267964 matches found
CVE-2026-91833 WX Subscribe <= 1.2.1 - Unauthenticated SQLi via 'attach' Parameter
The WX Subscribe 微信支付付费订阅 WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks on installs where the payment key has not been configured...
CVE-2026-91833
The WX Subscribe 微信支付付费订阅 WordPress plugin (versions up to and including 1.2.1 ) is vulnerable to an unauthenticated SQL injection attack. The flaw occurs because the plugin fails to properly sanitize and escape a parameter before utilizing it in a SQL statement. This vulnerability specifically a...
EUVD-2026-102669
The The Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.11.1 This is due to the software allowing users to execute an action that does not properly validate a value before running...
CVE-2026-109219
The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in version 2.4.4 via the mbwfileupload function. This is due to missing file extension validation on the attacker-supplied imagepath parameter, whose basename-derived file name bypasses the extension allowlist applied only...
EUVD-2026-102640
The Mail Mint plugin for WordPress is vulnerable to SQL Injection via the 'filters' parameter of the /wp-json/mrm/v1/segments/contacts REST endpoint in versions up to, and including, 1.31.4 This is due to insufficient escaping on the user supplied filter 'value' before it is appended to a SQL que...
CVE-2026-111106 Mail Mint <= 1.31.4 - Authenticated (Custom+) SQL Injection via 'filters' Parameter
The Mail Mint plugin for WordPress is vulnerable to SQL Injection via the 'filters' parameter of the /wp-json/mrm/v1/segments/contacts REST endpoint in versions up to, and including, 1.31.4 This is due to insufficient escaping on the user supplied filter 'value' before it is appended to a SQL que...
EUVD-2026-102636
The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.4 via the mbwfileupload function. This is due to missing file extension validation on the attacker-supplied imagepath parameter, whose basename-derived file name bypasses the...
EUVD-2026-102616
The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 's' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents o...
PT-2026-124551
TuxCare rebuilt @babel/plugin-transform-flow-strip-types to address 1 CVE. Fixed in 7.16.7-tuxcare.3...
PT-2026-115574
Name of the Vulnerable Software and Affected Versions GeoDirectory versions prior to 2.8.192 Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access or higher to perform Stored Cross-Site Scripting. By utilizing the post content...
CVE-2026-109930: Exposure of Sensitive Information to an Unauthorized Actor
The MAIO WordPress plugin before 7.3.22 does not properly restrict access to its analytics data, treating a credential value shipped verbatim in its own public source as a valid API key, which allows unauthenticated attackers to retrieve the stored crawl-analytics log, including each recorded...
PT-2026-115491
Name of the Vulnerable Software and Affected Versions HivePress – Business Directory, Listings & Classified Ads Plugin versions prior to 1.7.33 Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored...
PT-2026-115897
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc info plugin could be confused by a query containing embedded null bytes. Reading information schema.query cache info after such a query was cached could...
CVE-2026-91833: Improper Neutralization of Special Elements used in an SQL Command
The WX Subscribe 微信支付付费订阅 WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks on installs where the payment key has not been configured...
PT-2026-124440
TuxCare rebuilt @babel/plugin-proposal-class-properties to address 1 CVE. Fixed in 7.18.9-tuxcare.3...
PT-2026-115447
The The Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.11.1 This is due to the software allowing users to execute an action that does not properly validate a value before running d...
PT-2026-124487
TuxCare rebuilt @babel/plugin-proposal-nullish-coalescing-operator to address 1 CVE. Fixed in 7.12.18-tuxcare.2...
PT-2026-124488
TuxCare rebuilt @babel/plugin-proposal-nullish-coalescing-operator to address 1 CVE. Fixed in 7.21.0-tuxcare.4...