16337 matches found
WordPress Local Delivery Drivers for WooCommerce plugin <= 3.0.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Zamaan in WordPress Plugin Local Delivery Drivers for WooCommerce versions = 3.0.0...
CVE-2026-17542
The File Manager WordPress plugin before 6.9.1 does not perform any capability check on one of its file manager connector endpoints, allowing any authenticated user, such as a subscriber, to browse the entire WordPress installation directory and download files of certain types from it, including...
CVE-2026-17020 Salon Booking System – Free Version <= 10.31.0 - Subscriber+ Arbitrary Booking PII Disclosure
The Salon Booking System WordPress plugin through 10.31.0 does not verify that a requested booking belongs to the caller on one of its REST API endpoints, requiring only a basic read capability, allowing any authenticated user including a Subscriber or self-registered customer account to disclose...
The vulnerability of the simple-file-list plugin in the WordPress content management system allows a hacker to execute arbitrary code.
The vulnerability of the simple-file-list plugin in the WordPress content management system involves unlimited loading of dangerous types of files. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
CVE-2026-48093 Code Embed - Contributor Stored Cross-Site Scripting via Remote URL Embed
The Code Embed WordPress plugin prior to version 2.6.1 is vulnerable to stored Cross-Site Scripting XSS through the external URL embed feature in post content. The vulnerable code scans rendered content for URL embed tokens, fetches the remote URL, and inserts the remote response body into the pa...
OESA-2026-3238 perl-YAML security update
The YAML.pm module implements a YAML Loader and Dumper based on the YAML 1.0 specification. http://www.yaml.org/spec/ YAML is a generic data serialization language that is optimized for human readability.It can be used to express the data structures of most modern programming languages. Including...
CVE-2026-14364 TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset via 'tbab-userid'
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to account takeover via improper password reset validation in all versions up to, and including, 1.2.3. This is due to the plugin not properly validating a user's identity before resetting their password...
CVE-2026-66709
The CVE-2026-66709 entry describes a Remote Code Execution (RCE) vulnerability in the WordPress CTX Feed plugin (CTX Feed)
CVE-2026-65549 WordPress Jeg Elementor Kit plugin <= 3.2.10 - PHP Object Injection vulnerability
Author PHP Object Injection in Jeg Kit for Elementor = 3.2.10 versions...
CVE-2026-65545
CVE-2026-65545 concerns the WordPress plugin AI Engine (versions
CVE-2026-65520 WordPress WP OAuth Server plugin <= 6.2.0 - SQL Injection vulnerability
Unauthenticated SQL Injection in WP OAuth Server = 6.2.0 versions...
CVE-2026-65517 WordPress Easy PayPal Buy Now Button plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Easy PayPal Buy Now Button = 2.0.4 versions...
CVE-2026-65509 WordPress wpDataTables plugin <= 7.5.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in wpDataTables = 7.5.1 versions...
CVE-2026-32469 WordPress CAPTCHA 4WP plugin <= 7.6.0 - Captcha Bypass vulnerability
Unauthenticated Bypass Vulnerability in CAPTCHA 4WP = 7.6.0 versions...
CVE-2026-32469 WordPress CAPTCHA 4WP plugin <= 7.6.0 - Captcha Bypass vulnerability
Unauthenticated Bypass Vulnerability in CAPTCHA 4WP = 7.6.0 versions...
CVE-2026-28177 WordPress Popup Maker plugin <= 1.23.0 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Popup Maker = 1.23.0 versions...
CVE-2026-28140 WordPress JetFormBuilder plugin <= 3.6.4.1 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in JetFormBuilder = 3.6.4.1 versions...
CVE-2026-28139
CVE-2026-28139 concerns the WordPress plugin Ajax Search Lite (vulnerable: ≤ 4.14.4). The issue is an unauthenticated PHP Object Injection in the plugin’s handling of objects, as described in CVE details and corroborated by multiple feeds. Affected component: the Ajax Search Lite plugin; root cau...
WordPress Houzez Property Feed plugin <= 2.5.48 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Houzez Property Feed versions = 2.5.48...