Lucene search
+L

231825 matches found

CVE
CVE
added 4 days ago24 views

CVE-2026-6972

The CVE-2026-6972 entry concerns the SKT Skill Bar WordPress plugin (

6.4CVSS5.7AI score0.00201EPSS
SaveExploits0References6
Cvelist
Cvelist
added 4 days ago35 views

CVE-2026-7441 Simple Yearly Archive <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Simple Yearly Archive plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the posttype attribute of the SimpleYearlyArchive shortcode in all versions up to, and including, 2.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This make...

6.4CVSS0.00201EPSS
SaveExploits0References6
EUVD
EUVD
added 4 days ago4 views

EUVD-2026-53185

The Simple Yearly Archive plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the posttype attribute of the SimpleYearlyArchive shortcode in all versions up to, and including, 2.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This make...

6.4CVSS5.7AI score0.00201EPSS
SaveExploits0References6
Cvelist
Cvelist
added 4 days ago38 views

CVE-2026-7444 Search Analytics for WP <= 1.4.16 - Cross-Site Request Forgery

The Search Analytics for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.16. This is due to missing or incorrect nonce validation on the processbulkaction function of MWTSAStatsTable. This makes it possible for unauthenticated attacker...

8.1CVSS0.00168EPSS
SaveExploits0References8
EUVD
EUVD
added 4 days ago5 views

EUVD-2026-53186

The SKT Skill Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the chartsize attribute of the skillwrapper shortcode in all versions up to, and including, 2.6. This is due to insufficient input sanitization and output escaping on the chartsize attribute, which is...

6.4CVSS5.7AI score0.00201EPSS
SaveExploits0References6
CVE
CVE
added 4 days ago25 views

CVE-2026-7441

Technical details are not publicly available in the provided documents. Monitor for updates.

6.4CVSS5.7AI score0.00201EPSS
SaveExploits0References6
CVE
CVE
added 4 days ago31 views

CVE-2026-7444

CVE-2026-7444 affects the WordPress plugin Search Analytics for WP (

8.1CVSS5.7AI score0.00168EPSS
SaveExploits0References8
Cvelist
Cvelist
added 4 days ago33 views

CVE-2026-5651 Askeet <= 3.0 - Authenticated (Administrator+) SQL Injection via 'sql_query' Parameter

The Askeet plugin for WordPress is vulnerable to SQL Injection via the 'sqlquery' parameter in multiple AJAX actions askeetexecutesqlquery, askeetexportallresults in all versions up to, and including, 3.0. This is due to the askeetissafequery filter being bypassable using MySQL conditional commen...

4.9CVSS0.00378EPSS
SaveExploits0References6
CVE
CVE
added 4 days ago27 views

CVE-2026-5651

The CVE-2026-5651 entry concerns the WordPress plugin Askeet (versions up to 3.0). Affected component: the plugin’s AJAX actions (askeet_execute_sql_query, askeet_export_all_results) that take the sql_query parameter. Root cause: the askeet_is_safe_query() filter is bypassable via MySQL condition...

4.9CVSS5.8AI score0.00378EPSS
SaveExploits0References6
EUVD
EUVD
added 4 days ago5 views

EUVD-2026-53183

The Askeet plugin for WordPress is vulnerable to SQL Injection via the 'sqlquery' parameter in multiple AJAX actions askeetexecutesqlquery, askeetexportallresults in all versions up to, and including, 3.0. This is due to the askeetissafequery filter being bypassable using MySQL conditional commen...

4.9CVSS5.8AI score0.00378EPSS
SaveExploits0References6
Cvelist
Cvelist
added 4 days ago37 views

CVE-2026-7693 Backup Migration <= 2.1.5.1 - Authenticated (Administrator+) OS Command Injection via 'file' Parameter

The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 2.1.5.1 due to insufficient sanitization of the file POST parameter on the restoreBackup AJAX handler. The handler applies escattr — an HTML-context sanitizer that does not strip...

7.2CVSS0.02233EPSS
SaveExploits0References8
CVE
CVE
added 4 days ago24 views

CVE-2026-18881

CVE-2026-18881 affects the TableOn WordPress Posts Table Filterable plugin for WordPress, up to version 1.0.5.1. The vulnerability is a blind SQL injection in the public AJAX action tableon_get_table_data, triggered by the parameter filter_data[comment_count]. The value is split on ":" and interp...

7.5CVSS5.8AI score0.00376EPSS
SaveExploits0References5
CVE
CVE
added 4 days ago29 views

CVE-2026-7693

CVE-2026-7693 affects the WordPress Backup Migration plugin up to version 2.1.5.1. The vulnerability is OS Command Injection via the restoreBackup() AJAX handler, where the file POST parameter is sanitized with esc_attr() (HTML-context) and then concatenated unquoted into a php-cli -f … bmi_resto...

7.2CVSS6.5AI score0.02233EPSS
SaveExploits0References8
Cvelist
Cvelist
added 4 days ago32 views

CVE-2026-6147 LightSync Pro <= 2.1.6 - Authenticated (Author+) Arbitrary File Upload

The LightSync Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the restreplacemedia function in all versions up to, and including, 2.1.6. This makes it possible for authenticated attackers, with Author-level access and above, to upload...

8.8CVSS0.00657EPSS
SaveExploits0References4
Cvelist
Cvelist
added 4 days ago37 views

CVE-2026-18881 TableOn <= 1.0.5.1 - Unauthenticated Blind SQL Injection via 'comment_count' Filter Parameter

The TableOn – WordPress Posts Table Filterable plugin for WordPress is vulnerable to blind SQL Injection via the filterdatacommentcount parameter of the public tableongettabledata AJAX action in all versions up to, and including, 1.0.5.1. This is due to insufficient escaping on the user-supplied...

7.5CVSS0.00376EPSS
SaveExploits0References5
EUVD
EUVD
added 4 days ago6 views

EUVD-2026-53181

The TableOn – WordPress Posts Table Filterable plugin for WordPress is vulnerable to blind SQL Injection via the filterdatacommentcount parameter of the public tableongettabledata AJAX action in all versions up to, and including, 1.0.5.1. This is due to insufficient escaping on the user-supplied...

7.5CVSS5.8AI score0.00376EPSS
SaveExploits0References5
CVE
CVE
added 4 days ago29 views

CVE-2026-15281

The WordPress plugin User Access Manager (v

6.5CVSS5.8AI score0.00336EPSS
SaveExploits0References6
Cvelist
Cvelist
added 4 days ago34 views

CVE-2026-15281 User Access Manager <= 2.3.12 - Authenticated (Subscriber+) SQL Injection

The User Access Manager plugin for WordPress is vulnerable to Second-Order SQL Injection via the 'id' parameter of the wpajaxsave-attachment-compat AJAX action in versions up to, and including, 2.3.12. This is due to insufficient validation on the objectId value stored in the saveAjaxAttachmentDa...

6.5CVSS0.00336EPSS
SaveExploits0References6
EUVD
EUVD
added 4 days ago5 views

EUVD-2026-53179

The User Access Manager plugin for WordPress is vulnerable to Second-Order SQL Injection via the 'id' parameter of the wpajaxsave-attachment-compat AJAX action in versions up to, and including, 2.3.12. This is due to insufficient validation on the objectId value stored in the saveAjaxAttachmentDa...

6.5CVSS5.8AI score0.00336EPSS
SaveExploits0References6
CVE
CVE
added 4 days ago29 views

CVE-2026-17505

The CVE covers TranslatePress

6.1CVSS5.8AI score0.00672EPSS
SaveExploits0References5
Rows per page
Query Builder