25650 matches found
CVE-2026-13009: Improper Neutralization of Special Elements used in an SQL Command
The AI Copilot – Content Generator plugin for WordPress is vulnerable to generic SQL Injection via 'order0dir' Parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes...
CVE-2026-9635: Improper Neutralization of Input During Web Page Generation
The WP Shortcode by MyThemeShop plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter of the tab shortcode in versions up to, and including, 1.4.17. This is due to insufficient input sanitization and output escaping in the mtstabs function, which outputs the...
CVE-2026-15786: Improper Limitation of a Pathname to a Restricted Directory
The WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 7.8.6.6 via the 'imploded' parameter parameter. This makes it possible for authenticated attackers, with...
PT-2026-63789
The Header Footer Script Adder – Insert Code in Header, Body & Footer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'asm code' Snippet Meta in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-65491: Missing Authorization
Subscriber Broken Access Control in Query Wrangler = 1.5.57 versions...
CVE-2026-59513: Improper Neutralization of Input During Web Page Generation
Subscriber Cross Site Scripting XSS in Masteriyo - LMS = 2.3.0 versions...
CVE-2026-16078: Improper Limitation of a Pathname to a Restricted Directory
The WCPOS – Point of Sale POS plugin for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.9.8 via the 'type' parameter parameter. This makes it possible for authenticated attackers, with shop manager-level access and above, to read the...
CVE-2026-65478: Missing Authorization
Subscriber Broken Access Control in ListingPro = 2.9.10 versions...
CVE-2026-15394: Improper Neutralization of Input During Web Page Generation
The Header Footer Script Adder – Insert Code in Header, Body & Footer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'asmcode' Snippet Meta in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-15017: Improper Privilege Management
The MDJM Event Management plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8.4. This is due to missing capability checks and nonce verification in the MDJMPermissions::setpermissions and MDJMEmployeeManager::init functions, combined with the...
CVE-2026-15906: Improper Neutralization of Special Elements used in an SQL Command
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing...
CVE-2026-15794: Improper Neutralization of Input During Web Page Generation
The Grid/List View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'position' Shortcode Attribute in all versions up to, and including, 3.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
PT-2026-64112
Summary PraisonAI recipe execution has a dangerous-tool policy that is supposed to block default-denied tools unless the caller explicitly passes allow dangerous tools=True. That policy only checks tools declared in TEMPLATE.yaml requires.tools. For steps-based recipes, the actual execution path...
CVE-2026-65457: Missing Authorization
Subscriber Broken Access Control in ЮKassa для WooCommerce = 2.16.1 versions...
CVE-2026-13119: Improper Neutralization of Special Elements used in an SQL Command
The Registrations For The Events Calendar plugin for WordPress is vulnerable to SQL Injection via JSON keys in the 'standard' parameter handled by the rtecrecordsedit AJAX action in versions up to and including 3.2. The handler decodes attacker-controlled JSON from $POST'standard' and uses the JS...
CVE-2026-15404: Improper Neutralization of Input During Web Page Generation
The Lpagery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in versions up to, and including, 2.5.7. This is due to insufficient input sanitization and output escaping in the lpageryaddfiltertexttemplatepost function, which is hooked to adminfooter and echoes the...
CVE-2026-57703: Missing Authorization
Subscriber Broken Access Control in Sunshine Photo Cart = 3.6.10.1 versions...
CVE-2026-65530: Missing Authorization
Subscriber Broken Access Control in TemplateSpare = 4.2.2 versions...