Lucene search
+L

231825 matches found

Cvelist
Cvelist
added 4 days ago34 views

CVE-2026-17505 TranslatePress <= 3.2.5 - Reflected Cross-Site Scripting

The Translate Multilingual sites – TranslatePress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in versions up to, and including, 3.2.5. This is due to the translatepage function unconditionally replacing the plugin's internal !trpst and !trpen marker...

6.1CVSS0.00672EPSS
SaveExploits0References5
EUVD
EUVD
added 4 days ago7 views

EUVD-2026-53176

The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.0.5. This is due to insufficient output escaping on form shortcode keys displayed in the admin "Scan Forms for Post Meta and User Data Keys" page...

4.4CVSS5.7AI score0.00297EPSS
SaveExploits0References4
Cvelist
Cvelist
added 4 days ago33 views

CVE-2026-11454 Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.5.2 - Insecure Direct Object Reference

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.5.2 via the GET /wp-json/gh/v4/contacts/ REST endpoint. The endpoint's permission callback checks only the role-level...

6.5CVSS0.00395EPSS
SaveExploits0References9
EUVD
EUVD
added 4 days ago5 views

EUVD-2026-53177

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.5.2 via the GET /wp-json/gh/v4/contacts/ REST endpoint. The endpoint's permission callback checks only the role-level...

6.5CVSS5.5AI score0.00395EPSS
SaveExploits0References9
CVE
CVE
added 4 days ago15 views

CVE-2026-17532

Summary: CVE-2026-17532 affects the Seraphinite Accelerator WordPress plugin (≤ 2.29.15). It allows unauthenticated users to perform a reflected XSS via the seraph_accel_prep parameter. Root cause per the CVE description: a loose PHP comparison in CacheExtractPreparePageParams() (using != against...

6.1CVSS5.8AI score0.00347EPSS
SaveExploits1References9
Vulnrichment
Vulnrichment
added 4 days ago6 views

CVE-2026-5116 Contact Form 7 – Dynamic Text Extension <= 5.0.5 - Authenticated (Editor+) Stored Cross-Site Scripting

The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.0.5. This is due to insufficient output escaping on form shortcode keys displayed in the admin "Scan Forms for Post Meta and User Data Keys" page...

4.4CVSS5.7AI score0.00297EPSS
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 4 days ago5 views

CVE-2026-5116

The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.0.5. This is due to insufficient output escaping on form shortcode keys displayed in the admin "Scan Forms for Post Meta and User Data Keys" page...

4.4CVSS5.7AI score0.00297EPSS
SaveExploits0References5
Cvelist
Cvelist
added 4 days ago32 views

CVE-2026-17532 Seraphinite Accelerator <= 2.29.18 - Reflected Cross-Site Scripting

The Seraphinite Accelerator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'seraphaccelprep' parameter in versions up to, and including, 2.29.15. This is due to the CacheExtractPreparePageParams function using PHP's loose inequality operator != to compare the expecte...

6.1CVSS0.00347EPSS
SaveExploits1References9
CVE
CVE
added 4 days ago29 views

CVE-2026-5116

The vulnerability CVE-2026-5116 affects the WordPress plugin Contact Form 7 – Dynamic Text Extension (versions

4.4CVSS5.7AI score0.00297EPSS
SaveExploits0References4
EUVD
EUVD
added 4 days ago7 views

EUVD-2026-53175

The Seraphinite Accelerator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'seraphaccelprep' parameter in versions up to, and including, 2.29.15. This is due to the CacheExtractPreparePageParams function using PHP's loose inequality operator != to compare the expecte...

6.1CVSS5.8AI score0.00347EPSS
SaveExploits1References9
CVE
CVE
added 4 days ago29 views

CVE-2026-11454

The Groundhogg WordPress plugin (versions &lt;= 4.5.2) is affected by an Insecure Direct Object Reference via GET /wp-json/gh/v4/contacts/. The endpoint’s permission callback only checks a role-level view_contacts capability, and read_single() returns full contact records without object-level own...

6.5CVSS5.5AI score0.00395EPSS
SaveExploits0References9
EUVD
EUVD
added 4 days ago7 views

EUVD-2026-53173

The WPFormify – Stripe Payments with Form and Checkout plugin for WordPress is vulnerable to unauthorized modification and deletion of Stripe payment credentials in all versions up to, and including, 1.1.1. This is due to missing capability checks and nonce verification on the...

8.2CVSS5.5AI score0.00616EPSS
SaveExploits0References4
Cvelist
Cvelist
added 4 days ago36 views

CVE-2026-6627 WPFormify <= 1.1.1 - Missing Authorization

The WPFormify – Stripe Payments with Form and Checkout plugin for WordPress is vulnerable to unauthorized modification and deletion of Stripe payment credentials in all versions up to, and including, 1.1.1. This is due to missing capability checks and nonce verification on the...

8.2CVSS0.00616EPSS
SaveExploits0References4
Cvelist
Cvelist
added 4 days ago35 views

CVE-2026-6079 Material Dashboard <= 1.4.10 - Missing Authorization to Unauthenticated Task Enumeration, Execution, and Deletion

The Material Dashboard plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on the amdajaxtargettaskmanager function in all versions up to, and including, 1.4.10. This makes it possible for unauthenticated attackers to enumerate all...

7.3CVSS0.00394EPSS
SaveExploits0References4
CVE
CVE
added 4 days ago26 views

CVE-2026-6627

WPFormify – Stripe Payments with Form and Checkout plugin for WordPress: CVE-2026-6627, all versions

8.2CVSS5.5AI score0.00616EPSS
SaveExploits0References4
Cvelist
Cvelist
added 4 days ago38 views

CVE-2026-7726 Layouts for WPBakery <= 1.1.3 - Missing Authorization to Unauthenticated Template Cache Manipulation via 'handle_sync' AJAX Action

The Layouts for WPBakery plugin for WordPress is vulnerable to unauthorized actions due to a missing capability check on the LayoutsWPBRemote::templatesync callback registered via wpajaxnoprivhandlesync in all versions up to, and including, 1.1.3. This makes it possible for unauthenticated...

6.5CVSS0.00267EPSS
SaveExploits0References6
EUVD
EUVD
added 4 days ago6 views

EUVD-2026-53171

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.6. This is due to the getCurrentTaskResults method in modules/workspace/controller.php being accessible without authentication or authorizati...

7.5CVSS5.5AI score0.00367EPSS
SaveExploits0References6
Cvelist
Cvelist
added 4 days ago33 views

CVE-2026-6639 AI Chatbot & Workflow Automation by AIWU <= 1.4.6 - Missing Authorization to Unauthenticated Sensitive Information Exposure

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.6. This is due to the getCurrentTaskResults method in modules/workspace/controller.php being accessible without authentication or authorizati...

7.5CVSS0.00367EPSS
SaveExploits0References6
CVE
CVE
added 4 days ago30 views

CVE-2026-6639

The CVE concerns the AI Chatbot & Workflow Automation by AIWU WordPress plugin (

7.5CVSS5.5AI score0.00367EPSS
SaveExploits0References6
EUVD
EUVD
added 4 days ago6 views

EUVD-2026-53170

The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to unauthorized arbitrary media deletion in all versions up to, and including, 1.1.8. This is due to missing capability checks in the pluploadajaxdeletefile function, which is registered via wpajaxnoprivgfmudeletefile. The...

9.1CVSS5.6AI score0.00456EPSS
SaveExploits0References6
Rows per page
Query Builder