28901 matches found
WordPress Blog2Social: Social Media Auto Post & Scheduler plugin <= 8.7.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification vulnerability
Missing Authorization to Authenticated Subscriber+ Arbitrary Post Modification vulnerability discovered by Lucas Montes NiRoX in WordPress Plugin Blog2Social versions = 8.7.4...
CVE-2026-27059
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PenciDesign Penci Recipe penci-recipe allows DOM-Based XSS.This issue affects Penci Recipe: from n/a through = 4.1...
CVE-2026-25463
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WpEstate Wpresidence Core wpresidence-core allows Stored XSS.This issue affects Wpresidence Core: from n/a through = 5.4.0...
CVE-2026-25407
Missing Authorization vulnerability in cookiebot Cookiebot cookiebot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cookiebot: from n/a through = 4.6.4...
WordPress Video Conferencing with Zoom API plugin < 4.6.6 - Unauthenticated SDK Signature Generation vulnerability
Unauthenticated SDK Signature Generation vulnerability discovered by yiğit ibrahim sağlam in WordPress Plugin Video Conferencing with Zoom versions 4.6.6...
CVE-2026-27059 WordPress Penci Recipe plugin <= 4.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PenciDesign Penci Recipe penci-recipe allows DOM-Based XSS.This issue affects Penci Recipe: from n/a through = 4.1...
CVE-2026-27059
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PenciDesign Penci Recipe penci-recipe allows DOM-Based XSS.This issue affects Penci Recipe: from n/a through = 4.1...
CVE-2026-25451
CVE-2026-25451 describes a stored XSS flaw in WordPress Bold Page Builder (bold-page-builder) due to improper neutralization during web page generation. Affected: Bold Page Builder versions up to 5.6.9 (as per initial description). Root cause: improper input neutralization leading to stored paylo...
CVE-2026-25451 WordPress Bold Page Builder plugin <= 5.6.9 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in boldthemes Bold Page Builder bold-page-builder allows Stored XSS.This issue affects Bold Page Builder: from n/a through = 5.6.9...
CVE-2026-25463
CVE-2026-25463 affects WordPress Wpresidence Core (wpresidence-core) versions
CVE-2026-25389
CVE-2026-25389 affects WordPress EventPrime (EventPrime: Metagauss) and is a Sensitive Data Exposure vulnerability. The issue allows retrieval of embedded sensitive data by an unauthenticated actor and affects EventPrime versions from n/a up to and including 4.2.8.3; the entry indicates it is pat...
CVE-2026-25368 WordPress Calculated Fields Form plugin <= 5.4.4.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in codepeople Calculated Fields Form calculated-fields-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Calculated Fields Form: from n/a through = 5.4.4.1...
CVE-2026-25331
CVE-2026-25331 describes a DOM-based XSS in the WordPress plugin WP Activity Log (Melapress WP Activity Log) through improper input neutralization during web page generation. Affected range is WP Activity Log versions up to and including 5.5.4. The advisory notes this is a cross-site scripting vu...
CVE-2026-25330
CVE-2026-25330 affects the WordPress PublishPress Authors plugin (<= 4.10.1). Described as a Missing Authorization / Broken Access Control vulnerability due to incorrectly configured access control security levels. CVSSv3.1: 4.3 (Medium) with Network attack vector, Privileges Required: Low, Us...
CVE-2026-25330 WordPress PublishPress Authors plugin <= 4.10.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in PublishPress PublishPress Authors publishpress-authors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PublishPress Authors: from n/a through = 4.10.1...
CVE-2026-25330 WordPress PublishPress Authors plugin <= 4.10.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in PublishPress PublishPress Authors publishpress-authors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PublishPress Authors: from n/a through = 4.10.1...
CVE-2026-23545
CVE-2026-23545 describes a Missing Authorization/Broken Access Control vulnerability in the Aruba HiSpeed Cache WordPress plugin. Affected product: Aruba HiSpeed Cache, up to version 3.0.4. Public sources (Patchstack, CVE list, Red Hat/CVE repositories, and Wordfence vulnerability reports) confir...
CVE-2025-13079
CVE-2025-13079 concerns the WordPress plugin “Popup Builder” (versions
CVE-2025-12451 Easy SVG Support <= 4.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
The Easy SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file uploads in all versions up to, and including, 4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above,...
jsPDF security vulnerability
jsPDF is a JavaScript-based PDF document generation library developed by Parallax. Versions of jsPDF prior to 4.2.0 contained security vulnerabilities. These vulnerabilities stemmed from improper handling of user input by the Acroform module, which could lead to the injection of arbitrary PDF...