Lucene search
+L

239437 matches found

Patchstack
Patchstack
added 2026/08/31 12:09 p.m.36 views

WordPress Custom User Registration Fields for WooCommerce plugin <= 2.2.3 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Custom User Registration Fields for WooCommerce versions = 2.2.3...

9.8CVSS5.9AI score0.00397EPSS
SaveExploits0References1Affected Software1
Patchstack
Patchstack
added 2026/08/31 12:06 p.m.9 views

WordPress bbPress plugin <= 2.6.14 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin bbPress versions = 2.6.14...

5.3CVSS5.9AI score0.00188EPSS
SaveExploits0Affected Software1
Patchstack
Patchstack
added 2026/08/31 11:50 a.m.7 views

WordPress SigmaForms Pro – AI Generated Forms plugin <= 1.4.5 - Unauthenticated Unauthenticated Arbitrary File Upload Leading to Remote Code Execution vulnerability

Unauthenticated Unauthenticated Arbitrary File Upload Leading to Remote Code Execution vulnerability discovered by d.v4ns3c in WordPress Plugin SigmaForms Pro – AI Generated Forms versions = 1.4.5...

9.8CVSS5.9AI score0.00693EPSS
SaveExploits0References1Affected Software1
Patchstack
Patchstack
added 2026/08/31 11:42 a.m.5 views

WordPress SAML Single Sign On – SSO Login plugin <= 5.4.6 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by Tanishq Shah, Thatchapol Booranatanit AliceZz in WordPress Plugin SAML SP Single Sign On versions = 5.4.6...

7.5CVSS5.9AI score0.00289EPSS
SaveExploits0References1Affected Software1
Patchstack
Patchstack
added 2026/08/31 11:11 a.m.6 views

WordPress Really Simple Security plugin < 9.8.0 - Multisite Subsite Admin+ Arbitrary Plugin Installation vulnerability

Multisite Subsite Admin+ Arbitrary Plugin Installation vulnerability discovered by Charles Vosburgh in WordPress Plugin Really Simple SSL versions 9.8.0...

6.6CVSS5.9AI score0.00257EPSS
SaveExploits0References1Affected Software1
NVD
NVD
added 2026/08/31 9:17 a.m.11 views

CVE-2026-82868

@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the SVG schema plugin that renders user-supplied SVG content directly to innerHTML without sanitization. Attackers can inject malicious SVG with embedded scripts, event handlers, or foreignObject elements to execute...

6.1CVSS0.00155EPSS
SaveExploits0References2
NVD
NVD
added 2026/08/31 9:17 a.m.12 views

CVE-2026-82867

@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the Select schema plugin that fails to sanitize option values before interpolating them into HTML via innerHTML. Attackers can supply malicious templates with crafted option values containing HTML and JavaScript to execu...

6.1CVSS0.00183EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
added 2026/08/31 8:46 a.m.13 views

CVE-2026-82868 @pdfme/schemas before 5.5.9 Cross-Site Scripting via SVG

@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the SVG schema plugin that renders user-supplied SVG content directly to innerHTML without sanitization. Attackers can inject malicious SVG with embedded scripts, event handlers, or foreignObject elements to execute...

6.1CVSS6AI score0.00155EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/08/31 8:46 a.m.7 views

EUVD-2026-68403

@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the SVG schema plugin that renders user-supplied SVG content directly to innerHTML without sanitization. Attackers can inject malicious SVG with embedded scripts, event handlers, or foreignObject elements to execute...

6.1CVSS6AI score0.00155EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/08/31 8:46 a.m.41 views

CVE-2026-82868 @pdfme/schemas before 5.5.9 Cross-Site Scripting via SVG

@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the SVG schema plugin that renders user-supplied SVG content directly to innerHTML without sanitization. Attackers can inject malicious SVG with embedded scripts, event handlers, or foreignObject elements to execute...

