254348 matches found
CVE-2026-28167 WordPress Super Forms plugin <= 6.3.315 - Arbitrary File Download vulnerability
Unauthenticated Arbitrary File Download in Super Forms = 6.3.315 versions...
EUVD-2026-64795
Unauthenticated Cross Site Scripting XSS in Tourmaster = 5.4.9 versions...
CVE-2026-28166 WordPress Tourmaster plugin <= 5.4.9 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Tourmaster = 5.4.9 versions...
CVE-2026-28165 WordPress Digits plugin <= 9.2 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Digits = 9.2 versions...
CVE-2026-28165 WordPress Digits plugin <= 9.2 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Digits = 9.2 versions...
CVE-2026-28162 WordPress Events Made Easy plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Events Made Easy = 3.2.5 versions...
CVE-2026-28162 WordPress Events Made Easy plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Events Made Easy = 3.2.5 versions...
CVE-2026-28162
CVE-2026-28162 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Events Made Easy (versions ≤ 3.2.5 ). The vulnerability allows a remote unauthenticated attacker to inject and execute arbitrary script in another user's browser, with a CVSS 3.1 base score of 7....
CVE-2026-28153 WordPress Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More plugin <= 1.7.1 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Notification Master Real-Time WordPress Notifications With Email, SMS, Webhooks & More = 1.7.1 versions...
EUVD-2026-64792
Unauthenticated Broken Access Control in Notification Master Real-Time WordPress Notifications With Email, SMS, Webhooks & More = 1.7.1 versions...
CVE-2026-28152 WordPress Tonda Core plugin < 2.6 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Tonda Core 2.6 versions...
CVE-2026-28152 WordPress Tonda Core plugin < 2.6 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Tonda Core 2.6 versions...
CVE-2026-66671 WordPress Verdure Core plugin <= 1.2 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Verdure Core = 1.2 versions...
CVE-2026-66671 WordPress Verdure Core plugin <= 1.2 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Verdure Core = 1.2 versions...
WordPress ProfilePress plugin < 4.16.17 - Subscriber+ Subscription Cancellation via IDOR vulnerability
Subscriber+ Subscription Cancellation via IDOR vulnerability discovered by Haitam Lazaar in WordPress Plugin ProfilePress versions 4.16.17...
WordPress Everest Forms plugin < 3.5.0 - Unauthenticated Missing Authorization via Site Assistant REST Endpoints vulnerability
Unauthenticated Missing Authorization via Site Assistant REST Endpoints vulnerability discovered by Pedro Pinho in WordPress Plugin Everest Forms versions 3.5.0...
WordPress SALESmanago & Leadoo plugin < 3.11.3 - Subscriber+ SQL Injection vulnerability
Subscriber+ SQL Injection vulnerability discovered by Alberto Ucendo Martínez in WordPress Plugin SALESmanago & Leadoo versions 3.11.3...
CVE-2026-78280 WordPress Hash Form plugin <= 1.4.0 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery CSRF in Hash Form = 1.4.0 versions...