25090 matches found
EUVD-2026-47918
The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable to Code Injection via the 'path' parameter in all versions up to, and including, 6.0.5 due to the use of dynamic function invocation on an attacker-controlled value with insufficient validation. This makes it possibl...
WordPress Manual - Documentation, Knowledge Base & Education WordPress Theme theme <= 7.5.4 - Cross Site Scripting (XSS) vulnerability
WordPress Manual - Documentation, Knowledge Base & Education WordPress Theme theme = 7.5.4 - Cross Site Scripting XSS vulnerability discovered by ed32.dll in WordPress Theme Manual - Documentation, Knowledge Base & Education WordPress Theme versions = 7.5.4...
WordPress Manual - Documentation, Knowledge Base & Education WordPress theme theme <= 7.5.4 - Broken Access Control vulnerability
WordPress Manual - Documentation, Knowledge Base & Education WordPress theme theme = 7.5.4 - Broken Access Control vulnerability discovered by ed32.dll in WordPress Theme Manual - Documentation, Knowledge Base & Education WordPress Theme versions = 7.5.4...
WordPress Dokan Pro plugin <= 5.0.3 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by VanTastic in WordPress Plugin Dokan Pro versions = 5.0.3...
CVE-2026-14291 Security Ninja (Premium) < 5.290 - Two-Factor Authentication Bypass via secnin_skip_2fa
The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one of its two-factor authentication code paths, allowing an unauthenticated attacker who knows a user's password to complete authentication without the one-time code and bypass enforced...
PT-2026-63906
Unauthenticated Broken Access Control in Content Control = 2.6.5 versions...
PT-2026-63917
Author Server Side Request Forgery SSRF in Complianz = 7.5.0 versions...
PT-2026-63893
Unauthenticated Cross Site Request Forgery CSRF in Avada Core = 5.15.6 versions...
PT-2026-63882
Unauthenticated Cross Site Request Forgery CSRF in Zarinpal Gateway = 5.1.0 versions...
PT-2026-63952
Shop Manager Cross Site Scripting XSS in Tabs = 2.5 versions...
PT-2026-63838
Unauthenticated Cross Site Scripting XSS in Grand Photography = 5.7.8 versions...
PT-2026-63929
Contributor Cross Site Scripting XSS in Appointment Hour Booking = 1.5.86 versions...
PT-2026-63928
Name of the Vulnerable Software and Affected Versions WP Activity Log versions prior to 5.6.5 WP Activity Log Premium versions prior to 5.6.5 Description Cross-Site Request Forgery CSRF occurs when an attacker tricks a victim into performing an action they did not intend to do. This issue is caus...
PT-2026-63913
Unauthenticated Cross Site Scripting XSS in Dokan Pro = 5.0.0 versions...
Fedora 45 : libwignernj (2026-8d270f3d39)
The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-8d270f3d39 advisory. Automatic update for libwignernj-0.7.0-6.fc45. Changelog Thu Jul 23 2026 Susi Lehtola - 0.7.0-6 - Fix gating on BR: libquadmath-devel. Thu Jul 23 2026 Susi...
Next.js: Unbounded Server Action payload in Edge runtime
Impact Requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime Workarounds If you cannot upgrade, ensure your hosting provider limits the request's body size. 5 MiB should be...
Allocation of Resources Without Limits or Throttling
Overview next is a react framework. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the handleAction Server Actions path in the App Router Edge runtime. An attacker can exhaust server memory by sending an oversized Server Action request...
GHSA-4C39-4CCG-62R3 Next.js: Unbounded Server Action payload in Edge runtime
Impact Requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime Workarounds If you cannot upgrade, ensure your hosting provider limits the request's body size. 5 MiB should be...
WordPress Shiptastic for WooCommerce plugin <= 5.1.0 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by Guillermo Álvarez in WordPress Plugin Shiptastic for WooCommerce versions = 5.1.0...