4557 matches found
CVE-2026-18512
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Approved Comment Body Rendered in Translation Editor Strings Dropdown in all versions up to, and including, 3.2.6 due to insufficient input sanitization and...
CVE-2026-18512
The TranslatePress WordPress plugin (multilingual/AI translation) is vulnerable to Stored XSS in all versions up to and including 3.2.6 . The root cause is insufficient input sanitization and output escaping of approved comment body content rendered in the Translation Editor Strings Dropdown comp...
EUVD-2026-65317
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Approved Comment Body Rendered in Translation Editor Strings Dropdown in all versions up to, and including, 3.2.6 due to insufficient input sanitization and...
CVE-2026-18512 TranslatePress <= 3.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Approved Comment Body in Translation Editor
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Approved Comment Body Rendered in Translation Editor Strings Dropdown in all versions up to, and including, 3.2.6 due to insufficient input sanitization and...
CVE-2026-16601
CM Map Locations for WordPress (all versions ≤ 2.1.8 ) is vulnerable to limited arbitrary file upload via the cmloc_route_image_upload AJAX action. The uploadMedia function performs incomplete extension filtering without MIME-type checks or upload capability verification before calling move_uploa...
CVE-2026-16601 CM Map Locations <= 2.1.8 - Authenticated (Subscriber+) Arbitrary File Upload via cmloc_route_image_upload AJAX Action
The CM Map Locations – Visualize and share your locations in a few clicks plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 2.1.8 via the uploadMedia function. This is due to insufficient file type validation in the upload handler, which...
CVE-2026-78466
Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-78278. Reason: This candidate is a reservation duplicate of CVE-2026-78278. Notes: All CVE users should reference CVE-2026-78278 instead of this candidate. All references and descriptions in this candidate have been...
CVE-2026-78470
The WP Project Manager Pro plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers,...
CVE-2026-78466
This CVE is marked as a rejected reservation duplicate of CVE-2026-78278 , but connected documents provide concrete technical details. The Fluent Boards Pro plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to and including 2.0.11 , caused by missing valida...
EUVD-2026-65299
The WP Project Manager Pro plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers,...
CVE-2026-78467
...
CVE-2026-78467
CVE-2026-78467 is a reservation duplicate of CVE-2026-78272 and has been rejected by the CNA. The underlying vulnerability affects the Fluent Support Pro plugin for WordPress, specifically a missing capability check on a function in all versions up to and including 2.3.1 . This allows authenticat...
CVE-2026-76063
The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wfpfeaturedvideourl' parameter in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-76063
The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wfp_featured_video_url parameter in all versions up to and including 1.8.1 . The root cause is insufficient input sanitization and output escaping. The REST endpoint used ...
CVE-2026-76063 FundEngine <= 1.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wfp_featured_video_url' Parameter
The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wfpfeaturedvideourl' parameter in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping. This makes it possible for...
EUVD-2026-65276
The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wfpfeaturedvideourl' parameter in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping. This makes it possible for...
EUVD-2026-65274
The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.8.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated...
CVE-2026-75930
FundEngine – Donation and Crowdfunding Platform for WordPress (all versions up to and including 1.8.1 ) suffers from an authorization bypass due to missing authorization verification. An authenticated attacker with subscriber-level access or above can modify arbitrary posts and pages — overwritin...