Mail = 1.6.9 versions...
EUVD-2026-53977
Subscriber SQL Injection in Creative Mail = 1.6.9 versions...
