238706 matches found
CVE-2026-81771
Unauthenticated Cross-Site Scripting (XSS) was identified in the WordPress TrustedSite plugin , affecting versions 1.2.5 and earlier . The flaw allows an unauthenticated attacker to inject script that executes in the context of a different site (scope changed), with low impact on confidentiality,...
CVE-2026-81771 WordPress TrustedSite plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in TrustedSite = 1.2.5 versions...
CVE-2026-81769 WordPress Booking Hub plugin <= 1.3.1 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in LiquidThemes Booking Hub allows Privilege Escalation. This issue affects Booking Hub: from n/a through 1.3.1...
CVE-2026-81769
CVE-2026-81769 is an Incorrect Privilege Assignment vulnerability in the LiquidThemes Booking Hub WordPress plugin, affecting versions up to and including 1.3.1 . The flaw allows an attacker with low privileges to escalate access, potentially compromising confidentiality, integrity, and availabil...
CVE-2026-81770 WordPress Interactive Geo Maps plugin <= 1.6.30 - Reflected Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Interactive Geo Maps = 1.6.30 versions...
CVE-2026-81770
CVE-2026-81770 affects the WordPress Interactive Geo Maps plugin in versions ≤ 1.6.30 . The vulnerability is an unauthenticated Reflected Cross-Site Scripting (XSS) , meaning no prior login is required to exploit it, though user interaction is needed (CVSS 3.1: 7.1 HIGH , vector AV:N/AC:L/PR:N/UI...
CVE-2026-81294
CVE-2026-81294 is an unauthenticated privilege escalation vulnerability in the WordPress Authorizer plugin , affecting versions ≤ 3.15.1 . The flaw allows a remote attacker with no prior access to escalate privileges, rated CVSS 3.1: 9.8 (CRITICAL) — network vector, low complexity, no privileges ...
CVE-2026-81294 WordPress Authorizer plugin <= 3.15.1 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Authorizer = 3.15.1 versions...
CVE-2026-81294 WordPress Authorizer plugin <= 3.15.1 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Authorizer = 3.15.1 versions...
CVE-2026-81289
CVE-2026-81289 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the MP3 Audio Player for Music, Radio & Podcast by Sonaar WordPress plugin, affecting versions 5.13.1 and earlier . The vulnerability requires user interaction (victim must visit a crafted page) but needs no prior au...
CVE-2026-81288 WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Upsell Order Bump Offer for WooCommerce = 3.1.5 versions...
CVE-2026-81288
CVE-2026-81288 is an unauthenticated Cross Site Scripting (XSS) vulnerability in the Upsell Order Bump Offer for WooCommerce WordPress plugin, affecting versions 3.1.5 and below . The CVSS v3.1 score is 7.1 (HIGH) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L , indicating a network-based attack...
CVE-2026-81286 WordPress WCFM Marketplace plugin <= 3.8.1 - SQL Injection vulnerability
Unauthenticated SQL Injection in WCFM Marketplace = 3.8.1 versions...
EUVD-2026-69923
Unauthenticated SQL Injection in WCFM Marketplace = 3.8.1 versions...
CVE-2026-81286
CVE-2026-81286 is an unauthenticated SQL Injection in the WCFM Marketplace WordPress plugin, affecting versions 3.8.1 and earlier . The CNA (Patchstack) assigns a CVSS 3.1 score of 9.3 (CRITICAL) with a changed scope, indicating high confidentiality impact and low availability impact with no requ...
CVE-2026-84781
CVE-2026-84781 is a Contributor-level Cross Site Scripting (XSS) vulnerability in the WordPress Gallery PhotoBlocks plugin, affecting versions ≤ 1.3.4 . The flaw was discovered by V1T via Patchstack. An attacker with at least Contributor privileges can inject malicious scripts that execute in ano...
CVE-2026-81283 WordPress WP User Frontend plugin <= 4.3.10 - PHP Object Injection vulnerability
Subscriber PHP Object Injection in WP User Frontend = 4.3.10 versions...
EUVD-2026-69922
Subscriber PHP Object Injection in WP User Frontend = 4.3.10 versions...
