Lucene search
+L

108266 matches found

NVD
NVD
added 2026/07/24 10:16 a.m.9 views

CVE-2026-15401

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vbfX' parameter in all versions up to, and including, 1.8.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

7.2CVSS0.00342EPSS
SaveExploits0References14
Cvelist
Cvelist
added 2026/07/24 9:31 a.m.43 views

CVE-2026-15401 VikBooking Hotel Booking Engine & PMS <= 1.8.13 - Unauthenticated Stored Cross-Site Scripting via Custom Field 'vbfX' Parameter

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vbfX' parameter in all versions up to, and including, 1.8.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

7.2CVSS0.00342EPSS
SaveExploits0References14
EUVD
EUVD
added 2026/07/24 9:31 a.m.10 views

EUVD-2026-48548

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vbfX' parameter in all versions up to, and including, 1.8.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

7.2CVSS6AI score0.00342EPSS
SaveExploits0References14
CVE
CVE
added 2026/07/24 9:31 a.m.28 views

CVE-2026-15401

CVE-2026-15401 affects the VikBooking Hotel Booking Engine & PMS WordPress plugin. All versions up to and including 1.8.13 are vulnerable to a Stored Cross-Site Scripting (XSS) via the vbfX parameter. The vulnerability stems from insufficient input sanitization and output escaping, with the vbfX ...

7.2CVSS6AI score0.00342EPSS
SaveExploits0References14
ATTACKERKB
ATTACKERKB
added 2026/07/24 9:31 a.m.8 views

CVE-2026-15401

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vbfX' parameter in all versions up to, and including, 1.8.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

7.2CVSS6AI score0.00342EPSS
SaveExploits0References15
NVD
NVD
added 2026/07/24 9:16 a.m.10 views

CVE-2026-15346

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'categoryid' parameter in all versions up to, and including, 1.8.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke...

6.1CVSS0.00261EPSS
SaveExploits0References10
Cvelist
Cvelist
added 2026/07/24 7:53 a.m.32 views

CVE-2026-15346 VikBooking Hotel Booking Engine & PMS <= 1.8.13 - Reflected Cross-Site Scripting via 'category_id' Parameter

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'categoryid' parameter in all versions up to, and including, 1.8.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke...

6.1CVSS0.00261EPSS
SaveExploits0References10
CVE
CVE
added 2026/07/24 6:52 a.m.20 views

CVE-2026-15653

The CVE concerns the WordPress plugin Visualizer – Tables & Charts Manager with Built-in AI Generator. All versions up to 4.0.5 are vulnerable to Stored Cross‑Site Scripting via the backend-title parameter due to insufficient input sanitization and output escaping. Exploitation requires at least ...

6.4CVSS6AI score0.00193EPSS
SaveExploits0References5
EUVD
EUVD
added 2026/07/24 6:52 a.m.11 views

EUVD-2026-48510

The Visualizer – Tables & Charts Manager with Built-in AI Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'backend-title' parameter in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible fo...

6.4CVSS6AI score0.00193EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/07/24 4:40 a.m.43 views

CVE-2026-16870 Multiple Security Vulnerabilities in Snowflake libsnowflakeclient

Multiple security vulnerabilities in Snowflake libsnowflakeclient versions prior to 2.9.2 could allow remote code execution and credential exfiltration. A stack-based buffer overflow in the file download path could allow remote code execution on a victim host. An attacker could exploit this by...

8.8CVSS0.00362EPSS
SaveExploits0References1
NVD
NVD
added 2026/07/24 4:16 a.m.9 views

CVE-2026-15420

The Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 5.0.0 via the 'plusname' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, t...

4.3CVSS0.00586EPSS
SaveExploits0References10
NVD
NVD
added 2026/07/24 4:16 a.m.12 views

CVE-2026-13464

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0.14 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for...

5.3CVSS0.00343EPSS
SaveExploits0References8
CVE
CVE
added 2026/07/24 2:32 a.m.25 views

CVE-2026-11354

The CVE-2026-11354 entry affects the WordPress plugin Participants Database (versions up to 2.7.8.3). The vulnerability is a Missing Authorization issue via the id parameter, allowing unauthenticated attackers to overwrite arbitrary participant records and redirect the private_id‑bearing record-a...

5.3CVSS5.6AI score0.00239EPSS
SaveExploits0References6
Cvelist
Cvelist
added 2026/07/24 2:32 a.m.37 views

CVE-2026-11354 Participants Database <= 2.7.8.3 - Missing Authorization to Unauthenticated Arbitrary Record Update / Sensitive Information Exposure via 'id' Parameter

The Participants Database plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8.3 via the 'id' parameter. This makes it possible for unauthenticated attackers to overwrite arbitrary participant records by numeric ID and redirect the...

5.3CVSS0.00239EPSS
SaveExploits0References6
CVE
CVE
added 2026/07/24 2:31 a.m.24 views

CVE-2026-13464

The CVE concerns Kirki for WordPress (

5.3CVSS5.6AI score0.00343EPSS
SaveExploits0References8
EUVD
EUVD
added 2026/07/24 2:31 a.m.7 views

EUVD-2026-48464

The Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 5.0.0 via the 'plusname' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, t...

4.3CVSS5.5AI score0.00586EPSS
SaveExploits0References10
Cvelist
Cvelist
added 2026/07/24 2:31 a.m.37 views

CVE-2026-15420 Nexter Blocks <= 5.0.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary CSS/JS File Deletion via 'plus_name' Parameter

The Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 5.0.0 via the 'plusname' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, t...

4.3CVSS0.00586EPSS
SaveExploits0References10
ATTACKERKB
ATTACKERKB
added 2026/07/24 2:31 a.m.10 views

CVE-2026-13464

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0.14 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for...

5.3CVSS5.5AI score0.00343EPSS
SaveExploits0References9
CVE
CVE
added 2026/07/24 2:31 a.m.29 views

CVE-2026-15420

The CVE-2026-15420 entry concerns Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder for WordPress. Affected component: the WordPress plugin itself (Nexter Blocks) with a Directory Traversal flaw exploitable via the plus_name parameter. Impact: authenticated attackers with subscr...

4.3CVSS5.5AI score0.00586EPSS
SaveExploits0References10
Cvelist
Cvelist
added 2026/07/24 2:31 a.m.39 views

CVE-2026-13464 Kirki <= 6.0.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'context' Parameter

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0.14 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for...

5.3CVSS0.00343EPSS
SaveExploits0References8
Rows per page
Query Builder