240006 matches found
CVE-2026-44725 EMQX: Stale plugins allow grants amplify a compromised admin/API key to remote code execution
EMQX is a scalable and reliable MQTT broker for AI, IoT, IIoT, and connected vehicles. Prior to versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1, the plugin-install REST API and dashboard upload accepted stale grants created with emqx ctl plugins allow because there was no five-minute gran...
CVE-2026-44725
In EMQX versions prior to 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1, missing five-minute grant lifetime and SHA-256 package binding let a compromised admin/API key upload attacker-controlled Erlang code via POST /api/v5/plugins/install, achieving remote code execution. Patched in all listed ...
EUVD-2026-63381
EMQX is a scalable and reliable MQTT broker for AI, IoT, IIoT, and connected vehicles. Prior to versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1, the plugin-install REST API and dashboard upload accepted stale grants created with emqx ctl plugins allow because there was no five-minute gran...
CVE-2026-44725 EMQX: Stale plugins allow grants amplify a compromised admin/API key to remote code execution
EMQX is a scalable and reliable MQTT broker for AI, IoT, IIoT, and connected vehicles. Prior to versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1, the plugin-install REST API and dashboard upload accepted stale grants created with emqx ctl plugins allow because there was no five-minute gran...
Critical Arbitrary File Upload Vulnerability Patched in Elementor Pro WordPress Plugin
On July 24th, 2026, we received a submission for an Unauthenticated Arbitrary File Upload vulnerability in Elementor Pro, a WordPress plugin with an estimated 6,000,000 active installations. This vulnerability makes it possible for unauthenticated attackers to upload arbitrary files, including...
WordPress Digits plugin <= 9.2 - Privilege Escalation vulnerability
Privilege Escalation vulnerability discovered by VanTastic in WordPress Plugin Digits versions = 9.2...
WordPress Events Made Easy plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by sequenceX0 in WordPress Plugin Events Made Easy versions = 3.2.5...
WordPress Social Media & Share Icons plugin <= 2.9.9 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Bonds in WordPress Plugin Social Media & Share Icons versions = 2.9.9...
WordPress Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More plugin <= 1.7.1 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ian Ho Shim in WordPress Plugin Notification Master Real-Time WordPress Notifications With Email, SMS, Webhooks & More versions = 1.7.1...
WordPress 12 Step Meeting List plugin <= 3.19.16 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by V1T in WordPress Plugin 12 Step Meeting List versions = 3.19.16...
WordPress WP Cafe Pro plugin < 3.0.15 - Sensitive Data Exposure vulnerability
Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Cafe Pro versions 3.0.15...
WordPress WPComplete plugin <= 2.9.5.6 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Asim Alshaya in WordPress Plugin WPComplete versions = 2.9.5.6...
CVE-2026-28164 WordPress Easy Elementor Addons plugin <= 2.3.7 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in HashThemes Easy Elementor Addons allows Cross Site Request Forgery. This issue affects Easy Elementor Addons: from n/a through 2.3.7...
CVE-2026-28163
The New User Approve WordPress plugin (versions ≤ 3.2.8) has a broken access control vulnerability discovered by Austin Ginder. Unauthenticated remote attackers can exploit incorrectly configured access control security levels, achieving low integrity impact (CVSS 5.3 MEDIUM). No patch version or...
CVE-2026-28163 WordPress New User Approve plugin <= 3.2.8 - Broken Access Control vulnerability
Missing Authorization vulnerability in myCred New User Approve allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects New User Approve: from n/a through 3.2.8...
WordPress Easy Elementor Addons plugin <= 2.3.7 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by Asim Alshaya in WordPress Plugin Easy Elementor Addons versions = 2.3.7...
WordPress New User Approve plugin <= 3.2.8 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Austin Ginder in WordPress Plugin New User Approve versions = 3.2.8...
CVE-2026-74011
A Blind SQL Injection vulnerability exists in the InfiniteWP Client WordPress plugin by revmakx, affecting versions through 1.13.9 . The flaw stems from improper neutralization of special elements in SQL commands, allowing an authenticated attacker (high privileges required) to extract data from ...
WordPress InfiniteWP Client plugin <= 1.13.9 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin InfiniteWP Client versions = 1.13.9...
