Lucene search
+L

85742 matches found

EUVD
EUVD
added 2026/08/23 6:00 a.m.6 views

EUVD-2026-64637

The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as low as Contributor to publish posts and pages on the site without holding the publish capability...

5.4AI score
SaveExploits0References1
EUVD
EUVD
added 2026/08/23 6:00 a.m.8 views

EUVD-2026-64636

The WooCommerce Bookings WordPress plugin before 3.9.0 does not perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by omitting the token, allowing users with Subscriber-level access and above to create draft bookable products...

5.4AI score
SaveExploits0References1
CVE
CVE
added 2026/08/23 6:00 a.m.14 views

CVE-2026-14853

The WooCommerce Bookings WordPress plugin before 3.9.0 is affected by an authorization flaw. A specific AJAX action lacks a capability check , and its nonce check can be bypassed by simply omitting the token. This allows any authenticated user with Subscriber-level access or above to create draft...

5.4AI score
SaveExploits0References1
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.3 views

Flowise <= 3.0.13 - Unauthenticated OAuth Configuration Disclosure

Flowise before 3.1.0 contains a missing authentication vulnerability in the /api/v1/loginmethod endpoint, allowing unauthenticated remote attackers to retrieve an organization's complete SSO configuration including OAuth client secrets by providing an organizationId parameter. id: CVE-2026-56270...

8.7CVSS5.7AI score0.01498EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.89 views

FatPipe WARP/IPVPN/MPVPN - Authorization Bypass

FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 contain a missing authorization caused by lack of access control in the web management interface, letting remote attackers access sensitive URLs, exploit requires no authentication. id: CVE-2021-27858 info: name:...

5.3CVSS5.6AI score0.02703EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.39 views

WCFM Membership <= 2.10.0 - Broken Access Control

The WCFM Membership plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 2.10.0 due to missing capability checks true the AJAX actions: wcfm-memberships, wcfm-memberships-manage, and wcfm-memberships-settings. id: CVE-2022-4940 info:...

7.3CVSS7.1AI score0.01084EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.79 views

Zitadel - User Registration Bypass

The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Due to a missing security check in versions prior to 2.64.0, 2.63.5, 2.62.7, 2.61.4, 2.60.4, 2.59.5, and 2.58.7, disabling the "User Registration allowed" option only hid the...

7.5CVSS7.5AI score0.02518EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.35 views

CyberPower - Missing Authentication

An issue regarding missing authentication for certain utilities exists in CyberPower PowerPanel Enterprise prior to v2.8.3. id: CVE-2024-32735 info: name: CyberPower - Missing Authentication author: DhiyaneshDK severity: critical description: | An issue regarding missing authentication for certai...

9.8CVSS8.7AI score0.06765EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.6 views

Arcane < 1.18.0 - Unauthenticated Template and Env Disclosure

Arcane 1.18.0 contains an information disclosure caused by missing authorization on /api/templates GET endpoints, letting unauthenticated network clients read sensitive Compose YAML and .env content, exploit requires network access id: CVE-2026-42461 info: name: Arcane 1.18.0 - Unauthenticated...

8.7CVSS8.6AI score0.01051EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.26 views

PublishPress Capabilities < 2.3.1 - Missing Authorization

The PublishPress Capabilities plugin for WordPress before 2.3.1 does not have proper authorization and CSRF checks when updating settings via the init hook, allowing unauthenticated attackers to update arbitrary blog options, such as setting the default role to administrator. id: CVE-2021-25032...

9.8CVSS9AI score0.06565EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.68 views

WordPress RSVP and Event Management <2.7.8 - Missing Authorization

WordPress RSVP and Event Management plugin before 2.7.8 is susceptible to missing authorization. The plugin does not have any authorization checks when exporting its entries, and the export function is hooked to the init action. An attacker can potentially retrieve sensitive information such as...

5.3CVSS5.6AI score0.04213EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.10 views

Canto <= 3.1.1 - Missing Authorization to Unauthenticated File Upload

The Canto plugin for WordPress is vulnerable to missing authorization in the copy-media.php upload flow. The file is directly accessible and accepts attacker-controlled parameters for the upload destination, allowing unauthenticated users to upload arbitrary files constrained to WordPress-allowed...

5.3CVSS5.6AI score0.00969EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.9 views

LiteLLM 1.18.10 - Command Injection

LiteLLM 1.18.10 contains a remote code execution caused by lack of validation of arbitrary command and args in MCP server creation, letting attackers execute OS commands remotely, exploit requires crafted JSON configuration. id: CVE-2026-30623 info: name: LiteLLM 1.18.10 - Command Injection autho...

9.8CVSS6.8AI score0.05952EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.51 views

WPZOOM Social Icons Widget <= 4.2.15 - Missing Authorization

WPZOOM Social Icons Widget & Block versions up to 4.2.15 contain a missing authorization vulnerability caused by insufficient access control in the widget and block, letting attackers perform unauthorized actions, exploit requires no special conditions. id: CVE-2024-30464 info: name: WPZOOM Socia...

8.8CVSS8.6AI score0.01504EPSS
SaveExploits0References1
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.22 views

HyperComments <= 1.2.2 - Arbitrary Options Update

The HyperComments plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the hcrequesthandler function in all versions up to, and including, 1.2.2. This makes it possible for unauthenticated attackers to...

8.8CVSS5.6AI score0.01779EPSS
SaveExploits4References2
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.32 views

Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit - Broken Access Control

The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the installoractivateaddonplugins function and a weak nonce hash in all...

9.8CVSS5.6AI score0.03021EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.23 views

LottieFiles WordPress Plugin <= 3.0.0 - Missing Authorization

LottieFiles LottieFiles = 3.0.0 contains a broken access control vulnerability caused by incorrectly configured access control security levels, letting attackers exploit missing authorization, exploit requires no special privileges. id: CVE-2025-68043 info: name: LottieFiles WordPress Plugin =...

7.3CVSS5.1AI score0.00588EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.9 views

Meta Box <= 4.16.2 - Arbitrary File Deletion

The Meta Box plugin for WordPress is vulnerable to arbitrary file deletion in the ajaxdeletefile function. The function accepts any attachmentid from the POST request and directly calls wpdeleteattachment or unlink without validating that the attachment belongs to the specified Meta Box field,...

6.5CVSS6.6AI score0.01706EPSS
SaveExploits1References2
EUVD
EUVD
added 2026/08/23 12:30 a.m.12 views

EUVD-2026-64605

The Security Hardener plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.4. The vulnerability exists because the plugin's user-enumeration protection, which is enabled by default, hooks the restendpoints filter via secureuserendpoints and...

8.8CVSS5.5AI score
SaveExploits0References9
CVE
CVE
added 2026/08/22 11:27 p.m.21 views

CVE-2026-16149

Security Hardener for WordPress (all versions up to and including 2.4.4 ) contains a Missing Authorization flaw in its user-enumeration protection feature. The plugin's secure_user_endpoints() function hooks the rest_endpoints filter and overwrites the permission_callback on both /wp/v2/users and...

8.8CVSS5.5AI score
SaveExploits0References8
Rows per page
Query Builder