16337 matches found
CVE-2026-28173
The CVE-2026-28173 entry concerns the WordPress WP Event Solution plugin, versioned ≤ 4.1.19, with a vulnerability described as Customer Arbitrary Content Deletion. Supported details indicate a high-severity issue (CVSS 3.1: 7.1) with network attack vector, low attack complexity, and low privileg...
CVE-2026-28174 WordPress WP Event SOlution plugin <= 4.1.18 - Sensitive Data Exposure vulnerability
Customer Sensitive Data Exposure in WP Event SOlution = 4.1.18 versions...
WordPress Piotnet Addons For Elementor Pro plugin <= 7.1.67 - Arbitrary File Upload vulnerability
Arbitrary File Upload vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Piotnet Addons For Elementor Pro versions = 7.1.67...
WordPress Blog Floating Button plugin <= 1.4.20 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by hivesec in WordPress Plugin Blog Floating Button versions = 1.4.20...
PT-2026-71546
Subscriber Arbitrary File Download in AI Hub = 1.3.10 versions...
PT-2026-71499
Unauthenticated Cross Site Scripting XSS in MailChimp Subscribe Forms = 4.3.3 versions...
PT-2026-71548
Unauthenticated Cross Site Scripting XSS in WP-Stats = 2.56 versions...
WordPress GiveWP plugin < 4.16.6 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Asim Alshaya in WordPress Plugin GiveWP versions 4.16.6...
WordPress Featured Image from URL plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by luc in WordPress Plugin Featured Image from URL versions = 5.3.3...
CVE-2026-14857
The WP Crowdfunding WordPress plugin versions prior to 2.2.1 is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The plugin fails to verify campaign ownership, allowing any authenticated user—including those with the Subscriber role—to modify the update history of campaigns belongin...
CVE-2026-16230
The CVE concerns the Formidable Digital Signatures plugin for WordPress, where the delete_file function fails to validate file paths in all versions up to 3.0.6. This allows unauthenticated attackers to delete files on the server by submitting an attacker-controlled filename via item_meta[field_i...
WordPress Ray Enterprise Translation plugin <= 1.7.3 - Subscriber+ Language Addition and Deletion vulnerability
Subscriber+ Language Addition and Deletion vulnerability discovered by Akshat Parikh in WordPress Plugin Ray Enterprise Translation versions = 1.7.3...
WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Taylsec in WordPress Plugin WP Directory Kit versions = 1.5.4...
WordPress Live Copy Paste for Elementor – Cross Domain Copy Paste & Page Duplicator plugin <= 1.5.4 - Cross-Site Scripting vulnerability
Cross-Site Scripting vulnerability discovered by ? in WordPress Plugin Live Copy Paste for Elementor versions = 1.5.4...
WordPress Smart Admin Assistant – Dashboard and Site Enhancements plugin <= 2.2.0 - Cross-Site Scripting vulnerability
Cross-Site Scripting vulnerability discovered by ? in WordPress Plugin Smart Admin Assistant versions = 2.2.0...
WordPress FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More plugin <= 1.9.2 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by zer0gh0st in WordPress Plugin FormGent versions = 1.9.2...
CVE-2026-72729
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discourse-local-dates plugin rendered crafted local-date format data as HTML on sites with a modified or disabled default Content Security Policy. This issue is fixed in versions 2026.1.6,...
WordPress Motors plugin <= 1.4.113 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Mohamed Bassia in WordPress Plugin Motors versions = 1.4.113...
CVE-2026-66642 WordPress WP Umbrella plugin 2.24.2-2.26.2 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in WP Umbrella allows Cross Site Request Forgery. This issue affects WP Umbrella: from 2.24.2 through 2.26.2...