239595 matches found
PT-2026-82654
Name of the Vulnerable Software and Affected Versions Tutor LMS versions prior to 4.0.6 Description The Tutor LMS WordPress plugin contains a template injection issue caused by insufficient validation of request data. This allows unauthenticated users to overwrite internal variables during templa...
PT-2026-82601
Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.9 Description A signature verification issue exists in the gpg runner.verify detached function. The system accepts revoked and expired keys because it only checks the VALIDSIG status and fails to inspect...
PT-2026-82837
Name of the Vulnerable Software and Affected Versions WPMU DEV Dashboard versions prior to 5.0.2 Description An authentication bypass exists in the Hub Single Sign-On SSO flow, potentially affecting an estimated 350,000 WordPress sites. The issue stems from HMAC canonicalization confusion—a...
PT-2026-82448
Name of the Vulnerable Software and Affected Versions Apache APISIX versions 2.12.0 through 3.17.0 Description An inconsistent interpretation of HTTP requests, known as HTTP Request/Response Smuggling, occurs on serverless-plugin routes. This allows an attacker to manipulate the request stream so...
VulnCheck KEV: CVE-2026-76581
The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and ambiguous HMAC message construction between the unauthenticated wdpssostep1 and wdpssostep2 AJAX actions, where step 1 signs and disclose...
CVE-2025-22777-GiveWP-Plugin-PHP-Object-Injection-Point-PoC-
CVE-2025-22777-GiveWP-Plugin-PHP-Object-Injection-Point-PoC- Questo repository contiene una Proof of Concept in lavorazione per CVE-2025-22777 che interessa il plugin GiveWP per WordPress. Le cose potrebbero cambiare, rompersi o migliorare nel tempo. Per prima cosa, clona questo repository. Sul t...
TCGuard
TCGuard — Universal Crash, Exploit, Packet & Anti-Bot Protecti...
GO-2026-6259 vulnerabilities
Vulnerabilities for packages: velero-plugin-for-microsoft-azure, velero-plugin-for-microsoft-azure-fips, velero-plugin-for-aws, velero-plugin-for-gcp-fips, velero-plugin-for-gcp, velero-plugin-for-aws-fips...
GO-2026-6259 vulnerabilities
Vulnerabilities for packages: velero-plugin-for-microsoft-azure, velero-plugin-for-aws...
WordPress Push Notification for Post and BuddyPress plugin <= 3.20 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by JunHee CHO in WordPress Plugin Push Notification for Post and BuddyPress versions = 3.20...
WordPress Post SMTP plugin 4.0.0-beta.1 - Settings Change vulnerability
Settings Change vulnerability discovered by mad4cyber in WordPress Plugin Post SMTP versions 4.0.0-beta.1...
WordPress Suggestion Engine for WooCommerce plugin <= 2.0.11 - SQL Injection vulnerability
SQL Injection vulnerability discovered by JunHee CHO in WordPress Plugin Suggestion Engine for WooCommerce versions = 2.0.11...
WordPress Kali Forms plugin <= 2.4.23 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by sungbyeongchan in WordPress Plugin Kali Forms versions = 2.4.23...
WordPress FluentBooking Pro plugin <= 2.2.4 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin FluentBooking Pro versions = 2.2.4...
WordPress Ditty plugin <= 3.1.67 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by sungbyeongchan in WordPress Plugin Ditty versions = 3.1.67...
WordPress GeoDirectory plugin <= 2.8.176 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by Brian Willows in WordPress Plugin GeoDirectory versions = 2.8.176...
WordPress FluentPlayer Pro plugin <= 1.3.2 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin FluentPlayer Pro versions = 1.3.2...
SUSE CVE-2026-80101
A flaw was found in the file-xwd plugin in GIMP. When processing a specially crafted XWD image file, the plugin validates the image width and bytes-per-line parameters independently rather than ensuring their combined values are consistent with the allocated buffer size. This incorrect validation...
CVE-2026-54606
SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 3.1.4, the SunEditor Embed plugin in src/plugins/modal/embed.js parses attacker-controlled raw embed HTML with DOMParser and processes the resulting DOM nodes. When an external script eleme...
GHSA-W93Q-CQ9W-58P7 SunEditor Embed Plugin has DOM XSS via External Script Element After Iframe Embed
Summary A DOM-based Cross-Site Scripting XSS vulnerability exists in the SunEditor Embed plugin. Crafted iframe embed HTML followed by an external element bypasses the plugin’s sanitization logic. The plugin recreates and appends the attacker-controlled script element to the live DOM, causing...