378570 matches found
CVE-2026-18063
The Job Postings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'positionbutton' parameter in all versions up to, and including, 2.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...
CVE-2026-15402
The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'etnsheduleobjective' scheduleslot Parameter in all versions up to, and including, 4.1.23 due to insufficient input sanitization and output escaping...
Security Bulletin: Multiple security vulnerabilities found and remediated in IBM webMethods Managed File Transfer
Summary IBM webMethods Managed File Transfer is vulnerable to multiple issues in third-party JavaScript libraries used by its web user interface. The Axios HTTP client is susceptible to prototype pollution attacks that could allow an attacker to intercept or hijack HTTP transport, and to stream...
EUVD-2026-78304
The Job Postings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'positionbutton' parameter in all versions up to, and including, 2.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...
CVE-2026-18063 Job Postings <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'position_button' Parameter
The Job Postings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'positionbutton' parameter in all versions up to, and including, 2.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...
CVE-2026-18063 Job Postings <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'position_button' Parameter
The Job Postings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'positionbutton' parameter in all versions up to, and including, 2.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...
CVE-2026-18063
The Job Postings plugin for WordPress (all versions up to and including 2.8.1 ) is vulnerable to Stored Cross-Site Scripting via the position_button parameter in class-job-add-edit.php, due to insufficient input sanitization and output escaping. An authenticated attacker with contributor-level ac...
CVE-2026-85676
A flaw was found in Dub. This open redirect vulnerability exists in the redirurl query parameter, which is accepted on every short link without validation or domain allowlist enforcement. A remote attacker can exploit this by appending the redirurl parameter to any short link. This allows the...
CVE-2026-15758
The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.16.20 via the 'id' parameter. This makes it possible for unauthenticated attackers to extract sensitive data...
EUVD-2026-78296
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.7 via the 'mediaId' parameter due to missing validation on a user controlled key. This makes it possible for authenticated...
CVE-2026-15402 Eventin <= 4.1.23 - Authenticated (Custom+) Stored Cross-Site Scripting via 'etn_shedule_objective' schedule_slot Parameter
The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'etnsheduleobjective' scheduleslot Parameter in all versions up to, and including, 4.1.23 due to insufficient input sanitization and output escaping...
EUVD-2026-78297
The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'etnsheduleobjective' scheduleslot Parameter in all versions up to, and including, 4.1.23 due to insufficient input sanitization and output escaping...
CVE-2026-15402 Eventin <= 4.1.23 - Authenticated (Custom+) Stored Cross-Site Scripting via 'etn_shedule_objective' schedule_slot Parameter
The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'etnsheduleobjective' scheduleslot Parameter in all versions up to, and including, 4.1.23 due to insufficient input sanitization and output escaping...
CVE-2026-89141 AI Engine <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Attachment Disclosure via 'mediaId' Parameter
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.7 via the 'mediaId' parameter due to missing validation on a user controlled key. This makes it possible for authenticated...
CVE-2026-89141 AI Engine <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Attachment Disclosure via 'mediaId' Parameter
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.7 via the 'mediaId' parameter due to missing validation on a user controlled key. This makes it possible for authenticated...
CVE-2026-89141
CVE-2026-89141 affects the AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin in all versions up to and including 3.7.7 . The vulnerability is an Insecure Direct Object Reference (IDOR) via the mediaId parameter, caused by missing validation on a user-controlled key. Authenticated a...
CVE-2026-15402
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) WordPress plugin (slugged wp-event-solution ) is vulnerable to Stored Cross-Site Scripting (XSS) via the etn_shedule_objective schedule_slot parameter in versions up to and including 4.1.23 . The root cause is insuff...
CVE-2026-15758 3D FlipBook <= 1.16.20 - Unauthenticated Sensitive Information Exposure in 'id' Parameter
The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.16.20 via the 'id' parameter. This makes it possible for unauthenticated attackers to extract sensitive data...
CVE-2026-15758 3D FlipBook <= 1.16.20 - Unauthenticated Sensitive Information Exposure in 'id' Parameter
The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.16.20 via the 'id' parameter. This makes it possible for unauthenticated attackers to extract sensitive data...
EUVD-2026-78272
The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.16.20 via the 'id' parameter. This makes it possible for unauthenticated attackers to extract sensitive data...