16337 matches found
WordPress Advanced Excerpt plugin < 4.5 - Admin+ Stored XSS via Ellipsis Setting vulnerability
Admin+ Stored XSS via Ellipsis Setting vulnerability discovered by Mustafa Ahmed in WordPress Plugin Advanced Excerpt versions 4.5...
WordPress Google Authenticator plugin < 0.56 - 2FA Secret Overwrite via CSRF vulnerability
2FA Secret Overwrite via CSRF vulnerability discovered by Miguel Mendez Z in WordPress Plugin Google Authenticator versions 0.56...
WordPress GeoDirectory plugin <= 2.8.173 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by dunvu0 in WordPress Plugin GeoDirectory versions = 2.8.173...
WordPress JetEngine plugin <= 3.8.14 - Remote Code Execution (RCE) vulnerability
Remote Code Execution RCE vulnerability discovered by dutafi in WordPress Plugin JetEngine versions = 3.8.14...
WordPress Kalles Addons plugin <= 1.0.6 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Kalles Addons versions = 1.0.6...
WordPress Flexible Subscriptions plugin <= 1.8.1 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Van Phuc in WordPress Plugin Flexible Subscriptions versions = 1.8.1...
WordPress BBQ Pro plugin <= 3.9 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin BBQ Pro versions = 3.9...
WordPress Maps Marker Pro plugin <= 4.32 - SQL Injection vulnerability
SQL Injection vulnerability discovered by johska in WordPress Plugin Maps Marker Pro versions = 4.32...
CVE-2026-19709 Membership For WooCommerce < 3.1.2 - Unauthenticated Member Data Disclosure via REST Consumer Secret Bypass
The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to reach its REST routes and disclose any user's membership plan detail...
EUVD-2026-62210
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in David Lingren Media LIbrary Assistant allows Stored XSS. This issue affects Media LIbrary Assistant: from n/a through 3.39...
WordPress Media LIbrary Assistant plugin <= 3.39 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Abdullah Kareem "cyberkareem" in WordPress Plugin Media LIbrary Assistant versions = 3.39...
CVE-2026-66603 WordPress Draft List plugin <= 2.6.4 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in David Artiss Draft List simple-draft-list allows Stored XSS. This issue affects Draft List: from n/a through 2.6.4...
WordPress Gallery for Google Photos plugin < 1.2.1 - Unauthenticated Google OAuth Token Disclosure vulnerability
Unauthenticated Google OAuth Token Disclosure vulnerability discovered by Pablo González and Fran Ramírez in WordPress Plugin Gallery For Google Photos versions 1.2.1...
WordPress ShopMonitor.io plugin < 1.2.0 - Unauthenticated Administrator Account Takeover vulnerability
Unauthenticated Administrator Account Takeover vulnerability discovered by Pedro Pinho in WordPress Plugin ShopMonitor.io versions 1.2.0...
WordPress User Profile Builder plugin < 3.16.4 - Unauthenticated Account Takeover vulnerability
Unauthenticated Account Takeover vulnerability discovered by Jakub Herman in WordPress Plugin Profile Builder versions 3.16.4...
CVE-2026-74012
Deserialization of Untrusted Data vulnerability in TaxoPress allows Object Injection. This issue affects TaxoPress: from n/a through 3.51.0...
CVE-2026-32547
Unauthenticated Cross Site Scripting XSS in BP Better Messages = 2.15.22 versions...
CVE-2026-73996
The Masteriyo LMS WordPress plugin (≤2.3.2) allows unauthenticated arbitrary file uploads, enabling remote code execution on affected sites. Patchstack rates it Critical (CVSS 9.8). No patch version or exploitation evidence is provided in the documents.