7679 matches found
PT-2026-78999
Cross-Site Request Forgery CSRF vulnerability in HashThemes Easy Elementor Addons allows Cross Site Request Forgery. This issue affects Easy Elementor Addons: from n/a through 2.3.7...
CVE-2026-19406
The Easy Appointments WordPress plugin before 4.0.1 does not restrict one of its appointment-listing REST endpoints to the records belonging to the requesting user, allowing users with contributor-level access to read all bookings on the site, including customer names, schedules, and statuses...
CVE-2026-15253
The Easy Media Replace WordPress plugin through 0.2.0 does not sanitise and escape an attachment title before outputting it in an HTML attribute in the media library list view, allowing users with the Author role and above to inject arbitrary web scripts that are executed in the browser of a high...
CVE-2026-19406
The Easy Appointments WordPress plugin before 4.0.1 exposes an appointment-listing REST endpoint without per-user scoping, letting contributor-level accounts read all site bookings including customer names, schedules, and statuses. Fix is to upgrade to version 4.0.1 or later. No in-the-wild explo...
EUVD-2026-62288
The Easy Appointments WordPress plugin before 4.0.1 does not restrict one of its appointment-listing REST endpoints to the records belonging to the requesting user, allowing users with contributor-level access to read all bookings on the site, including customer names, schedules, and statuses...
CVE-2026-19406 Easy Appointments < 4.0.1 - Contributor+ Sensitive Information Disclosure via REST Appointments Listing
The Easy Appointments WordPress plugin before 4.0.1 does not restrict one of its appointment-listing REST endpoints to the records belonging to the requesting user, allowing users with contributor-level access to read all bookings on the site, including customer names, schedules, and statuses...
CVE-2026-15253 Easy Media Replace <= 0.2.0 - Author+ Stored XSS via Attachment Title
The Easy Media Replace WordPress plugin through 0.2.0 does not sanitise and escape an attachment title before outputting it in an HTML attribute in the media library list view, allowing users with the Author role and above to inject arbitrary web scripts that are executed in the browser of a high...
EUVD-2026-62268
The Easy Media Replace WordPress plugin through 0.2.0 does not sanitise and escape an attachment title before outputting it in an HTML attribute in the media library list view, allowing users with the Author role and above to inject arbitrary web scripts that are executed in the browser of a high...
CVE-2026-15253
The Easy Media Replace WordPress plugin (≤0.2.0) fails to sanitise attachment titles before rendering them in HTML attributes in the media library list view, enabling Author+ role users to inject stored XSS executed in the browser of higher-privileged admins. No patch version or exploit code is d...
PT-2026-78282
Name of the Vulnerable Software and Affected Versions Easy Media Replace WordPress plugin versions prior to 0.2.1 Description Insufficient sanitization and escaping of attachment titles before they are output in an HTML attribute within the media library list view allows users with the Author rol...
CVE-2026-73367
Unauthenticated Remote File Inclusion in Easy Google Maps 1.14.2 versions...
CVE-2026-73366
Unauthenticated PHP Object Injection in Easy Google Maps = 1.13.0 versions...
EUVD-2026-60789
Unauthenticated Remote File Inclusion in Easy Google Maps 1.14.2 versions...
CVE-2026-73367 WordPress Easy Google Maps plugin < 1.14.2 - Remote File Inclusion vulnerability
Unauthenticated Remote File Inclusion in Easy Google Maps 1.14.2 versions...
CVE-2026-73367
The WordPress plugin Easy Google Maps (slug google-maps-easy) is vulnerable to unauthenticated Remote File Inclusion (RFI) in versions prior to 1.14.2 . The flaw allows a network attacker with no authentication to include arbitrary remote files, potentially affecting confidentiality and integrity...
CVE-2026-73367
Unauthenticated Remote File Inclusion in Easy Google Maps 1.14.2 versions...
CVE-2026-73366 WordPress Easy Google Maps plugin <= 1.13.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Easy Google Maps = 1.13.0 versions...
EUVD-2026-60788
Unauthenticated PHP Object Injection in Easy Google Maps = 1.13.0 versions...