239750 matches found
WordPress WP Job Portal plugin <= 2.5.9 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by Md Mehedi Hasan in WordPress Plugin WP Job Portal versions = 2.5.9...
WordPress RestrictMate plugin < 1.3.0 - Unauthenticated Privilege Escalation to Administrator vulnerability
Unauthenticated Privilege Escalation to Administrator vulnerability discovered by João Ramos Maciel in WordPress Plugin RestrictMate versions 1.3.0...
WordPress ACF Extended plugin <= 0.9.2.6 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin ACF Extended versions = 0.9.2.6...
WordPress Salon booking system plugin <= 10.31.1 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Daniel Dhaniswara in WordPress Plugin Salon booking system versions = 10.31.1...
WordPress Salon booking system plugin <= 10.31.1 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Salon booking system versions = 10.31.1...
WordPress CubeWP plugin <= 1.1.31 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin CubeWP versions = 1.1.31...
CVE-2026-81279
Subscriber Broken Access Control in Push Notification for Post and BuddyPress = 3.20 versions...
CVE-2026-78288
Unauthenticated SQL Injection in Beautiful Taxonomy Filters = 2.4.6 versions...
CVE-2026-78293
Unauthenticated Cross Site Scripting XSS in WP w3all phpBB = 3.0.6 versions...
CVE-2026-78261
Unauthenticated Cross Site Scripting XSS in Realtyna Organic IDX plugin = 5.4.1 versions...
CVE-2026-78273
Subscriber Cross Site Scripting XSS in Fluent Boards Pro = 2.0.11 versions...
CVE-2026-78283
Unauthenticated Cross Site Scripting XSS in Music Player for WooCommerce = 1.8.9 versions...
CVE-2026-74848
Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache APISIX. An attacker could make other clients receive attacker-chosen or other users' responses on serverless-plugin routes. This issue affects Apache APISIX: from 2.12.0 through 3.17.0. Users ar...
CVE-2026-32564
Subscriber SQL Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...
CVE-2026-32566
Unauthenticated Privilege Escalation in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...
EUVD-2026-66958
Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache APISIX. An attacker could make other clients receive attacker-chosen or other users' responses on serverless-plugin routes. This issue affects Apache APISIX: from 2.12.0 through 3.17.0. Users ar...
CVE-2026-75020 Apache APISIX: ldap-auth plugin cross-subtree identity impersonation
Improper Neutralization of Special Elements used in an LDAP Query 'LDAP Injection' vulnerability in Apache APISIX. A caller who holds valid credentials for one entry in the LDAP directory can authenticate through APISIX as a consumer mapped to a different entry, one the plugin's configured scope...
CVE-2026-75020
This LDAP Injection vulnerability in Apache APISIX's ldap-auth plugin (versions 2.11.0 through 3.17.0 ) allows a caller holding valid credentials for one LDAP directory entry to authenticate as a consumer mapped to a different entry, effectively bypassing the plugin's configured scope and enablin...
CVE-2026-81276
CVE-2026-81276 affects the Kali Forms WordPress plugin in versions 2.4.23 and earlier . The vulnerability is an unauthenticated Broken Access Control flaw, rated CVSS 5.3 (Medium) with an attack vector of network, low complexity, no required privileges, and a low impact on integrity. The issue wa...