30992 matches found
WordPress GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin GamiPress versions = 7.9.9.1...
CVE-2026-54540
Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, there is an authenticated terminal command whitelist bypass. The terminal feature checks whether the submitted command starts with one of the configured TERMINALCOMMANDS values, then passes the full command...
CVE-2026-66029 Ekushey Project Manager CRM 5.0 Stored XSS via Client Name Field
Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the client Name field on the Edit Profile page without sanitization. Attackers ca...
CVE-2026-55578 Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injection
Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, the terminal feature in Pheditor uses an incomplete character blocklist to sanitize user-supplied commands before passing them to shellexec. After the fix for GHSA-9643-6xjp-vx57 which...
CVE-2026-55578
Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, the terminal feature in Pheditor uses an incomplete character blocklist to sanitize user-supplied commands before passing them to shellexec. After the fix for GHSA-9643-6xjp-vx57 which...
CVE-2026-66390
The Apache Wicket Java web application framework is vulnerable to Cross-site Scripting (XSS) due to improper input neutralization during web page generation. Specifically, the wicket-core component fails to properly escape JavaScript when generating code for Link, ExternalLink, and PopupSettings....
CVE-2026-17529
A vulnerability was identified in AstrBotDevs AstrBot up to 4.25.5. Affected is an unknown function of the file astrbot/core/astrmainagent.py. The manipulation of the argument req.functool leads to incorrect authorization. The attack may be initiated remotely. The exploit is publicly available an...
EUVD-2026-49332
phpMyFAQ before 4.1.6 contains a privilege escalation vulnerability in GroupController::updateMembers that allows administrators with only group-management permissions to join privileged groups without verification of required rights. Attackers can add themselves to pre-existing groups holding...
CVE-2026-66438
Unauthenticated Sensitive Data Exposure in Exclusive Addons Elementor = 2.8.0 versions...
CVE-2026-59553
Unauthenticated Cross Site Scripting XSS in Product Feed Manager = 7.6.1 versions...
CVE-2026-59536
Unauthenticated Broken Access Control in CoCart – Headless ecommerce = 4.8.4 versions...
CVE-2026-59530
Unauthenticated Broken Access Control in Stripe For WooCommerce = 4.0.7 versions...
CVE-2026-66442 WordPress YayPricing plugin <= 3.5.6 - Broken Access Control vulnerability
Subscriber Broken Access Control in YayPricing = 3.5.6 versions...
CVE-2026-66438
Unauthenticated Sensitive Data Exposure in Exclusive Addons Elementor = 2.8.0 versions...
CVE-2026-66434
Contributor Cross Site Scripting XSS in Photonic Gallery & Lightbox for Flickr, SmugMug & Others = 3.33 versions...
CVE-2026-66433
Contributor Cross Site Scripting XSS in Location Weather = 3.0.6 versions...
CVE-2026-66428
Unauthenticated Cross Site Request Forgery CSRF in WP Google Review Slider = 18.4 versions...
EUVD-2026-49234
Contributor Cross Site Scripting XSS in WordPress Social Login and Register = 7.8.0 versions...