16337 matches found
WordPress Tutor LMS – eLearning and online course solution plugin <= 3.9.13 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability
Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by skyv3il - aisafe.io in WordPress Plugin Tutor LMS versions = 3.9.13...
WordPress GiveWP – Donation Plugin and Fundraising Platform plugin <= 4.16.0 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability
Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by AmonRa in WordPress Plugin GiveWP versions = 4.16.0...
WordPress ShortPixel Adaptive Images plugin <= 3.11.3 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by dodoh4t in WordPress Plugin ShortPixel Adaptive Images versions = 3.11.3...
WordPress Business Directory plugin <= 6.4.23 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by John Umoru in WordPress Plugin Business Directory versions = 6.4.23...
CVE-2026-10083
The APCu Manager WordPress plugin (versions before 4.5.0 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to escape APCu object-cache keys before rendering them on an admin-area page. If a persistent object cache is active, an unauthenticated attacker can provi...
PT-2026-61527
Name of the Vulnerable Software and Affected Versions All-in-One WP Migration and Backup versions prior to 7.106 Description An issue exists where a user-supplied value is not properly sanitized before being used to construct a file path. This allows unauthenticated attackers to create or append ...
CVE-2026-11597
The Surbma | Infusionsoft Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'infusionsoft-form' shortcode in versions up to, and including, 2.0.1. This is due to insufficient input sanitization and output escaping on user-supplied 'account' and 'id' shortcode...
CVE-2026-13295
The CVE-2026-13295 entry concerns the Page Builder by SiteOrigin WordPress plugin. A stored XSS vulnerability affects all versions up to 2.34.3, caused by insufficient input sanitization and output escaping of the panels_data parameter. Authenticated users with Contributor-level access and above ...
CVE-2026-11783 Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.4 - Authenticated (Custom+) Stored Cross-Site Scripting via Product SKU
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Product SKU in all versions up to, and including, 5.0.4 due to insufficient input sanitization and output escaping. This mak...
EUVD-2026-39945
The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 9.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated...
WordPress Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin <= 5.0.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Information Disclosure vulnerability
Authenticated Subscriber+ Insecure Direct Object Reference to Information Disclosure vulnerability discovered by 0xHerc - IntegSec in WordPress Plugin Dokan versions = 5.0.4...
WordPress Surbma | Infusionsoft Shortcode plugin <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zakaria in WordPress Plugin Surbma | Infusionsoft Shortcode versions = 2.0.1...
CVE-2026-57648 WordPress Nelio Content plugin <= 4.3.4 - Broken Access Control vulnerability
Contributor Broken Access Control in Nelio Content = 4.3.4 versions...
CVE-2026-57649 WordPress Shoppable Images Lite plugin <= 1.3 - Broken Access Control vulnerability
Subscriber Broken Access Control in Shoppable Images Lite = 1.3 versions...
CVE-2026-57633
CVE-2026-57633 describes an unauthenticated sensitive data exposure affecting the WordPress plugin WCBoost – Products Compare for versions up to 1.1.0 . The connected sources confirm the affected component and the exposure but do not provide attacker vectors, specific data exposed, root cause det...
CVE-2026-57321 WordPress H5P plugin <= 1.17.7 - Arbitrary File Deletion vulnerability
Contributor Arbitrary File Deletion in H5P = 1.17.7 versions...
CVE-2026-57316
CVE-2026-57316 concerns the WordPress GetGenie plugin (versions up to 4.4.2). The issue is described as Subscriber Sensitive Data Exposure, indicating that subscriber data may be exposed due to a vulnerability in the affected plugin. The CVSS 3.1 data in the initial document assigns a base score ...
CVE-2026-57316 WordPress GetGenie plugin <= 4.4.2 - Sensitive Data Exposure vulnerability
Subscriber Sensitive Data Exposure in GetGenie = 4.4.2 versions...