236770 matches found
CVE-2026-11882 Builderall for WordPress < 3.0.2 - Unauthenticated OAuth Access Token Poisoning via Public REST Routes
The Builderall for WordPress plugin before 3.0.2 does not bind the state value of its public OAuth authentication routes to the initiating user session, allowing unauthenticated attackers to complete the connection flow and overwrite the stored third-party integration access token. A durable...
CVE-2026-10827 Spectra (Ultimate Addons for Gutenberg) < 2.20.0 - Contributor+ Stored CSS Injection via Block Attributes
The Spectra Legacy WordPress plugin before 2.20.0 does not validate or escape several block style attributes before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into the pages that render the affected block. Th...
CVE-2026-13329
The Buckaroo Woocommerce Payments Plugin WordPress plugin before 4.9.0 does not perform any capability check or nonce validation on an AJAX action that processes payment capture refunds, allowing any authenticated user, including Subscribers, to trigger refunds against captured orders...
CVE-2026-13158
The Everest Toolkit WordPress plugin through 1.2.3 does not validate the type of files uploaded during demo-content import the WordPress file-type test is disabled, allowing high-privilege users Administrator by default, including non-super-admin site administrators on multisite to upload...
EUVD-2026-51714
The Everest Toolkit WordPress plugin through 1.2.3 does not validate the type of files uploaded during demo-content import the WordPress file-type test is disabled, allowing high-privilege users Administrator by default, including non-super-admin site administrators on multisite to upload...
CVE-2026-15234
The CVE-2026-15234 vulnerability affects the WordPress plugin Codeless Page Builder (≤ 1.1.4). The underlying issue is that a shortcode attribute is not sanitized/validated before being used as an HTML tag name during content rendering. This allows users with contributor-level access and above to...
CVE-2026-13158 Everest Toolkit <= 1.2.3 - Admin+ Arbitrary File Upload
The Everest Toolkit WordPress plugin through 1.2.3 does not validate the type of files uploaded during demo-content import the WordPress file-type test is disabled, allowing high-privilege users Administrator by default, including non-super-admin site administrators on multisite to upload...
CVE-2026-15234 Codeless Page Builder <= 1.1.4 - Contributor+ Stored XSS via Shortcode Attribute
The Codeless Page Builder WordPress plugin through 1.1.4 does not sanitize or validate a shortcode attribute before using it as an HTML tag name when rendering content, allowing users with contributor-level access and above to inject arbitrary HTML and JavaScript that executes in the session of a...
EUVD-2026-51716
The Admin Columns for ACF Fields WordPress plugin through 0.3.2 does not escape Advanced Custom Fields values before outputting them in the WordPress admin list-table columns, allowing users with contributor-level access or above to store a payload that executes as JavaScript in the session of...
CVE-2026-13158
The Everest Toolkit WordPress plugin (versions 1.2.3) and implement proper upload handling (e.g., using WordPress wp_handle_upload with strict whitelisting) plus server rules to prevent PHP execution in uploads. If exploiting evidence exists, PoCs or in-wild links are mentioned within connected ...
CVE-2026-15262
The Admin Columns for ACF Fields WordPress plugin through 0.3.2 does not escape Advanced Custom Fields values before outputting them in the WordPress admin list-table columns, allowing users with contributor-level access or above to store a payload that executes as JavaScript in the session of...
CVE-2026-15234
The Codeless Page Builder WordPress plugin through 1.1.4 does not sanitize or validate a shortcode attribute before using it as an HTML tag name when rendering content, allowing users with contributor-level access and above to inject arbitrary HTML and JavaScript that executes in the session of a...
CVE-2026-14836
The CVE-2026-14836 entry concerns the Login & Register Forms WordPress plugin prior to 3.2.5. The vulnerability arises from improper enforcement of the rate limit on the password-reset verification-code flow, where both the verification code and the per-source attempt counter are keyed on an unau...
EUVD-2026-51717
The User Profile Builder WordPress plugin before 3.16.4 does not correctly bind the automatic login performed after user registration to the newly created account, allowing unauthenticated attackers to obtain an authenticated session for an arbitrary existing user, including administrators, on...
CVE-2026-15244
The HUSKY WordPress plugin before 1.4.1 does not sanitize a stored setting value against directory traversal before concatenating it into a file inclusion path, allowing users with the shop manager capability to cause the inclusion and execution of arbitrary local files, which is then triggered o...
CVE-2026-15244
CVE-2026-15244 affects the HUSKY WordPress plugin prior to 1.4.1. A stored setting value is not sanitized against directory traversal before being concatenated into a file inclusion path, enabling a user with the shop manager capability to cause inclusion and execution of arbitrary local files. T...
CVE-2026-15368
The CVE describes a vulnerability in the WordPress plugin User Profile Builder, affecting versions prior to 3.16.4. The flaw permits an unauthenticated attacker to obtain an authenticated session on an existing user (including administrators) by abusing the automatic login after registration on s...
CVE-2026-15368
The User Profile Builder WordPress plugin before 3.16.4 does not correctly bind the automatic login performed after user registration to the newly created account, allowing unauthenticated attackers to obtain an authenticated session for an arbitrary existing user, including administrators, on...
CVE-2026-15368 Profile Builder < 3.16.4 - Unauthenticated Account Takeover via Auto-Login After Registration
The User Profile Builder WordPress plugin before 3.16.4 does not correctly bind the automatic login performed after user registration to the newly created account, allowing unauthenticated attackers to obtain an authenticated session for an arbitrary existing user, including administrators, on...
CVE-2026-15244 HUSKY - Products Filter Professional for WooCommerce < 1.4.1 - Shop Manager+ Local File Inclusion via meta_filter search_view
The HUSKY WordPress plugin before 1.4.1 does not sanitize a stored setting value against directory traversal before concatenating it into a file inclusion path, allowing users with the shop manager capability to cause the inclusion and execution of arbitrary local files, which is then triggered o...