295198 matches found
CVE-2026-104647
The weMail WordPress plugin (versions through 2.1.6 ) contains an incorrect authorization vulnerability in its REST API permission checks. The plugin fails to properly verify user capabilities, instead granting full authorization to any user whose role is included in the plugin's allowed-roles li...
CVE-2026-106004 DT LMS <= 1.2 - Unauthenticated Arbitrary Course Completion Revocation
The DT LMS WordPress plugin through 1.2 does not perform capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to revoke any learner's course and class completion status...
WordPress DT LMS plugin <= 1.2 - Unauthenticated Arbitrary Course Completion Revocation vulnerability
Unauthenticated Arbitrary Course Completion Revocation vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin DT LMS – elearning, WordPress LMS Plugin versions = 1.2...
WordPress DT Directory Lite Addon plugin <= 1.1 - Unauthenticated Plugin Settings Update vulnerability
Unauthenticated Plugin Settings Update vulnerability discovered by Usama Arshad in WordPress Plugin DT Directory Lite Addon versions = 1.1...
Attackers Target Unpatched CryptoPayment Gateway Flaw That Can Expose Wallet Credentials
Threat actors are attempting to exploit an unpatched maximum-severity security vulnerability in the CryptoPayment Gateway WordPress plugin, according to findings from Defused Cyber. The vulnerability in question is CVE-2026-81648, which carries a CVSS score of 10.0. Successful exploitation of the...
WordPress AI Engine Plugin - Token Exposure
Unauthenticated sensitive information exposure in AI Engine WordPress plugin = 3.1.3 exposes bearer tokens via REST API endpoints when No-Auth URL is enabled. id: CVE-2025-11749 info: name: WordPress AI Engine Plugin - Token Exposure author: 4m3rr0r severity: critical description: | Unauthenticat...
CVE-2026-116675
TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted through data-mce-object in the active document before sanitization. Those elements can execute malicious scripts during processing, resulting in stored cross-si...
CVE-2026-104066
Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin when unpacking 4-bit indexed pixel data. Attackers can supply a crafted PICT file with inconsistent width and row data that, when placed or imported, writes out...
CVE-2026-104065
Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds write vulnerability in the importdrw Micrografx Draw plugin that uses an unvalidated y offset to select image scanlines. Attackers can craft a DRW file that, when imported by a user, writes decoded bitmap data outside the heap...
EUVD-2026-115649
A vulnerability was identified in Welcart e-Commerce Plugin up to 2.12.6 on WordPress. This affects the function ESCOTTMAIN::errorpagemessage of the file classes/paymentESCOTT.main.class.php. Such manipulation of the argument ResponseCd leads to cross site scripting. The attack can be launched...
CVE-2026-121554: silkimen cordova-plugin-advanced-http: cordova-plugin-advanced-http 1.5.0 through 3.3.1 contains an information disclosure vulnerability that leaks cookies to…
cordova-plugin-advanced-http 1.5.0 through 3.3.1 contains an information disclosure vulnerability that leaks cookies to third-party hosts because the JavaScript layer passes jar-built Cookie headers as ordinary request headers. When a request is redirected to another host via an open or...
CVE-2026-121509: n/a Headless CMS Plugin: A security flaw has been discovered in Headless CMS Plugin up to 2.0.4 on WordPress
A security flaw has been discovered in Headless CMS Plugin up to 2.0.4 on WordPress. This affects the function getrequiredpostdata of the file /wp-json/rae/v1/post of the component REST API. The manipulation of the argument postid/postslug results in information disclosure. The attack may be...
CVE-2026-121546: Novik ruTorrent: ruTorrent before 5.3.20 contains a path traversal vulnerability in the datadir plugin that allows authenticated users…
ruTorrent before 5.3.20 contains a path traversal vulnerability in the datadir plugin that allows authenticated users to escape the topDirectory jail because correctDirectory does not resolve symbolic links. Attackers can submit a datadir path through a symlink under their top directory to create...
CVE-2026-120597
A vulnerability was identified in Welcart e-Commerce Plugin up to 2.12.6 on WordPress. This affects the function ESCOTTMAIN::errorpagemessage of the file classes/paymentESCOTT.main.class.php. Such manipulation of the argument ResponseCd leads to cross site scripting. The attack can be launched...
CVE-2026-120597
The Welcart e-Commerce Plugin for WordPress (versions up to 2.12.6 ) is vulnerable to a remote cross-site scripting (XSS) attack. The issue originates from the ESCOTT_MAIN::error_page_message function within the classes/paymentESCOTT.main.class.php file, where the ResponseCd argument is improperl...
CVE-2026-120597 Welcart e-Commerce Plugin paymentESCOTT.main.class.php error_page_message cross site scripting
A vulnerability was identified in Welcart e-Commerce Plugin up to 2.12.6 on WordPress. This affects the function ESCOTTMAIN::errorpagemessage of the file classes/paymentESCOTT.main.class.php. Such manipulation of the argument ResponseCd leads to cross site scripting. The attack can be launched...
SUSE CVE-2026-104063
Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds read vulnerability in the Mac PICT image loader and import plugin when decoding planar pixel data. Attackers can supply a crafted PICT file with manipulated dimensions that, when placed or imported, causes heap over-reads leadi...
SUSE CVE-2026-111487
An out-of-bounds write vulnerability in the Qt Framework assimp scene import plugin of the Qt3D module...
[SECURITY] [DLA 4879-1] strongswan security update
------------------------------------------------------------------------- Debian LTS Advisory DLA-4879-1 [email protected] https://www.debian.org/lts/security/ Simon Quigley November 02, 2026 https://wiki.debian.org/LTS -...
