Lucene search
+L

231727 matches found

Cvelist
Cvelist
added 2 days ago34 views

CVE-2025-15678 Nexter Blocks < 5.0.2 - Author+ Stored XSS via SVG Upload

The Nexter Blocks WordPress plugin before 5.0.2 does not sanitize uploaded SVG files and allows SVG uploads for any user able to upload files Author by default, allowing them to upload a file containing malicious JavaScript that executes when the file is accessed, leading to Stored Cross-Site...

0.00149EPSS
SaveExploits0References1
CVE
CVE
added 2 days ago18 views

CVE-2026-13154

The CVE-2026-13154 entry concerns the Gutenberg Essential Blocks WordPress plugin, affected versions are before 6.4.0. The issue arises because the plugin does not verify that an attacker-supplied post type is publicly viewable before querying it in a public REST route, enabling unauthenticated u...

7.5CVSS5.3AI score0.00256EPSS
SaveExploits0References1
EUVD
EUVD
added 2 days ago7 views

EUVD-2026-53728

The EONSR AEO Agent WordPress plugin through 3.7.9 does not perform any authorisation check on one of its REST API routes and disables HTML sanitisation before saving the post, allowing unauthenticated attackers to create administrator-attributed published posts containing arbitrary web scripts...

6.1CVSS5.8AI score0.00162EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2 days ago7 views

CVE-2026-18395

The Child Pages Card WordPress plugin before 1.09 does not sanitise and escape some of its shortcode attributes before outputting them back in a page, allowing users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

5.4CVSS5.5AI score0.00133EPSS
SaveExploits0References1
CVE
CVE
added 2 days ago18 views

CVE-2026-18395

The CVE refers to the WordPress plugin Child Pages Card, affected before version 1.09. The flaw is improper sanitisation/escaping of shortcode attributes, enabling Stored XSS for users with the contributor role and above when rendering pages. No exploit details or patches are provided in the conn...

5.4CVSS5.5AI score0.00133EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2 days ago31 views

CVE-2026-16537 Slick Slider < 0.5.3 - Contributor+ Stored XSS via Gallery Shortcode

The Slick Slider WordPress plugin before 0.5.3 does not sanitize and escape a shortcode attribute value before outputting it in an HTML attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute when a user views the affected post...

0.00133EPSS
SaveExploits0References1
EUVD
EUVD
added 2 days ago6 views

EUVD-2026-53731

The Welcart e-Commerce WordPress plugin before 2.11.32 does not properly sanitise a value taken from an imported CSV file before using it in a SQL statement, allowing users with the Editor role and above including its custom shop-management roles to perform SQL injection attacks...

6.5CVSS5.7AI score0.00231EPSS
SaveExploits0References1
CVE
CVE
added 2 days ago20 views

CVE-2026-16065

CVE-2026-16065 affects the Welcart e-Commerce WordPress plugin prior to 2.11.32. The issue is a lack of sanitisation of a value from an imported CSV file used in a SQL statement, enabling SQL injection by users with Editor role or higher (including custom shop-management roles). Reported CVSSv3.1...

6.5CVSS5.7AI score0.00231EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2 days ago7 views

CVE-2026-16537

The Slick Slider WordPress plugin before 0.5.3 does not sanitize and escape a shortcode attribute value before outputting it in an HTML attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute when a user views the affected post...

5.4CVSS5.6AI score0.00133EPSS
SaveExploits0References1
EUVD
EUVD
added 2 days ago5 views

EUVD-2026-53733

The Slick Slider WordPress plugin before 0.5.3 does not sanitize and escape a shortcode attribute value before outputting it in an HTML attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute when a user views the affected post...

5.4CVSS5.6AI score0.00133EPSS
SaveExploits0References1
CVE
CVE
added 2 days ago20 views

CVE-2026-11588

The CVE-2026-11588 entry concerns the EONSR AEO Agent WordPress plugin up to version 3.7.9. The issue arises because there is no authorization check on a REST API route and HTML sanitisation is disabled before saving a post, enabling unauthenticated attackers to create administrator-attributed pu...

6.1CVSS5.8AI score0.00162EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2 days ago31 views

CVE-2026-14829 Checkimate <= 1.0.13 - Unauthenticated License Deactivation via Hardcoded Secret

The Checkimate — WooCommerce Checkout, Abandoned Cart Recovery & Order Bumps WordPress plugin through 1.0.13 does not properly restrict access to its license-management functionality, relying on a shared secret computed entirely from publicly available information, allowing unauthenticated...

0.00193EPSS
SaveExploits0References1
EUVD
EUVD
added 2 days ago8 views

EUVD-2026-53732

The Child Pages Card WordPress plugin before 1.09 does not sanitise and escape some of its shortcode attributes before outputting them back in a page, allowing users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

5.4CVSS5.5AI score0.00133EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2 days ago5 views

CVE-2026-16065

The Welcart e-Commerce WordPress plugin before 2.11.32 does not properly sanitise a value taken from an imported CSV file before using it in a SQL statement, allowing users with the Editor role and above including its custom shop-management roles to perform SQL injection attacks...

6.5CVSS5.7AI score0.00231EPSS
SaveExploits0References1
CVE
CVE
added 2 days ago23 views

CVE-2026-14829

The CVE concerns the Checkimate — WooCommerce Checkout, Abandoned Cart Recovery & Order Bumps WordPress plugin (

8.2CVSS5.5AI score0.00193EPSS
SaveExploits0References1
EUVD
EUVD
added 2 days ago6 views

EUVD-2026-53729

The Checkimate — WooCommerce Checkout, Abandoned Cart Recovery & Order Bumps WordPress plugin through 1.0.13 does not properly restrict access to its license-management functionality, relying on a shared secret computed entirely from publicly available information, allowing unauthenticated...

8.2CVSS5.5AI score0.00193EPSS
SaveExploits0References1
EUVD
EUVD
added 2 days ago6 views

EUVD-2026-53726

The AI Engine WordPress plugin before 3.6.4 does not redact secret configuration values before exposing them in an admin page's inline script data, allowing users with the Editor role to read the site's stored third-party API key and authentication tokens in cleartext, despite those secrets being...

6.5CVSS5.5AI score0.00249EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2 days ago34 views

CVE-2026-16734 Stripe Payment Forms by WP Full Pay < 8.5.2 - Unauthenticated Payment Intent Amount Manipulation

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.2 does not verify that the caller owns the Stripe payment intent referenced by two unauthenticated payment-form AJAX actions, allowing an unauthenticated visitor — using a nonce that is embedded in every public page containing a...

0.00202EPSS
SaveExploits0References1
CVE
CVE
added 2 days ago17 views

CVE-2026-16954

The CVE concerns the AI Engine WordPress plugin prior to version 3.6.4. The vulnerability stems from not redacting secret configuration values before they are exposed in an admin page’s inline script data, enabling users with the Editor role to read stored third-party API keys and authentication ...

6.5CVSS5.5AI score0.00249EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2 days ago35 views

CVE-2026-16954 AI Engine < 3.6.4 - Editor+ Sensitive Information Disclosure of API Key and Bearer Tokens

The AI Engine WordPress plugin before 3.6.4 does not redact secret configuration values before exposing them in an admin page's inline script data, allowing users with the Editor role to read the site's stored third-party API key and authentication tokens in cleartext, despite those secrets being...

0.00249EPSS
SaveExploits0References1
Rows per page
Query Builder