10945 matches found
CVE-2026-28003
Unauthenticated Cross Site Scripting XSS in Maspik – Spam blacklist = 2.9.1 versions...
CVE-2026-66689
Unauthenticated Broken Access Control in Anti Spam and list cleaner - AcyChecker = 2.0.0 versions...
CVE-2026-28003
The CVE-2026-28003 entry describes an unauthenticated Cross Site Scripting (XSS) vulnerability in WordPress Maspik – Spam blacklist plugin, affecting versions up to 2.9.1. The issue is documented with CVSSv3.1 base score 7.1 (HIGH) with NETWORK attack vector, no privileges required, user interact...
EUVD-2026-57942
Unauthenticated Cross Site Scripting XSS in Maspik – Spam blacklist = 2.9.1 versions...
PT-2026-71508
Unauthenticated Cross Site Scripting XSS in Maspik – Spam blacklist = 2.9.1 versions...
PT-2026-71588
Unauthenticated Broken Access Control in Anti Spam and list cleaner AcyChecker = 2.0.0 versions...
CVE-2026-69113
Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any private video without permission by supplying an arbitrary videoId in the request body. Attackers can inject comments into private video...
EUVD-2026-56853
Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any private video without permission by supplying an arbitrary videoId in the request body. Attackers can inject comments into private video...
CVE-2026-69113 Cap v0.3.1 Broken Access Control via video comment endpoint
Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any private video without permission by supplying an arbitrary videoId in the request body. Attackers can inject comments into private video...
CVE-2026-65556
Unauthenticated PHP Object Injection in WPBruiser no- Captcha anti-Spam = 3.1.43 versions...
EUVD-2026-53983
Unauthenticated PHP Object Injection in WPBruiser no- Captcha anti-Spam = 3.1.43 versions...
CVE-2026-14547
The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not properly enforce its anti-spam check or restrict the recipient routing of its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To, effectively...
CVE-2026-14547
The CVE-2026-14547 entry affects the Estatik Real Estate Plugin for WordPress, specifically versions before 4.3.3. The root cause is that the plugin does not properly enforce its anti-spam check nor restrict recipient routing for the property request form, allowing unauthenticated users to send e...
EUVD-2026-53721
The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not properly enforce its anti-spam check or restrict the recipient routing of its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To, effectively...
EUVD-2026-53187
The Xpro Addons plugin for WordPress is vulnerable to unauthorized creation of data due to a missing capability check on the getmenucontenteditor function in all versions up to, and including, 1.5.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...
CVE-2026-16774 WPBot <= 8.5.9 - Missing Authorization to Unauthenticated Email Relay via wpcs_send_email AJAX Action
The Chatbot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.5.9 via the wpcssendemail AJAX handler. This is due to the wpcssendemail function being registered on both wpajaxwpcssendemail and wpajaxnoprivwpcssendemail with no nonce verification,...
EUVD-2026-49655
Unauthenticated Cross Site Scripting XSS in Anti Spam and list cleaner AcyChecker = 1.8.1 versions...
EUVD-2026-49665
Unauthenticated Cross Site Scripting XSS in Spam protection, AntiSpam, FireWall by CleanTalk = 6.82 versions...