6.1CVSS0.00155EPSS
SaveExploits0References2
OSV
OSV
added 2026/08/31 8:46 a.m.8 views

CVE-2026-82868 @pdfme/schemas before 5.5.9 Cross-Site Scripting via SVG

@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the SVG schema plugin that renders user-supplied SVG content directly to innerHTML without sanitization. Attackers can inject malicious SVG with embedded scripts, event handlers, or foreignObject elements to execute...

5.3CVSS6AI score
SaveExploits0References4
EUVD
EUVD
added 2026/08/31 8:46 a.m.9 views

EUVD-2026-68402

@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the Select schema plugin that fails to sanitize option values before interpolating them into HTML via innerHTML. Attackers can supply malicious templates with crafted option values containing HTML and JavaScript to execu...

6.1CVSS6.1AI score0.00183EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/08/31 8:46 a.m.42 views

CVE-2026-82867 @pdfme/schemas before 5.5.9 Cross-Site Scripting via Select

@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the Select schema plugin that fails to sanitize option values before interpolating them into HTML via innerHTML. Attackers can supply malicious templates with crafted option values containing HTML and JavaScript to execu...

6.1CVSS0.00183EPSS
SaveExploits0References2
OSV
OSV
added 2026/08/31 8:46 a.m.11 views

CVE-2026-82867 @pdfme/schemas before 5.5.9 Cross-Site Scripting via Select

@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the Select schema plugin that fails to sanitize option values before interpolating them into HTML via innerHTML. Attackers can supply malicious templates with crafted option values containing HTML and JavaScript to execu...

5.3CVSS6.1AI score
SaveExploits0References4
Vulnrichment
Vulnrichment
added 2026/08/31 8:46 a.m.13 views

CVE-2026-82867 @pdfme/schemas before 5.5.9 Cross-Site Scripting via Select

@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the Select schema plugin that fails to sanitize option values before interpolating them into HTML via innerHTML. Attackers can supply malicious templates with crafted option values containing HTML and JavaScript to execu...

6.1CVSS6.1AI score0.00183EPSS
SaveExploits0References2
CVE
CVE
added 2026/08/31 8:46 a.m.13 views

CVE-2026-82867

@pdfme/schemas versions before 5.5.9 contain a cross-site scripting (XSS) vulnerability in the Select schema plugin . The root cause is the failure to sanitize option values before interpolating them into HTML via innerHTML. An attacker who can supply a malicious template with crafted option valu...

6.1CVSS6.1AI score0.00183EPSS
SaveExploits0References2
Patchstack
Patchstack
added 2026/08/31 8:33 a.m.5 views

WordPress MapSVG plugin <= 8.15.0 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Adam Kahlon Adkali in WordPress Plugin MapSVG versions = 8.15.0...

5.4CVSS5.9AI score0.00138EPSS
SaveExploits0Affected Software1
NVD
NVD
added 2026/08/31 7:17 a.m.13 views

CVE-2026-77013

The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not restrict which of its handler methods a request may invoke, and performs no capability or nonce check on them, allowing unauthenticated users to create WordPress user accounts and taxonomy terms...

5.3CVSS0.00182EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/31 6:00 a.m.42 views

CVE-2026-77013 Icollect <= 1.0.0 - Unauthenticated User and Term Creation via Unrestricted Method Dispatch

The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not restrict which of its handler methods a request may invoke, and performs no capability or nonce check on them, allowing unauthenticated users to create WordPress user accounts and taxonomy terms...

0.00182EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/31 6:00 a.m.18 views

CVE-2026-77013

The Icollect (爱采集数据采集和发布插件) WordPress plugin, versions through 1.0.0 , is vulnerable to unauthenticated user and taxonomy term creation due to unrestricted handler method dispatch. The plugin fails to restrict which of its handler methods a request may invoke and performs no capability or nonce c...

5.3CVSS5.9AI score0.00182EPSS
SaveExploits0References1
Rows per page
Query Builder