252913 matches found
WordPress kk Star Ratings – Rate Post & Collect User Feedbacks plugin <= 5.4.10.3 - Unauthenticated Arbitrary Shortcode Execution vulnerability
Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Ronnachai Sretawat Na Ayutaya Simonhaskelly in WordPress Plugin kk Star Ratings versions = 5.4.10.3...
WordPress FundEngine – Donation and Crowdfunding Platform plugin <= 1.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability
Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin FundEngine versions = 1.8.1...
WordPress WS Form LITE – Drag & Drop Contact Form Builder plugin <= 1.10.80 - Unauthenticated PHP Object Injection vulnerability
Unauthenticated PHP Object Injection vulnerability discovered by Athiwat Tiprasaharn Jitlada in WordPress Plugin WS Form LITE versions = 1.10.80...
WordPress Events Manager – Calendar, Bookings, Tickets, and more! plugin <= 7.3.7.4 - Authenticated (Administrator+) Local File Inclusion vulnerability
Authenticated Administrator+ Local File Inclusion vulnerability discovered by Wordfence PRISM in WordPress Plugin Events Manager versions = 7.3.7.4...
CVE-2026-78468
Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-78270. Reason: This candidate is a reservation duplicate of CVE-2026-78270. Notes: All CVE users should reference CVE-2026-78270 instead of this candidate. All references and descriptions in this candidate have been...
CVE-2026-24169
NVIDIA UFM Enterprise contains a vulnerability in the plugin management API, where an authenticated user with low privileges could inject code by sending a specially crafted API request. A successful exploit of this vulnerability might lead to code execution, escalation of privileges and...
WordPress ManageWP Worker plugin < 4.9.37 - Unauthenticated Authentication Bypass vulnerability
Unauthenticated Authentication Bypass vulnerability discovered by Jakub Herman in WordPress Plugin ManageWP Worker versions 4.9.37...
WordPress FiboSearch plugin < 1.34.1 - Unauthenticated Password-Protected Product Information Disclosure vulnerability
Unauthenticated Password-Protected Product Information Disclosure vulnerability discovered by Duy Tran in WordPress Plugin FiboSearch versions 1.34.1...
WordPress Limit Login Attempts Security plugin < 3.3.5 - Username Denylist Bypass vulnerability
Username Denylist Bypass vulnerability discovered by Artus KG in WordPress Plugin Limit Login Attempts Reloaded versions 3.3.5...
WordPress All-in-One WP Migration and Backup plugin <= 7.109 - Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution vulnerability
Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution vulnerability discovered by Jack Taylor in WordPress Plugin All-in-One WP Migration versions = 7.109...
WordPress ShopEngine Elementor WooCommerce Builder Addon <= 4.9.4 - Authenticated (Shop Manager+) Privilege Escalation to WXR Import 'plugin <wp_option>' Nodes vulnerability
Authenticated Shop Manager+ Privilege Escalation to WXR Import 'plugin ' Nodes vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin ShopEngine versions = 4.9.4...
WordPress MetForm plugin <= 4.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mf_form_id' Widget Setting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via 'mfformid' Widget Setting vulnerability discovered by Jonah Burgess CryptoCat in WordPress Plugin Metform versions = 4.1.8...
WordPress eCommerce Product Catalog plugin <= 3.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via 'style' Shortcode Attribute vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin eCommerce Product Catalog versions = 3.5.10...
WordPress Newsletters plugin <= 4.17 - Authenticated (Author+) Arbitrary Modification via 'newsletters_mailinglistsroles' POST Parameter vulnerability
Authenticated Author+ Arbitrary Modification via 'newslettersmailinglistsroles' POST Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Newsletters versions = 4.17...
WordPress Media Sweep plugin <= 1.1.3 - Authenticated (Administrator+) SQL Injection via 'fields' Parameter vulnerability
Authenticated Administrator+ SQL Injection via 'fields' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Media Sweep – WordPress Media Cleaner versions = 1.1.3...
WordPress My Agile Privacy® plugin <= 3.3.6 - Missing Authorization to Unauthenticated Plugin Settings Modification via map_missing_cookie_shield / map_check_consent_mode_status AJAX Actions vulnerability
Missing Authorization to Unauthenticated Plugin Settings Modification via mapmissingcookieshield / mapcheckconsentmodestatus AJAX Actions vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin My Agile Privacy versions = 3.3.6...
CVE-2026-78468
CVE-2026-78468 is a reservation duplicate of CVE-2026-78270 . Per connected documents, the underlying vulnerability affects the FluentCRM Pro WordPress plugin in all versions up to and including 3.1.12 . The root cause is SQL Injection due to insufficient escaping on user-supplied parameters and ...
EUVD-2026-65579
The FluentCRM Pro – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 3.1.12 due to insufficient escaping on the user supplied parameter and lack of sufficient...
