16127 matches found
CVE-2026-66467
CVE-2026-66467 affects the WordPress FluentCommunity plugin (versions <= 2.7.5). The connected records confirm a Cross Site Scripting (XSS) vulnerability in the Subscriber context. The CVE entry lists CVSS v3.1 metrics with a base score of 6.5 (Medium) and attributes: Network attack vector, Lo...
CVE-2026-66453 WordPress Salon booking system plugin <= 10.30.26 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in Salon booking system = 10.30.26 versions...
EUVD-2026-57977
Unauthenticated Arbitrary File Download in OMGF Pro = 5.2.7 versions...
CVE-2026-61974
Unauthenticated Cross Site Scripting XSS in Mang Board WP = 2.3.4 versions...
CVE-2026-61960
WP Full Stripe Free plugin <= 8.5.0 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. Affected software: WordPress WP Full Stripe Free (versions
CVE-2026-28185
The CVE-2026-28185 entry concerns the WordPress plugin “Login with Google” (
CVE-2026-28173
The CVE-2026-28173 entry concerns the WordPress WP Event Solution plugin, versioned ≤ 4.1.19, with a vulnerability described as Customer Arbitrary Content Deletion. Supported details indicate a high-severity issue (CVSS 3.1: 7.1) with network attack vector, low attack complexity, and low privileg...
WordPress Piotnet Addons For Elementor Pro plugin <= 7.1.67 - Arbitrary File Upload vulnerability
Arbitrary File Upload vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Piotnet Addons For Elementor Pro versions = 7.1.67...
PT-2026-71546
Subscriber Arbitrary File Download in AI Hub = 1.3.10 versions...
WordPress GiveWP plugin < 4.16.6 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Asim Alshaya in WordPress Plugin GiveWP versions 4.16.6...
WordPress Featured Image from URL plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by luc in WordPress Plugin Featured Image from URL versions = 5.3.3...
CVE-2026-14857
The WP Crowdfunding WordPress plugin is affected by an IDOR vulnerability in versions before 2.2.1. The issue arises because the plugin does not verify campaign ownership when allowing updates to a campaign’s history and sending notification emails to backers. As a result, any authenticated user ...
CVE-2026-16230
The CVE concerns the Formidable Digital Signatures plugin for WordPress, where the delete_file function fails to validate file paths in all versions up to 3.0.6. This allows unauthenticated attackers to delete files on the server by submitting an attacker-controlled filename via item_meta[field_i...
WordPress Ray Enterprise Translation plugin <= 1.7.3 - Subscriber+ Language Addition and Deletion vulnerability
Subscriber+ Language Addition and Deletion vulnerability discovered by Akshat Parikh in WordPress Plugin Ray Enterprise Translation versions = 1.7.3...
WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Taylsec in WordPress Plugin WP Directory Kit versions = 1.5.4...
WordPress Live Copy Paste for Elementor – Cross Domain Copy Paste & Page Duplicator plugin <= 1.5.4 - Cross-Site Scripting vulnerability
Cross-Site Scripting vulnerability discovered by ? in WordPress Plugin Live Copy Paste for Elementor versions = 1.5.4...
WordPress Smart Admin Assistant – Dashboard and Site Enhancements plugin <= 2.2.0 - Cross-Site Scripting vulnerability
Cross-Site Scripting vulnerability discovered by ? in WordPress Plugin Smart Admin Assistant versions = 2.2.0...
WordPress FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More plugin <= 1.9.2 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by zer0gh0st in WordPress Plugin FormGent versions = 1.9.2...
CVE-2026-72729
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discourse-local-dates plugin rendered crafted local-date format data as HTML on sites with a modified or disabled default Content Security Policy. This issue is fixed in versions 2026.1.6,...