Lucene search
+L

108322 matches found

CVE
CVE
added 2026/07/23 8:34 a.m.25 views

CVE-2026-14481

The CVE-2026-14481 entry affects the WordPress plugin Equalize Digital Accessibility Checker (versions up to and including 1.46.0). It reports a Stored Cross-Site Scripting (XSS) vulnerability in the html parameter due to insufficient input sanitization and output escaping. The flaw allows authen...

6.4CVSS5.7AI score0.00307EPSS
SaveExploits0References10
EUVD
EUVD
added 2026/07/23 8:34 a.m.13 views

EUVD-2026-47922

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing...

6.5CVSS5.8AI score0.00281EPSS
SaveExploits0References8
CVE
CVE
added 2026/07/23 8:34 a.m.16 views

CVE-2026-15906

CVE-2026-15906 affects the WordPress plugin “Premium Packages – Sell Digital Products Securely” up to version 7.0.4. The issue is a generic SQL injection via the orderby parameter caused by insufficient escaping and lack of proper SQL query preparation. This allows authenticated attackers with ad...

6.5CVSS5.8AI score0.00281EPSS
SaveExploits0References8
EUVD
EUVD
added 2026/07/23 8:34 a.m.8 views

EUVD-2026-47925

The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tceventfilter' parameter in all versions up to, and including, 3.6.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

6.5CVSS5.9AI score0.00269EPSS
SaveExploits0References6
ATTACKERKB
ATTACKERKB
added 2026/07/23 8:34 a.m.7 views

CVE-2026-15404

The Lpagery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in versions up to, and including, 2.5.7. This is due to insufficient input sanitization and output escaping in the lpageryaddfiltertexttemplatepost function, which is hooked to adminfooter and echoes the...

6.4CVSS5.5AI score0.00243EPSS
SaveExploits0References6
CVE
CVE
added 2026/07/23 8:34 a.m.17 views

CVE-2026-15404

CVE-2026-15404 concerns the Lpagery WordPress plugin (<= 2.5.7). It enables a Stored Cross-Site Scripting (XSS) via post titles due to insufficient sanitization and output escaping in lpagery_add_filter_text_template_post(), which runs on admin_footer and echoes the raw post_title of the post ...

6.4CVSS5.6AI score0.00243EPSS
SaveExploits0References5
NVD
NVD
added 2026/07/23 8:16 a.m.9 views

CVE-2026-9635

The WP Shortcode by MyThemeShop plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter of the tab shortcode in versions up to, and including, 1.4.17. This is due to insufficient input sanitization and output escaping in the mtstabs function, which outputs the...

6.4CVSS0.00187EPSS
SaveExploits0References3
NVD
NVD
added 2026/07/23 7:16 a.m.16 views

CVE-2026-9577

The Post Status Notifier Lite WordPress plugin before 1.13.0 does not properly escape the mod URL parameter before reflecting it into the admin settings page admin.php?page=post-status-notifier-lite, leading to a Reflected Cross-Site Scripting vulnerability that fires in the administrator's sessi...

4.8CVSS0.00142EPSS
SaveExploits0References1
NVD
NVD
added 2026/07/23 7:16 a.m.16 views

CVE-2026-9066

The WP Compress WordPress plugin before 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build the URLs of JavaScript files emitted on the page, leading to Reflected XSS. When a visitor follows a crafted link, the WP Compress WordPress...

6.1CVSS0.00149EPSS
SaveExploits0References1
CVE
CVE
added 2026/07/23 6:52 a.m.18 views

CVE-2026-9713

CVE-2026-9713 : The Lumise Product Designer for WooCommerce WordPress plugin (up to version 2.1.1) is vulnerable to SQL injection via the uploaded cart JSON file processed by the checkout AJAX action. The root cause is insufficient escaping of user-provided parameters in the find_resource() funct...

7.5CVSS5.8AI score0.00273EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/07/23 6:52 a.m.8 views

CVE-2026-9713

The Lumise Product Designer for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'id' and 'table' parameters in the uploaded cart JSON file processed by the checkout AJAX action in versions up to, and including, 2.1.1. This is due to insufficient escaping on the user-suppli...

7.5CVSS5.8AI score0.00273EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/07/23 6:52 a.m.8 views

EUVD-2026-47934

The Lumise Product Designer for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'id' and 'table' parameters in the uploaded cart JSON file processed by the checkout AJAX action in versions up to, and including, 2.1.1. This is due to insufficient escaping on the user-suppli...

7.5CVSS5.8AI score0.00273EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/07/23 6:0 a.m.7 views

CVE-2026-9066

The WP Compress WordPress plugin before 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build the URLs of JavaScript files emitted on the page, leading to Reflected XSS. When a visitor follows a crafted link, the WP Compress WordPress...

5.7AI score0.00149EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/07/23 6:0 a.m.9 views

EUVD-2026-47887

The Post Status Notifier Lite WordPress plugin before 1.13.0 does not properly escape the mod URL parameter before reflecting it into the admin settings page admin.php?page=post-status-notifier-lite, leading to a Reflected Cross-Site Scripting vulnerability that fires in the administrator's sessi...

4.8CVSS5.3AI score0.00142EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/23 6:0 a.m.47 views

CVE-2026-9066 WP Compress < 7.10.04 - Reflected XSS via test_zone

The WP Compress WordPress plugin before 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build the URLs of JavaScript files emitted on the page, leading to Reflected XSS. When a visitor follows a crafted link, the WP Compress WordPress...

0.00149EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/23 6:0 a.m.43 views

CVE-2026-9577 Post Status Notifier Lite < 1.13.0 - Reflected XSS via mod Parameter

The Post Status Notifier Lite WordPress plugin before 1.13.0 does not properly escape the mod URL parameter before reflecting it into the admin settings page admin.php?page=post-status-notifier-lite, leading to a Reflected Cross-Site Scripting vulnerability that fires in the administrator's sessi...

0.00142EPSS
SaveExploits0References1
CVE
CVE
added 2026/07/23 6:0 a.m.20 views

CVE-2026-9066

The CVE describes a Reflected XSS in WP Compress for WordPress plugin before 7.10.04 due to lack of validation of a query parameter that controls the asset CDN host. This allows an attacker, via a crafted link, to cause the loader to inject script elements pointing to an attacker-controlled origi...

6.1CVSS5.8AI score0.00149EPSS
SaveExploits0References1
CVE
CVE
added 2026/07/23 6:0 a.m.24 views

CVE-2026-9577

The Post Status Notifier Lite WordPress plugin (before 1.13.0) is affected. The vulnerability arises because the plugin does not properly escape the mod URL parameter before reflecting it into the admin settings page (admin.php?page=post-status-notifier-lite), enabling a Reflected Cross-Site Scri...

4.8CVSS5.3AI score0.00142EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/07/23 5:35 a.m.8 views

EUVD-2026-47878

The FormCraft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'parameter name' parameter in all versions up to, and including, 3.9.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

7.2CVSS5.5AI score0.00206EPSS
SaveExploits0References2
CVE
CVE
added 2026/07/23 5:35 a.m.16 views

CVE-2026-7534

The CVE-2026-7534 entry details a vulnerability in the SUMO Reward Points for WooCommerce plugin (WordPress) up to version 32.7.0. Affected component: SRP_REST_Earning_Controller handling REST endpoint /wp-json/wc-srp/v1/earning. Root cause: the user_has_cap filter unconditionally grants the rs_e...

7.2CVSS5.6AI score0.0019EPSS
SaveExploits0References2
Rows per page
Query Builder