CVE-2026-84764

CVE-2026-84764 is an unauthenticated Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Simply Schedule Appointments , affecting versions 1.6.12.23 and below . The flaw was discovered by Anthony Green of Greenhat Security . The assigned CVSS 3.1 score is 8.8 (High) , reflecti...

CVE-2026-84759 WordPress Activity Log plugin <= 2.13.1 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in Activity Log = 2.13.1 versions...

CVE-2026-82223 WordPress WP Event SOlution plugin <= 4.1.22 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WP Event SOlution = 4.1.22 versions...

EUVD-2026-69933

Unauthenticated Broken Access Control in WP Event SOlution = 4.1.22 versions...

CVE-2026-82223

CVE-2026-82223 affects the WP Event Solution WordPress plugin in versions 4.1.22 and earlier . The vulnerability is an Unauthenticated Broken Access Control flaw, meaning a remote attacker with no prior authentication can bypass access controls. The CVSS 3.1 score is 6.5 (Medium) , with impacts o...

EUVD-2026-69934

Contributor Cross Site Scripting XSS in WCFM Marketplace = 3.8.2 versions...

CVE-2026-83562 WordPress WCFM Marketplace plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in WCFM Marketplace = 3.8.2 versions...

CVE-2026-83562

CVE-2026-83562 is a Contributor Cross Site Scripting (XSS) vulnerability in the WordPress plugin WCFM Marketplace (versions ≤ 3.8.2 ). Discovered by Ananda Dhakal via Patchstack, the flaw requires an authenticated contributor-level user and user interaction to exploit, but results in a changed sc...

CVE-2026-81775

CVE-2026-81775 affects the WordPress Estatik plugin, versions 4.3.4 and below . The vulnerability is an unauthenticated Cross-Site Scripting (XSS) flaw, meaning an attacker can inject malicious scripts without prior authentication. The CVSS 3.1 score is 7.1 (HIGH) with the vector AV:N/AC:L/PR:N/U...

CVE-2026-81775 WordPress Estatik plugin <= 4.3.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Estatik = 4.3.4 versions...

nate158g-m-w-n-l-p-d-a-o-e

nate158g-m-w-n-l-p-d-a-o-e 此模块需要 Metasploit：https://metasploit.com/download 当前来源：https://github.com/rapid7/metasploit-framework class MetasploitModule 'WordPress Popular Posts 插件认证远程代码执行', 'Description' = %q 此漏洞利用要求 Metasploit 拥有一个 FQDN，并且能够运行端口 80、443 或 8080 上的有效载荷 Web 服务器。 FQDN...

CVE-2026-81774

CVE-2026-81774 affects the WooCommerce Product Attachment WordPress plugin in versions 2.3.3 and below , introducing an unauthenticated Sensitive Data Exposure vulnerability. The flaw allows a remote, unauthenticated attacker over the network to access confidential data, with a CVSS 3.1 base scor...

CVE-2026-81774 WordPress WooCommerce Product Attachment plugin <= 2.3.3 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in WooCommerce Product Attachment = 2.3.3 versions...

CVE-2026-81771

Unauthenticated Cross-Site Scripting (XSS) was identified in the WordPress TrustedSite plugin , affecting versions 1.2.5 and earlier . The flaw allows an unauthenticated attacker to inject script that executes in the context of a different site (scope changed), with low impact on confidentiality,...

CVE-2026-81771 WordPress TrustedSite plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in TrustedSite = 1.2.5 versions...

CVE-2026-81769 WordPress Booking Hub plugin <= 1.3.1 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in LiquidThemes Booking Hub allows Privilege Escalation. This issue affects Booking Hub: from n/a through 1.3.1...

CVE-2026-81770

CVE-2026-81770 affects the WordPress Interactive Geo Maps plugin in versions ≤ 1.6.30 . The vulnerability is an unauthenticated Reflected Cross-Site Scripting (XSS) , meaning no prior login is required to exploit it, though user interaction is needed (CVSS 3.1: 7.1 HIGH , vector AV:N/AC:L/PR:N/UI...

CVE-2026-81769

CVE-2026-81769 is an Incorrect Privilege Assignment vulnerability in the LiquidThemes Booking Hub WordPress plugin, affecting versions up to and including 1.3.1 . The flaw allows an attacker with low privileges to escalate access, potentially compromising confidentiality, integrity, and availabil...

CVE-2026-81770 WordPress Interactive Geo Maps plugin <= 1.6.30 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Interactive Geo Maps = 1.6.30 versions...

CVE-2026-81294

CVE-2026-81294 is an unauthenticated privilege escalation vulnerability in the WordPress Authorizer plugin , affecting versions ≤ 3.15.1 . The flaw allows a remote attacker with no prior access to escalate privileges, rated CVSS 3.1: 9.8 (CRITICAL) — network vector, low complexity, no privileges ...