NetAlertX 23.01.14–24.x < 24.10.12 - Remote Code Execution

NetAlertX 23.01.14 through 24.x before 24.10.12 allows unauthenticated command injection via settings update because function=savesettings lacks an authentication requirement, as exploited in the wild in May 2025. This is related to settings.php and util.php. id: CVE-2024-46506 info: name:...

WordPress Contact Form by Supsystic plugin < 1.11.1 - Arbitrary Plugin Settings Update vulnerability

Arbitrary Plugin Settings Update vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Contact Form by Supsystic versions 1.11.1...

WordPress InstaWP Connect plugin < 0.1.4.2 - Authenticated Plugin Settings Update vulnerability

Authenticated Plugin Settings Update vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin InstaWP Connect versions 0.1.4.2...

WordPress Download Manager plugin < 3.3.71 - Privacy Settings Update vulnerability

Privacy Settings Update vulnerability discovered by Kartik Sharma in WordPress Plugin Download Manager versions 3.3.71...

WordPress Download Manager plugin 4.0.0-7.5.8 - Privacy Settings Update vulnerability

Privacy Settings Update vulnerability discovered by Kartik Sharma in WordPress Plugin Download Manager versions 4.0.0-7.5.8...

WordPress Smush plugin < 4.3.4 - Admin+ Network-Wide Plugin Settings Update on Multisite vulnerability

Admin+ Network-Wide Plugin Settings Update on Multisite vulnerability discovered by Erwan LR WPScan in WordPress Plugin Smush Image Compression and Optimization versions 4.3.4...

WordPress KeyWord Collector plugin <= 1.4 - Unauthenticated Stored XSS and Settings Update vulnerability

Unauthenticated Stored XSS and Settings Update vulnerability discovered by Enrico Marcolini - Claudio Marchesini - Dottor Marc in WordPress Plugin KeyWord Collector versions = 1.4...

CVE-2026-88905 KeyWord Collector <= 1.4 - Unauthenticated Stored XSS and Settings Update via WPKeyWordSettings

The KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check when saving its settings, and does not escape them before output, allowing unauthenticated attackers to store malicious JavaScript that executes when an administrator opens the KeyWord Collector...

CVE-2026-88905 KeyWord Collector <= 1.4 - Unauthenticated Stored XSS and Settings Update via WPKeyWordSettings

The KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check when saving its settings, and does not escape them before output, allowing unauthenticated attackers to store malicious JavaScript that executes when an administrator opens the KeyWord Collector...

CVE-2026-88905

The KeyWord Collector WordPress plugin, affecting versions through 1.4 , is vulnerable to unauthenticated stored Cross-Site Scripting (XSS) and unauthorized settings updates. The root cause is a lack of authorisation or nonce checks when saving settings via WPKeyWordSettings, combined with a fail...

CVE-2026-103305 Prenotazioni <= 1.7.5 - Unauthenticated Stored XSS via Settings Update

The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and CSRF checks when saving its settings, and does not escape some of them when outputting them, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators and site visitors...

CVE-2026-103305

The Prenotazioni WordPress plugin (versions through 1.7.5 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a lack of authorisation and CSRF checks when saving settings, combined with insufficient escaping of those settings when they are outputted. This allows unauthenticat...

CVE-2026-103305 Prenotazioni <= 1.7.5 - Unauthenticated Stored XSS via Settings Update

The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and CSRF checks when saving its settings, and does not escape some of them when outputting them, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators and site visitors...

CVE-2026-85348 GDPR Data Request Form 1.5 - 1.7.1 - DPO Email Update via CSRF

The GDPR Data Request Form WordPress plugin through 1.7.1 does not have CSRF protection when updating one of its settings, allowing attackers to change that setting via a forged request granted they can trick a site administrator into performing an action such as clicking on a link...

WordPress Social Web Suite plugin <= 4.1.12 - Unauthenticated Arbitrary Plugin Settings Update vulnerability

Unauthenticated Arbitrary Plugin Settings Update vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Social Web Suite versions = 4.1.12...

CVE-2026-88931 Social Web Suite <= 4.1.12 - Unauthenticated Arbitrary Plugin Settings Update

The Social Web Suite WordPress plugin through 4.1.12 does not restrict which of its settings may be written through an unauthenticated endpoint, allowing attackers to overwrite arbitrary Social Web Suite WordPress plugin through 4.1.12 options, including the shared secret that guards its own...

CVE-2026-88931 Social Web Suite <= 4.1.12 - Unauthenticated Arbitrary Plugin Settings Update

The Social Web Suite WordPress plugin through 4.1.12 does not restrict which of its settings may be written through an unauthenticated endpoint, allowing attackers to overwrite arbitrary Social Web Suite WordPress plugin through 4.1.12 options, including the shared secret that guards its own...

CVE-2026-88931

The Social Web Suite WordPress plugin (versions through 4.1.12 ) is vulnerable to an unauthenticated arbitrary plugin settings update . The root cause is a failure to restrict which settings can be modified via an unauthenticated endpoint. This allows an attacker to overwrite arbitrary plugin opt...

CVE-2026-85576 All in One Files Upload for WooCommerce < 2.0.17 - Subscriber+ Arbitrary Plugin Settings Update

The All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and does not verify the authenticity of the request, when saving its settings, allowing any authenticated user, such as a subscriber, to change them...

CVE-2026-85576

The All in One Files Upload WordPress plugin, specifically versions before 2.0.17 , is vulnerable to an unauthorized settings modification. The root cause is a lack of capability checks and a failure to verify the authenticity of the request when saving plugin settings. This flaw allows any authe...