16337 matches found
WordPress Xendit Payment plugin <= 7.1.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Mitchell in WordPress Plugin Xendit Payment versions = 7.1.0...
WordPress Easy Digital Downloads plugin <= 3.6.9 - Arbitrary File Deletion vulnerability
Arbitrary File Deletion vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Easy Digital Downloads versions = 3.6.9...
WordPress Download Manager plugin < 3.3.62 - Unauthorized Protected File Download vulnerability
Unauthorized Protected File Download vulnerability discovered by Alessandro Greco aka Aleff, Giovanbattista Ianni University of Calabria - UNICAL in WordPress Plugin Download Manager versions 3.3.62...
CVE-2026-14235
The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to the requesting session nor expire it promptly, making the token a long-lived, multi-use, portable bearer token, so that an attacker who obtains one leaked download key can repeatedly download a role-...
CVE-2026-13714 Realtyna Organic IDX plugin + WPL Real Estate < 5.3.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution
The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.3.0 does not validate the type of uploaded files, and its file upload functionality is gated only by an API that is enabled by default and authenticated with hardcoded credentials shipped identically across all...
CVE-2026-13714
The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.3.0 does not validate the type of uploaded files, and its file upload functionality is gated only by an API that is enabled by default and authenticated with hardcoded credentials shipped identically across all...
WordPress Advanced Ads plugin < 2.0.23 - Contributor+ Stored XSS vulnerability
Contributor+ Stored XSS vulnerability discovered by Pablo González and Francisco José Ramírez in WordPress Plugin Advanced Ads versions 2.0.23...
PT-2026-64955
Author Cross Site Scripting XSS in Orbit Fox by ThemeIsle = 3.0.7 versions...
PT-2026-64832
The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication has been disabled for the targeted account, allowing an unauthenticated attacker to obtain a valid authentication session as that account,...
CVE-2026-8789 Easy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Arbitrary Connection Deletion
The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the eadeletemultipleconnections AJAX action in all versions up to, and including, 3.12.27. This makes it possible for authenticated...
WordPress MapPress Maps for WordPress plugin <= 2.97.6 - Sensitive Data Exposure vulnerability
Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin MapPress Maps for WordPress versions = 2.97.6...
PT-2026-64255
The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'category id' parameter in all versions up to, and including, 1.8.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...
PT-2026-64410
Name of the Vulnerable Software and Affected Versions Milkdown versions prior to 7.21.3 Description A DOM cross-site scripting issue exists in the @milkdown/plugin-emoji package. Unauthenticated attackers can execute arbitrary JavaScript in the host application origin by tricking a victim into...
CVE-2026-15981
CVE-2026-15981 is a critical (CVSS 9.8) unauthenticated authentication bypass in the miniOrange SAML 2.0 Single Sign On – SSO Login WordPress plugin (≤ 5.4.4). The root cause is a loose boolean check in mo_saml_validate_signature(): PHP's openssl_verify() returns -1 on internal error, which evalu...
WordPress Visualizer – Tables & Charts Manager with Built-in AI Generator plugin <= 4.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Visualizer versions = 4.0.5...
CVE-2026-65897 Grav API Plugin 1.0.9 Privilege Escalation via Invitations groups
Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create, allowing authenticated api.users.write callers to assign invited accounts to groups that grant api.super permissions. Attackers can create invitation records with elevated group membership,...
CVE-2026-65534 WordPress Custom links in Elementor Image Carousel plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability
Author Cross Site Scripting XSS in Custom links in Elementor Image Carousel = 1.1.1 versions...
CVE-2026-65527 WordPress LIQUID SPEECH BALLOON plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in LIQUID SPEECH BALLOON = 1.2.5 versions...