14559 matches found
CVE-2026-84777 WordPress Really Simple SSL plugin <= 9.8.0 - 2FA Bypass vulnerability
Unauthenticated Broken Authentication in Really Simple SSL = 9.8.0 versions...
CVE-2026-84777
WordPress Really Simple SSL plugin versions ≤ 9.8.0 are affected by an unauthenticated broken authentication vulnerability described as a 2FA bypass . The flaw allows a network-based attacker (with no prior privileges or user interaction, but high attack complexity) to compromise authentication, ...
CVE-2026-81292 WordPress Simple Payment plugin <= 2.5.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Simple Payment = 2.5.1 versions...
EUVD-2026-70594
Unauthenticated Cross Site Scripting XSS in Simple Payment = 2.5.1 versions...
CVE-2026-81292
WordPress Simple Payment plugin versions ≤ 2.5.1 are affected by an unauthenticated Cross Site Scripting (XSS) vulnerability, as reported by Patchstack. The flaw requires user interaction but no prior authentication, and operates over the network with low complexity. The CVSS 3.1 base score is 7....
CVE-2026-81292 WordPress Simple Payment plugin <= 2.5.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Simple Payment = 2.5.1 versions...
WordPress Simple Ajax Chat plugin < 20260827 - Unauthenticated Stored XSS vulnerability
Unauthenticated Stored XSS vulnerability discovered by Erwan LR WPScan in WordPress Plugin Simple Ajax Chat versions 20260827...
CVE-2026-84777: Authentication Bypass Using an Alternate Path or Channel
Unauthenticated Broken Authentication in Really Simple SSL = 9.8.0 versions...
PT-2026-85113
Unauthenticated Broken Authentication in Really Simple SSL = 9.8.0 versions...
CVE-2026-81292: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Simple Payment = 2.5.1 versions...
PT-2026-85088
Unauthenticated Cross Site Scripting XSS in Simple Payment = 2.5.1 versions...
CVE-2026-8151
The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks in its settings page, allowing attackers to trick a logged-in administrator into changing the configured third-party API key. Once replaced, all subsequent member registration data name, email,...
CVE-2026-8151 Simple Membership MailChimp Integration < 1.9.8 - API Key Update via CSRF
The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks in its settings page, allowing attackers to trick a logged-in administrator into changing the configured third-party API key. Once replaced, all subsequent member registration data name, email,...
CVE-2026-8151
The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 lacks CSRF protection on its settings page. An attacker can craft a request that, when submitted by a logged-in administrator , silently replaces the configured MailChimp API key. Once swapped, all subsequent member registr...
CVE-2026-8151 Simple Membership MailChimp Integration < 1.9.8 - API Key Update via CSRF
The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks in its settings page, allowing attackers to trick a logged-in administrator into changing the configured third-party API key. Once replaced, all subsequent member registration data name, email,...
EUVD-2026-70043
The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks in its settings page, allowing attackers to trick a logged-in administrator into changing the configured third-party API key. Once replaced, all subsequent member registration data name, email,...
WordPress Simple Payment plugin <= 2.5.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by V1T in WordPress Plugin Simple Payment versions = 2.5.1...
CVE-2026-84775
Unauthenticated Denial of Service Attack in Really Simple SSL = 9.8.0 versions...
CVE-2026-84775
CVE-2026-84775 affects the Really Simple SSL WordPress plugin, versions 9.8.0 and earlier . The vulnerability allows an unauthenticated Denial of Service attack, meaning a remote attacker with no prior access can disrupt service availability. The CVSS 3.1 base score is 5.3 (MEDIUM) , with the pri...