268049 matches found
PT-2026-110009
Name of the Vulnerable Software and Affected Versions Mobile builder WordPress plugin versions prior to 1.4.3 Description An issue exists where the plugin fails to properly restrict the user meta keys that a logged-in user can update via a REST route. This allows any user with a self-registered...
CVE-2026-89302: Improper Neutralization of Special Elements used in an SQL Command
The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...
PT-2026-110057
Name of the Vulnerable Software and Affected Versions WP-Partner versions prior to 1.2.2 Description An issue exists where the software fails to sanitize and escape the id parameter before incorporating it into a SQL query. This allows unauthenticated attackers to perform SQL injection, enabling...
CVE-2026-87761: Improper Neutralization of Input During Web Page Generation
The Adwised Web Push Notification WordPress plugin through 2.5.7 does not perform any capability or nonce check before allowing an authenticated user to overwrite its site-wide configuration, and does not escape those configuration values before printing them inside an inline script block on ever...
CVE-2026-108725: Improper Neutralization of Input During Web Page Generation
Cheshire Cat AI core through 2.0.23 contains a stored cross-site scripting vulnerability in the uploads plugin that allows authenticated users to upload HTML files via POST /uploads without type restrictions. Attackers can send the public GET /uploads/path URL to a signed-in victim, executing...
PT-2026-110014
The Envira Gallery WordPress plugin before 1.16.2 does not correctly check authorization on its gallery-conversion feature, verifying that the requester can edit an arbitrary post they name rather than that they are allowed to create the Envira Gallery WordPress plugin before 1.16.2's own gallery...
PT-2026-110050
Name of the Vulnerable Software and Affected Versions Topcontent versions prior to 1.2.2 Description An issue exists where a request handler is not properly authorized and HTML sanitization is disabled before storing submitted content. This allows unauthenticated attackers to publish arbitrary...
PT-2026-110008
The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and CSRF checks when saving its settings, and does not escape some of them when outputting them, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators and site visitors...
CVE-2026-88903: Improper Neutralization of Input During Web Page Generation
The Topcontent WordPress plugin through 1.2.1 does not properly authorise one of its request handlers and disables HTML sanitisation before storing the submitted content, allowing unauthenticated attackers to publish arbitrary posts containing malicious JavaScript on any site where its API key ha...
CVE-2026-103694: Improper Privilege Management
The Mobile builder WordPress plugin through 1.4.2 does not properly restrict which user meta keys a logged-in user can update through one of its REST routes, allowing any user with a self-registered account, such as a customer, to grant themselves the administrator role...
CVE-2026-103695: Improper Neutralization of Special Elements used in an SQL Command
The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks...
ida-efitools2
Informazioni È un plugin IDA per estendere le capacità di reverse engineering UEFI. Basato su ida-efitools con una serie di correzioni e nuove funzionalità. Funziona sia con Python 2 che con Python 3. Supporta versioni obsolete di IDA Pro 7.x senza garanzie. Funzionalità Definizione dei GUID...
CVE-2026-62035
Subscriber Broken Access Control in AWS S3 for WordPress Plugin – Upcasted = 3.1.0 versions...
CVE-2026-62035 WordPress AWS S3 for WordPress Plugin – Upcasted plugin <= 3.1.0 - Broken Access Control vulnerability
Subscriber Broken Access Control in AWS S3 for WordPress Plugin – Upcasted = 3.1.0 versions...
EUVD-2026-96470
Subscriber Broken Access Control in AWS S3 for WordPress Plugin – Upcasted = 3.1.0 versions...
CVE-2026-62035 WordPress AWS S3 for WordPress Plugin – Upcasted plugin <= 3.1.0 - Broken Access Control vulnerability
Subscriber Broken Access Control in AWS S3 for WordPress Plugin – Upcasted = 3.1.0 versions...
CVE-2026-62035
The AWS S3 for WordPress Plugin (specifically the Upcasted version) is vulnerable to a Broken Access Control issue in versions
CVE-2026-42717
The WordPress Leyka plugin (versions