295382 matches found
CVE-2026-21811 Multiple security vulnerabilities affect HCL AppScan Azure Boards Plugin (CVE-2026-12143 and CVE-2026-13149)
HCL AppScan Azure Boards Plugin is potentially affected by an Information Disclosure vulnerability involving secrets accessible in plaintext during pipeline execution. Depending on the pipeline configuration, these secrets could be exposed through task outputs, debug logs, environment variable...
WordPress All-in-One Video Gallery plugin <= 4.9.7 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by beopseong.kim in WordPress Plugin All-in-One Video Gallery versions = 4.9.7...
WordPress H5P plugin <= 1.17.9 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin H5P versions = 1.17.9...
WordPress Elementor Addon Elements plugin <= 1.14.4 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin Elementor Addon Elements versions = 1.14.4...
CVE-2026-88849
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.55 does not verify that a user targeted through its student-enrolment feature has any relationship to the requesting instructor, allowing users with the Instructor role to overwrite the first name, last name and public display name ...
CVE-2026-109927
The HIPAA Forms WordPress plugin before 3.3.2 does not perform a capability check when handling a request that rebuilds its own custom user role, allowing a user who already holds that role to grant it administrator-level capabilities and escalate their privileges...
WordPress MasterStudy LMS WordPress Plugin plugin 3.7.13-3.7.54 - Instructor+ Arbitrary User Display Name Update vulnerability
Instructor+ Arbitrary User Display Name Update vulnerability discovered by Arman Kumar in WordPress Plugin MasterStudy LMS versions 3.7.13-3.7.54...
CVE-2026-97328 WebP Express < 0.25.16 - Unauthenticated Stored XSS via Alter HTML Parser
The WebP Express WordPress plugin before 0.25.16 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled, allowing unauthenticated users to submit content that is stored and later executed as Cross-Site Scripting in th...
EUVD-2026-108019
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.55 does not verify that a user targeted through its student-enrolment feature has any relationship to the requesting instructor, allowing users with the Instructor role to overwrite the first name, last name and public display name ...
CVE-2026-88849 MasterStudy LMS 3.7.13 - 3.7.54 - Instructor+ Arbitrary User Display Name Update via Student Enrollment
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.55 does not verify that a user targeted through its student-enrolment feature has any relationship to the requesting instructor, allowing users with the Instructor role to overwrite the first name, last name and public display name ...
CVE-2026-88849
The MasterStudy LMS WordPress Plugin affects versions before 3.7.55 . The vulnerability stems from a lack of verification in the student-enrolment feature, where the plugin fails to ensure a relationship exists between a targeted user and the requesting instructor. This allows users with the Inst...
CVE-2026-97328 WebP Express < 0.25.16 - Unauthenticated Stored XSS via Alter HTML Parser
The WebP Express WordPress plugin before 0.25.16 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled, allowing unauthenticated users to submit content that is stored and later executed as Cross-Site Scripting in th...
CVE-2026-88849 MasterStudy LMS 3.7.13 - 3.7.54 - Instructor+ Arbitrary User Display Name Update via Student Enrollment
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.55 does not verify that a user targeted through its student-enrolment feature has any relationship to the requesting instructor, allowing users with the Instructor role to overwrite the first name, last name and public display name ...
CVE-2026-97328
The WebP Express WordPress plugin, in versions prior to 0.25.16 , contains a vulnerability where it fails to escape values re-emitted by its bundled HTML parser into element attributes. This occurs specifically when a non-default image delivery mode is enabled. The flaw allows unauthenticated use...
CVE-2026-109931
The Infility Global WordPress plugin, in versions before 2.16.25 , is vulnerable to an unauthenticated authorization bypass. The plugin fails to perform necessary authorisation or nonce checks on an AJAX action accessible to public users. This flaw allows any visitor to overwrite a machine-transl...
EUVD-2026-108010
The HIPAA Forms WordPress plugin before 3.3.2 does not perform a capability check when handling a request that rebuilds its own custom user role, allowing a user who already holds that role to grant it administrator-level capabilities and escalate their privileges...
CVE-2026-109931 Infility Global < 2.16.25 - Unauthenticated Google Translate API Key Update
The Infility Global WordPress plugin before 2.16.25 does not perform any authorisation or nonce check on an AJAX action available to unauthenticated users, allowing any visitor to overwrite a machine-translation configuration value belonging to a companion Infility Global WordPress plugin before...
CVE-2026-109931 Infility Global < 2.16.25 - Unauthenticated Google Translate API Key Update
The Infility Global WordPress plugin before 2.16.25 does not perform any authorisation or nonce check on an AJAX action available to unauthenticated users, allowing any visitor to overwrite a machine-translation configuration value belonging to a companion Infility Global WordPress plugin before...
CVE-2026-103234 WP Ultimate Review < 2.4.5 - Unauthenticated Arbitrary Shortcode Execution via Reviewer Email
The WP Ultimate Review WordPress plugin before 2.4.5 does not neutralise shortcodes in all of the review fields submitted through its public review form, which is available to unauthenticated visitors, allowing them to execute arbitrary shortcodes when the affected field is displayed, provided us...
CVE-2026-100142
The FluentCart A New Era of eCommerce WordPress plugin versions before 2.2.0 is vulnerable to an Insecure Direct Object Reference (IDOR) . The software fails to verify if a stored customer address selected during checkout actually belongs to the requester. This flaw allows unauthenticated attacke...