20356 matches found
CVE-2026-10818
The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajaxchunkuploadfinalize function. This is due to the file type validation occurring after chunk metadata and file contents have already been written to disk, and the...
CVE-2026-10818
WPForms Pro (WordPress) is affected by an Arbitrary File Upload vulnerability up to version 1.10.1.1, exploitable via the ajax_chunk_upload_finalize path. The issue arises because file type validation occurs after chunk metadata and file contents are written to disk, and the assembled file isn’t ...
CVE-2026-10818 WPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Write via Chunked Upload Init/Finalize Ordering
The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajaxchunkuploadfinalize function. This is due to the file type validation occurring after chunk metadata and file contents have already been written to disk, and the...
EUVD-2026-48764
The Checkout Field Editor for WooCommerce Pro plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.7.7 via the 'thwcfelegacyfile' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the content...
CVE-2026-14955 Checkout Field Editor for WooCommerce (Pro) <= 3.7.7 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read via 'thwcfe_legacy_file' Parameter
The Checkout Field Editor for WooCommerce Pro plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.7.7 via the 'thwcfelegacyfile' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the content...
CVE-2026-14955
The CVE-2026-14955 entry affects the Checkout Field Editor for WooCommerce (Pro) for WordPress, specifically versions up to 3.7.7. The root cause is a Directory Traversal vulnerability in the thwcfe_legacy_file parameter, allowing authenticated users with subscriber-level access and above to read...
EUVD-2026-48106
Unauthenticated Broken Access Control in Dokan Pro = 5.0.3 versions...
CVE-2026-65495
The CVE-2026-65495 entry describes an unauthenticated Broken Access Control vulnerability in the WordPress Dokan Pro plugin versions
EUVD-2026-48105
Subscriber SQL Injection in Dokan Pro = 5.0.2 versions...
CVE-2026-65494
CVE-2026-65494 affects WordPress via the Dokan Pro plugin ≤ 5.0.2, with a Subscriber SQL Injection vulnerability. The connected data confirms the affected component and the vulnerability class (SQL injection) but does not provide exploit details, affected tables/parameters, or a patch/version to ...
CVE-2026-65492 WordPress Dokan Pro plugin <= 5.0.0 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Dokan Pro = 5.0.0 versions...
EUVD-2026-48103
Unauthenticated Cross Site Scripting XSS in Dokan Pro = 5.0.0 versions...
CVE-2026-65493
The CVE-2026-65493 entry concerns the WordPress Dokan Pro plugin (
EUVD-2026-48104
Subscriber PHP Object Injection in Dokan Pro = 5.0.2 versions...
CVE-2026-65492
CVE-2026-65492 : Unauthenticated Cross Site Scripting (XSS) in the WordPress Dokan Pro plugin, version
EUVD-2026-48089
Subscriber Broken Access Control in ListingPro = 2.9.10 versions...
EUVD-2026-48213
Unauthenticated Cross Site Request Forgery CSRF in Simple Link Directory Pro = 15.0.8 versions...
CVE-2026-61981
CVE-2026-61981 affects the WordPress plugin Simple Link Directory Pro up to version 15.0.8 . The issue is an unauthenticated Cross Site Request Forgery (CSRF) vulnerability, as described in both CVE records. No exploitation details or mitigating fixes are provided in the connected documents. The ...