41607 matches found
CVE-2026-5809
The wpForo Forum plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to 3.0.2. The flaw stems from topic_add() and topic_edit() accepting arbitrary user data in $_REQUEST and storing it as postmeta without restricting which fields may be arrays. Since data[body][fileurl] ...
CVE-2025-6986
creationtimestamp| type| source ---|---|--- 2026-04-11 06:30:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mj77kqm4jb2u...
CVE-2026-4154
creationtimestamp| type| source ---|---|--- 2026-04-11 03:21:29+00:00| seen| Telegram/9p2zwy9MZzhVwoc6VK1G-jeZ0lfiSFc0xC5yOTrHz-Zg8Sw 2026-04-11 05:04:01+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mj72qrski22s 2026-04-15 00:37:07+00:00| seen|...
CVE-2026-4155
creationtimestamp| type| source ---|---|--- 2026-04-11 03:21:29+00:00| seen| Telegram/9p2zwy9MZzhVwoc6VK1G-jeZ0lfiSFc0xC5yOTrHz-Zg8Sw 2026-04-11 05:51:55+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mj75gfu4242h...
CVE-2026-4150
creationtimestamp| type| source ---|---|--- 2026-04-11 03:21:08+00:00| published-proof-of-concept| Telegram/jQJESTxAnDJkcV3IOr4zcsYk9e3AhwwItG0ad6oUuWk-UR8 2026-04-11 06:00:43+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mj75w67b652h 2026-06-14 21:07:07+00:00| seen|...
CVE-2026-5059
creationtimestamp| type| source ---|---|--- 2026-04-11 02:50:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj6tcdfok72o 2026-04-11 03:21:45+00:00| seen| Telegram/oNJqzE-05Zhzc8NPQW-z5MMZ2uUFxP7FYrJiMTOKneUM6w 2026-04-11 05:01:46+00:00| seen|...
CVE-2026-4895
creationtimestamp| type| source ---|---|--- 2026-04-11 02:23:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj6rrskalb2z 2026-04-18 09:33:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mjr52ezjqv26...
CVE-2026-3371
creationtimestamp| type| source ---|---|--- 2026-04-11 02:16:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj6rfdrtl62r...
CVE-2026-5207
The LifterLMS plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter in all versions up to, and including, 9.2.1. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...
CVE-2026-3358
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized private course enrollment in all versions up to, and including, 3.9.7. This is due to missing poststatus validation in the enrollnow and courseenrollment functions. Both enrollment endpoints...
CVE-2026-40199
creationtimestamp| type| source ---|---|--- 2026-04-11 01:45:30+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mj6pnsttg52t 2026-04-13 18:01:28+00:00| published-proof-of-concept| Telegram/GGU4l3ghB8B3Ai9EUxQ7xduUqm6NQYmTwZHkJoJpqeQPEQk...
CVE-2026-40198
creationtimestamp| type| source ---|---|--- 2026-04-11 01:35:29+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mj6p3vdj3r2c 2026-04-13 18:01:00+00:00| seen| Telegram/KWuxeeHSuQ8XCG0I0PmdlmfWtMeROe19MjnJrMoKtHiv8c 2026-04-13 18:01:28+00:00| published-proof-of-concept|...
CVE-2026-5207
The LifterLMS plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter in all versions up to, and including, 9.2.1. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...
CVE-2026-5207 LifterLMS <= 9.2.1 - Authenticated (Custom+) SQL Injection via 'order' Parameter
The LifterLMS plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter in all versions up to, and including, 9.2.1. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...
CVE-2026-3358
CVE-2026-3358 affects the Tutor LMS WordPress plugin up to version 3.9.7. The root cause is missing post_status validation in enroll_now() and course_enrollment() (no check for private post_status) allowing authenticated users with Subscriber-level access or higher to enroll in private courses vi...
CVE-2026-3358 Tutor LMS <= 3.9.7 - Missing Authorization to Authenticated (Subscriber+) Unauthorized Private Course Enrollment
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized private course enrollment in all versions up to, and including, 3.9.7. This is due to missing poststatus validation in the enrollnow and courseenrollment functions. Both enrollment endpoints...
CVE-2026-3358
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized private course enrollment in all versions up to, and including, 3.9.7. This is due to missing poststatus validation in the enrollnow and courseenrollment functions. Both enrollment endpoints...
PT-2026-32084
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized private course enrollment in all versions up to, and including, 3.9.7. This is due to missing post status validation in the enroll now and course enrollment functions. Both enrollment endpoints...
WordPress plugin Tutor LMS – eLearning and online course solution 安全漏洞
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be added t...