20289 matches found
CVE-2026-9830
CVE-2026-9830 affects BookingPress Appointment Booking Pro for WordPress prior to 5.7.3. The root cause is a REST permission callback not being invoked, leaving all routes in a REST API namespace accessible without authentication. This allows unauthenticated attackers to read customer booking dat...
WordPress Secure Copy Content Protection and Content Locking <2.8.2 - SQL Injection
WordPress Secure Copy Content Protection and Content Locking plugin before 2.8.2 contains a SQL injection vulnerability. The plugin does not escape the sccpid parameter of the ayssccpresultsexportfile AJAX action, available to both unauthenticated and authenticated users, before using it in a SQL...
Everest Forms Pro <= 1.9.12 - Unauthenticated RCE via Calculation Formula Injection
The Everest Forms Pro plugin for WordPress is vulnerable to Remote Code Execution via PHP Code Injection in all versions up to, and including, 1.9.12. This is due to the Calculation Addon's processfilter function concatenating user-submitted form field values into a PHP code string without proper...
Dokan Pro <= 3.10.3 - SQL Injection
The Dokan Pro plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter in all versions up to, and including, 3.10.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. id: CVE-2024-3922 info: name: Dokan Pro...
WordPress Paid Memberships Pro <2.9.8 - Blind SQL Injection
WordPress Paid Memberships Pro plugin before 2.9.8 contains a blind SQL injection vulnerability in the 'code' parameter of the /pmpro/v1/order REST route. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of th...
CVE-2026-15962
CVE-2026-15962 affects the Fluent Forms Pro Add On Pack for WordPress (all versions up to 6.2.6). It enables PHP Object Injection through deserialization of untrusted input. An authenticated attacker with Subscriber-level access or higher can inject a PHP Object, with a POP chain allowing passwor...
CVE-2026-10818
The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajaxchunkuploadfinalize function. This is due to the file type validation occurring after chunk metadata and file contents have already been written to disk, and the...
CVE-2026-10818 WPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Write via Chunked Upload Init/Finalize Ordering
The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajaxchunkuploadfinalize function. This is due to the file type validation occurring after chunk metadata and file contents have already been written to disk, and the...
CVE-2026-10818
WPForms Pro (WordPress) is affected by an Arbitrary File Upload vulnerability up to version 1.10.1.1, exploitable via the ajax_chunk_upload_finalize path. The issue arises because file type validation occurs after chunk metadata and file contents are written to disk, and the assembled file isn’t ...
EUVD-2026-48764
The Checkout Field Editor for WooCommerce Pro plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.7.7 via the 'thwcfelegacyfile' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the content...
CVE-2026-14955 Checkout Field Editor for WooCommerce (Pro) <= 3.7.7 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read via 'thwcfe_legacy_file' Parameter
The Checkout Field Editor for WooCommerce Pro plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.7.7 via the 'thwcfelegacyfile' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the content...
CVE-2026-14955
The CVE-2026-14955 entry affects the Checkout Field Editor for WooCommerce (Pro) for WordPress, specifically versions up to 3.7.7. The root cause is a Directory Traversal vulnerability in the thwcfe_legacy_file parameter, allowing authenticated users with subscriber-level access and above to read...
EUVD-2026-48106
Unauthenticated Broken Access Control in Dokan Pro = 5.0.3 versions...
CVE-2026-65495
The CVE-2026-65495 entry describes an unauthenticated Broken Access Control vulnerability in the WordPress Dokan Pro plugin versions
CVE-2026-65494
CVE-2026-65494 affects WordPress via the Dokan Pro plugin ≤ 5.0.2, with a Subscriber SQL Injection vulnerability. The connected data confirms the affected component and the vulnerability class (SQL injection) but does not provide exploit details, affected tables/parameters, or a patch/version to ...
EUVD-2026-48105
Subscriber SQL Injection in Dokan Pro = 5.0.2 versions...
CVE-2026-65492
CVE-2026-65492 : Unauthenticated Cross Site Scripting (XSS) in the WordPress Dokan Pro plugin, version
CVE-2026-65492 WordPress Dokan Pro plugin <= 5.0.0 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Dokan Pro = 5.0.0 versions...