Lucene search
+L

239579 matches found

NVD
NVD
added 2026/08/27 6:16 a.m.14 views

CVE-2026-19715

The WP OAuth Server Login with WordPress WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user...

7.5CVSS0.00256EPSS
SaveExploits0References1
NVD
NVD
added 2026/08/27 6:16 a.m.18 views

CVE-2026-19454

The JetBackup WordPress plugin before 3.1.23.5 does not perform its multisite authorisation check before serving backup archives and job logs, allowing an administrator of the network's main site who is not a Super Admin to download a full backup of the entire network, including every site's data...

4.4CVSS0.00254EPSS
SaveExploits0References1
NVD
NVD
added 2026/08/27 6:16 a.m.10 views

CVE-2026-16569

The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not check the user's capabilities before allowing a stock-update operation through one of its REST endpoints, allowing any authenticated user, such as a customer or subscriber...

4.3CVSS0.00152EPSS
SaveExploits0References1
NVD
NVD
added 2026/08/27 6:16 a.m.7 views

CVE-2026-19223

The Smush WordPress plugin before 4.3.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network...

7.2CVSS0.0037EPSS
SaveExploits0References1
NVD
NVD
added 2026/08/27 6:16 a.m.10 views

CVE-2026-13415

The CMP WordPress plugin before 4.1.18 does not enforce an option-name allow-list when importing settings via one of its AJAX actions, allowing users with the Editor role when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls to...

7.2CVSS0.00257EPSS
SaveExploits0References1
NVD
NVD
added 2026/08/27 6:16 a.m.9 views

CVE-2026-13416

The CMP WordPress plugin before 4.1.18 does not sanitise and escape a settings value before outputting it on the coming-soon page, allowing users with the Editor role when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls to inject...

3.5CVSS0.00142EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/27 6:00 a.m.31 views

CVE-2026-78333 12 Step Meeting List 3.17 - 3.19.16 - Unauthenticated Stored XSS via Geocode Event Log

The 12 Step Meeting List WordPress plugin before 3.19.17 does not sanitise and escape a value submitted by unauthenticated users before storing it in its activity log and outputting it back in an admin area page, leading to a Stored Cross-Site Scripting issue which could be used against high...

0.00276EPSS
SaveExploits1References1
EUVD
EUVD
added 2026/08/27 6:00 a.m.8 views

EUVD-2026-66885

The 12 Step Meeting List WordPress plugin before 3.19.17 does not sanitise and escape a value submitted by unauthenticated users before storing it in its activity log and outputting it back in an admin area page, leading to a Stored Cross-Site Scripting issue which could be used against high...

8.8CVSS5.2AI score0.00276EPSS
SaveExploits1References1
CVE
CVE
added 2026/08/27 6:00 a.m.18 views

CVE-2026-78333

The 12 Step Meeting List WordPress plugin (versions 3.17 through 3.19.16 ) contains a Stored Cross-Site Scripting (XSS) vulnerability. An unauthenticated user can inject a malicious payload via the Geocode Event Log , which is stored unsanitised in the plugin's activity log and later rendered in ...

8.8CVSS5.4AI score0.00276EPSS
SaveExploits1References1
Cvelist
Cvelist
added 2026/08/27 6:00 a.m.29 views

CVE-2026-77017 Workeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Read via Candidate Profile Mass Assignment

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor confine the stored file location to an allowed directory before serving it, allowing users with a role as low as subscriber to read arbitrary files on the server, including its...

0.00249EPSS
SaveExploits0References1
Patchstack
Patchstack
added 2026/08/27 6:00 a.m.6 views

WordPress Finale Lite plugin < 2.21.0 - Subscriber+ Campaign Configuration Disclosure vulnerability

Subscriber+ Campaign Configuration Disclosure vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Finale Lite versions 2.21.0...

4.3CVSS5.2AI score0.00176EPSS
SaveExploits0References1Affected Software1
Patchstack
Patchstack
added 2026/08/27 6:00 a.m.5 views

WordPress LearnPress plugin < 4.0.3 - Unauthenticated Order Status Disclosure vulnerability

Unauthenticated Order Status Disclosure vulnerability discovered by Shikhali Jamalzade in WordPress Plugin LearnPress & Sepay Payment versions 4.0.3...

5.3CVSS5.2AI score0.00206EPSS
SaveExploits0References1Affected Software1
EUVD
EUVD
added 2026/08/27 6:00 a.m.9 views

EUVD-2026-66881

The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in all versions up to, and including, 4.0.2, allowing unauthenticated attackers to disclose the payment status of arbitrary orders by enumerating order identifiers...

5.3CVSS5.4AI score0.00206EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/27 6:00 a.m.36 views

CVE-2026-78138 Finale Lite < 2.21.0 - Subscriber+ Campaign Configuration Disclosure via wcct_quick_view_html

The Finale Lite WordPress plugin before 2.21.0 does not perform a capability check on an AJAX action that returns a sales-campaign's configuration for an arbitrary post ID, allowing any authenticated user Subscriber and above to read the Finale Lite WordPress plugin before 2.21.0's campaign...

0.00176EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/27 6:00 a.m.8 views

EUVD-2026-66883

The Finale Lite WordPress plugin before 2.21.0 does not perform a capability check on an AJAX action that returns a sales-campaign's configuration for an arbitrary post ID, allowing any authenticated user Subscriber and above to read the Finale Lite WordPress plugin before 2.21.0's campaign...

4.3CVSS5.5AI score0.00176EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/27 6:00 a.m.22 views

CVE-2026-77018

The Workeera WordPress plugin (Remote Tech Job Board) before 1.0.6 allows users with a subscriber role to submit unrestricted profile values, which the plugin writes as an unvalidated file into a publicly reachable directory. This mass-assignment flaw enables arbitrary file upload and, consequent...

8.8CVSS6.1AI score0.00406EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/27 6:00 a.m.11 views

EUVD-2026-66879

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor confine the stored file location to an allowed directory before serving it, allowing users with a role as low as subscriber to read arbitrary files on the server, including its...

7.7CVSS5.6AI score0.00249EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/27 6:00 a.m.11 views

CVE-2026-78138

CVE-2026-78138 is a missing capability check in the Finale Lite WordPress plugin (versions

4.3CVSS5.7AI score0.00176EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/27 6:00 a.m.42 views

CVE-2026-77018 Workeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Upload via Candidate Profile Mass Assignment

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate the type of the file it subsequently writes into a publicly reachable directory, allowing users with a role as low as subscriber to upload arbitrary files and achieve remote code...

0.00406EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/27 6:00 a.m.20 views

CVE-2026-77017

CVE-2026-77017 affects the Workeera Remote Tech Job Board WordPress plugin in versions prior to 1.0.6 . The root cause is a mass assignment flaw in the candidate profile feature: the plugin does not restrict which profile values a candidate may submit, nor does it confine the stored file location...

7.7CVSS5.7AI score0.00249EPSS
SaveExploits0References1
Rows per page
Query Builder