239437 matches found
WordPress Custom User Registration Fields for WooCommerce plugin <= 2.2.3 - Unauthenticated Privilege Escalation vulnerability
Unauthenticated Privilege Escalation vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Custom User Registration Fields for WooCommerce versions = 2.2.3...
WordPress bbPress plugin <= 2.6.14 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin bbPress versions = 2.6.14...
WordPress SigmaForms Pro – AI Generated Forms plugin <= 1.4.5 - Unauthenticated Unauthenticated Arbitrary File Upload Leading to Remote Code Execution vulnerability
Unauthenticated Unauthenticated Arbitrary File Upload Leading to Remote Code Execution vulnerability discovered by d.v4ns3c in WordPress Plugin SigmaForms Pro – AI Generated Forms versions = 1.4.5...
WordPress SAML Single Sign On – SSO Login plugin <= 5.4.6 - Unauthenticated Authentication Bypass vulnerability
Unauthenticated Authentication Bypass vulnerability discovered by Tanishq Shah, Thatchapol Booranatanit AliceZz in WordPress Plugin SAML SP Single Sign On versions = 5.4.6...
WordPress Really Simple Security plugin < 9.8.0 - Multisite Subsite Admin+ Arbitrary Plugin Installation vulnerability
Multisite Subsite Admin+ Arbitrary Plugin Installation vulnerability discovered by Charles Vosburgh in WordPress Plugin Really Simple SSL versions 9.8.0...
CVE-2026-82868
@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the SVG schema plugin that renders user-supplied SVG content directly to innerHTML without sanitization. Attackers can inject malicious SVG with embedded scripts, event handlers, or foreignObject elements to execute...
CVE-2026-82867
@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the Select schema plugin that fails to sanitize option values before interpolating them into HTML via innerHTML. Attackers can supply malicious templates with crafted option values containing HTML and JavaScript to execu...
CVE-2026-82868 @pdfme/schemas before 5.5.9 Cross-Site Scripting via SVG
@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the SVG schema plugin that renders user-supplied SVG content directly to innerHTML without sanitization. Attackers can inject malicious SVG with embedded scripts, event handlers, or foreignObject elements to execute...
EUVD-2026-68403
@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the SVG schema plugin that renders user-supplied SVG content directly to innerHTML without sanitization. Attackers can inject malicious SVG with embedded scripts, event handlers, or foreignObject elements to execute...
CVE-2026-82868 @pdfme/schemas before 5.5.9 Cross-Site Scripting via SVG
@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the SVG schema plugin that renders user-supplied SVG content directly to innerHTML without sanitization. Attackers can inject malicious SVG with embedded scripts, event handlers, or foreignObject elements to execute...
CVE-2026-82868 @pdfme/schemas before 5.5.9 Cross-Site Scripting via SVG
@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the SVG schema plugin that renders user-supplied SVG content directly to innerHTML without sanitization. Attackers can inject malicious SVG with embedded scripts, event handlers, or foreignObject elements to execute...
EUVD-2026-68402
@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the Select schema plugin that fails to sanitize option values before interpolating them into HTML via innerHTML. Attackers can supply malicious templates with crafted option values containing HTML and JavaScript to execu...
CVE-2026-82867 @pdfme/schemas before 5.5.9 Cross-Site Scripting via Select
@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the Select schema plugin that fails to sanitize option values before interpolating them into HTML via innerHTML. Attackers can supply malicious templates with crafted option values containing HTML and JavaScript to execu...
CVE-2026-82867 @pdfme/schemas before 5.5.9 Cross-Site Scripting via Select
@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the Select schema plugin that fails to sanitize option values before interpolating them into HTML via innerHTML. Attackers can supply malicious templates with crafted option values containing HTML and JavaScript to execu...
CVE-2026-82867 @pdfme/schemas before 5.5.9 Cross-Site Scripting via Select
@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the Select schema plugin that fails to sanitize option values before interpolating them into HTML via innerHTML. Attackers can supply malicious templates with crafted option values containing HTML and JavaScript to execu...
CVE-2026-82867
@pdfme/schemas versions before 5.5.9 contain a cross-site scripting (XSS) vulnerability in the Select schema plugin . The root cause is the failure to sanitize option values before interpolating them into HTML via innerHTML. An attacker who can supply a malicious template with crafted option valu...
WordPress MapSVG plugin <= 8.15.0 - Server Side Request Forgery (SSRF) vulnerability
Server Side Request Forgery SSRF vulnerability discovered by Adam Kahlon Adkali in WordPress Plugin MapSVG versions = 8.15.0...
CVE-2026-77013
The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not restrict which of its handler methods a request may invoke, and performs no capability or nonce check on them, allowing unauthenticated users to create WordPress user accounts and taxonomy terms...
CVE-2026-77013 Icollect <= 1.0.0 - Unauthenticated User and Term Creation via Unrestricted Method Dispatch
The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not restrict which of its handler methods a request may invoke, and performs no capability or nonce check on them, allowing unauthenticated users to create WordPress user accounts and taxonomy terms...
CVE-2026-77013
The Icollect (爱采集数据采集和发布插件) WordPress plugin, versions through 1.0.0 , is vulnerable to unauthenticated user and taxonomy term creation due to unrestricted handler method dispatch. The plugin fails to restrict which of its handler methods a request may invoke and performs no capability or nonce c...