572 matches found
wp2shell
wp2shell Pre-authentication remote code execution for WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1. Chains CVE-2026-63030 batch route confusion SQLi with CVE-2026-60137 customizer changeset re-entry to achieve unauthenticated administrator creation and OS command execution. No password cracking required...
CVE-2026-8206
CVE-2026-8206 Vulnerability: Unauthenticated Account Takeover — Password Reset Email Hijacking in Kirki Customizer Framework CVSS v3.1 9.8 / 10.0 CRITICAL Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 1. Overview CVE-2026-8206 is an Unauthenticated Account Takeover vulnerability in Kirki Customizer...
CVE-2026-107630
The Email Templates Customizer and Designer for WordPress and WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible...
EUVD-2026-114218
The Email Templates Customizer and Designer for WordPress and WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible...
CVE-2026-107630 Email Templates Customizer and Designer for WordPress and WooCommerce <= 1.5.14 - Missing Authorization to Unauthenticated Order PII Disclosure via 'preview_order' Parameter
The Email Templates Customizer and Designer for WordPress and WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible...
CVE-2026-107630 Email Templates Customizer and Designer for WordPress and WooCommerce <= 1.5.14 - Missing Authorization to Unauthenticated Order PII Disclosure via 'preview_order' Parameter
The Email Templates Customizer and Designer for WordPress and WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible...
CVE-2026-107630
The Email Templates Customizer and Designer for WordPress and WooCommerce plugin (versions up to and including 1.5.14 ) is vulnerable to an authorization bypass due to insufficient verification of user permissions. This flaw allows unauthenticated attackers to enumerate WooCommerce order IDs usin...
WordPress Email Templates Customizer and Designer for WordPress and WooCommerce plugin <= 1.5.14 - Missing Authorization to Unauthenticated Order PII Disclosure vulnerability
Missing Authorization to Unauthenticated Order PII Disclosure vulnerability discovered by Kuba in WordPress Plugin Email Templates versions = 1.5.14...
WordPress Email Customizer for WooCommerce (Pro) plugin <= 3.9.5 - Authenticated (Subscriber+) Remote Code Execution vulnerability
Authenticated Subscriber+ Remote Code Execution vulnerability discovered by theviper17y in WordPress Plugin Email Customizer for WooCommerce Pro versions = 3.9.5...
CVE-2026-107630: saadiqbal Email Templates Customizer and Designer for WordPress and WooCommerce: The Email Templates Customizer and Designer for WordPress and WooCommerce plugin for WordPress is vulnerable to…
The Email Templates Customizer and Designer for WordPress and WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible...
PT-2026-133693
The Email Templates Customizer and Designer for WordPress and WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible...
WP 5.0 - 7.1.3 - Contributor+ Stored XSS via Customizer Selective Refresh
Description WordPress does not safely handle a stored selector value during Customizer selective refresh in some cases, which could allow users with contributor-level access and above to perform Stored Cross-Site Scripting attacks in an administrator's Customizer session on sites using a classic...
WP 4.9 - 7.1.3 - Unauthenticated Customizer Changeset Disclosure
Description WordPress does not correctly restrict access to unpublished Customizer changesets in some cases, which could allow unauthenticated users to disclose draft Customizer state and the preview identifier...
WordPress Core <= 7.1.3 - Unauthenticated Sensitive Data Exposure of Unpublished Customizer Changesets
Unauthenticated Sensitive Data Exposure of Unpublished Customizer Changesets vulnerability discovered by Antonio Lorensius Silaban in WordPress core versions = 7.1.3...
WordPress Core <= 7.1.3 - Contributor+ Stored Cross-Site Scripting via Customizer Selective Refresh
Contributor+ Stored Cross-Site Scripting via Customizer Selective Refresh vulnerability discovered by Rafie Muhammad in WordPress core versions = 7.1.3...
EUVD-2026-111606
The Post Snippets – Custom WordPress Code Snippets Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 4.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
CVE-2026-77871: saadiqbal Post Snippets – Custom WordPress Code Snippets Customizer: The Post Snippets – Custom WordPress Code Snippets Customizer plugin for WordPress is vulnerable to Stored Cross-Site…
The Post Snippets – Custom WordPress Code Snippets Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 4.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
PT-2026-127893
The Post Snippets – Custom WordPress Code Snippets Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 4.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
CVE-2026-111838
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThemeHunk ThemeHunk Customizer themehunk-customizer allows Reflected XSS.This issue affects ThemeHunk Customizer: from n/a through 2.8.7...
EUVD-2026-107275
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThemeHunk ThemeHunk Customizer themehunk-customizer allows Reflected XSS.This issue affects ThemeHunk Customizer: from n/a through 2.8.7...