239533 matches found
CVE-2026-81700 openssl_encrypt before 1.4.9 GPG Signature Verification Bypass
opensslencrypt versions before 1.4.9 contain a signature verification vulnerability in gpgrunner.verifydetached that accepts revoked and expired keys by only checking VALIDSIG status without inspecting REVKEYSIG, EXPKEYSIG, or gpg exit codes. Attackers holding compromised-then-revoked signing key...
CVE-2026-81701 openssl_encrypt before 1.4.9 Arbitrary Code Execution via unsigned plugin
opensslencrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unknown subdirectories to bypass signature verification. Attackers can place malicious unsigned plugins following documented installation paths...
CVE-2026-81701 openssl_encrypt before 1.4.9 Arbitrary Code Execution via unsigned plugin
opensslencrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unknown subdirectories to bypass signature verification. Attackers can place malicious unsigned plugins following documented installation paths...
EUVD-2026-67057
opensslencrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unknown subdirectories to bypass signature verification. Attackers can place malicious unsigned plugins following documented installation paths...
CVE-2026-81700
openssl_encrypt versions before 1.4.9 contain a signature verification bypass in the gpg_runner.verify_detached function. The root cause is that the function only checks the VALIDSIG status without inspecting REVKEYSIG , EXPKEYSIG , or GPG exit codes, causing it to accept revoked and expired sign...
CVE-2026-81700 openssl_encrypt before 1.4.9 GPG Signature Verification Bypass
opensslencrypt versions before 1.4.9 contain a signature verification vulnerability in gpgrunner.verifydetached that accepts revoked and expired keys by only checking VALIDSIG status without inspecting REVKEYSIG, EXPKEYSIG, or gpg exit codes. Attackers holding compromised-then-revoked signing key...
WordPress Email Subscribers & Newsletters plugin <= 5.9.33 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Jiemook in WordPress Plugin Email Subscribers & Newsletters versions = 5.9.33...
WordPress Essential Addons for Elementor plugin <= 6.8.0 - Bypass vulnerability vulnerability
Bypass vulnerability vulnerability discovered by Gaurav popalghat in WordPress Plugin Essential Addons for Elementor versions = 6.8.0...
WordPress Workeera plugin < 1.0.6 - Subscriber+ Arbitrary File Read vulnerability
Subscriber+ Arbitrary File Read vulnerability discovered by Artus KG and Shhriyash in WordPress Plugin Workeera versions 1.0.6...
WordPress Workeera plugin < 1.0.6 - Subscriber+ Arbitrary File Deletion vulnerability
Subscriber+ Arbitrary File Deletion vulnerability discovered by Artus KG and Shhriyash in WordPress Plugin Workeera versions 1.0.6...
WordPress Workeera plugin < 1.0.6 - Subscriber+ Arbitrary File Upload vulnerability
Subscriber+ Arbitrary File Upload vulnerability discovered by Erwan LR WPScan in WordPress Plugin Workeera versions 1.0.6...
WordPress WpEvently plugin <= 5.5.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by sungbyeongchan in WordPress Plugin WpEvently versions = 5.5.0...
WordPress WpEvently plugin <= 5.5.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by sungbyeongchan in WordPress Plugin WpEvently versions = 5.5.0...
WordPress WP Job Portal plugin <= 2.5.9 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by Md Mehedi Hasan in WordPress Plugin WP Job Portal versions = 2.5.9...
WordPress RestrictMate plugin < 1.3.0 - Unauthenticated Privilege Escalation to Administrator vulnerability
Unauthenticated Privilege Escalation to Administrator vulnerability discovered by João Ramos Maciel in WordPress Plugin RestrictMate versions 1.3.0...
WordPress ACF Extended plugin <= 0.9.2.6 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin ACF Extended versions = 0.9.2.6...
WordPress Salon booking system plugin <= 10.31.1 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Daniel Dhaniswara in WordPress Plugin Salon booking system versions = 10.31.1...
WordPress Salon booking system plugin <= 10.31.1 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Salon booking system versions = 10.31.1...
WordPress CubeWP plugin <= 1.1.31 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin CubeWP versions = 1.1.31...
