239986 matches found
PT-2026-81176
Name of the Vulnerable Software and Affected Versions WP Project Manager Pro versions prior to 4.0.2 Description Insufficient escaping of user-supplied parameters and lack of proper preparation in SQL queries allow authenticated attackers with Subscriber-level access and above to perform SQL...
PT-2026-81124
The BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This...
12 Step Meeting List 3.17 - 3.19.16 - Unauthenticated Stored XSS via Geocode Event Log
Description The plugin does not sanitise and escape a value submitted by unauthenticated users before storing it in its activity log and outputting it back in an admin area page, leading to a Stored Cross-Site Scripting issue which could be used against high privilege users such as admin. PoC The...
PT-2026-81248
The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.5.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
PT-2026-81250
Name of the Vulnerable Software and Affected Versions Kalles Addons versions prior to 1.0.7 Description The Kalles Addons plugin for WordPress is susceptible to PHP Object Injection due to the deserialization of untrusted input. This allows unauthenticated attackers to inject a PHP Object. The...
PT-2026-81863
Name of the Vulnerable Software and Affected Versions Punk::Plugin::TOTP versions prior to 0.05 Description The software incorrectly validates recovery codes during the two-factor authentication challenge. The totp use recovery function searches the recovery model for a submitted code's digest...
PT-2026-81165
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'header format' parameter in all versions up to, and including, 7.4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for...
PT-2026-81271
The Newsletters plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and...
CVE-2026-78266
Subscriber Broken Access Control in AutomatorWP = 5.8.3 versions...
CVE-2026-78265
Unauthenticated PHP Object Injection in The Events Calendar = 6.17.2 versions...
UBUNTU-CVE-2026-77337
CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0 allow authentication bypass and potential CPU or memory exhaustion when CookieAuthenticator uses...
CVE-2026-77337
CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0 allow authentication bypass and potential CPU or memory exhaustion when CookieAuthenticator uses...
CVE-2026-32560
Subscriber Local File Inclusion in MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator = 1.4 versions...
CVE-2026-78282
CVE-2026-78282 affects the WordPress Stripe Payments plugin in versions
CVE-2026-78282 WordPress Stripe Payments plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Stripe Payments = 2.1.2 versions...
CVE-2026-78268 WordPress Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads plugin <= 1.2.0 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads = 1.2.0 versions...
CVE-2026-78267
CVE-2026-78267 is an unauthenticated privilege escalation vulnerability in the TranslatePress WordPress plugin, affecting versions 3.3.2 and earlier . With a CVSS 3.1 score of 9.8 (Critical) , the flaw is exploitable over the network with low complexity, requiring no prior authentication or user ...
CVE-2026-78266 WordPress AutomatorWP plugin <= 5.8.3 - Broken Access Control vulnerability
Subscriber Broken Access Control in AutomatorWP = 5.8.3 versions...
CVE-2026-78266
AutomatorWP , a WordPress plugin , is affected by a Broken Access Control vulnerability in versions ≤ 5.8.3 . The flaw allows a Subscriber -level authenticated user to perform actions beyond their expected permissions, resulting in a high integrity impact (CVSS 3.1 base score 6.5 / MEDIUM ). The ...
