10010 matches found
CVE-2026-6128 All-in-One WP Migration Unlimited Extension <= 2.84 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'ai1wm_backups_path' Parameter
The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ai1wmbackupspath' parameter in all versions up to, and including, 2.84. This is due to insufficient input sanitization and output escaping on user-supplied attributes combine...
WordPress One User Avatar | User Profile Picture plugin <= 2.5.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via wpua-file Parameter vulnerability
Authenticated Subscriber+ Stored Cross-Site Scripting via wpua-file Parameter vulnerability discovered by Dthangws - PTIT in WordPress Plugin One User Avatar versions = 2.5.4...
EUVD-2026-67574
The User Registration & Membership WordPress plugin before 5.2.5 does not verify that the account whose pending email change is being cancelled belongs to the user making the request, allowing authenticated users with Subscriber-level access and above to cancel any other user's in-progress email...
WordPress User Registration & Membership plugin < 5.2.5 - Subscriber+ Pending Email Change Cancellation vulnerability
Subscriber+ Pending Email Change Cancellation vulnerability discovered by Sai Praneeth Koti in WordPress Plugin User Registration versions 5.2.5...
CVE-2026-79995
The User Registration & Membership WordPress plugin (versions
WordPress Workeera plugin < 1.0.6 - Subscriber+ Arbitrary File Read vulnerability
Subscriber+ Arbitrary File Read vulnerability discovered by Artus KG and Shhriyash in WordPress Plugin Workeera versions 1.0.6...
WordPress Workeera plugin < 1.0.6 - Subscriber+ Arbitrary File Deletion vulnerability
Subscriber+ Arbitrary File Deletion vulnerability discovered by Artus KG and Shhriyash in WordPress Plugin Workeera versions 1.0.6...
WordPress Workeera plugin < 1.0.6 - Subscriber+ Arbitrary File Upload vulnerability
Subscriber+ Arbitrary File Upload vulnerability discovered by Erwan LR WPScan in WordPress Plugin Workeera versions 1.0.6...
WordPress Salon booking system plugin <= 10.31.1 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Salon booking system versions = 10.31.1...
CVE-2026-81274
Subscriber Broken Access Control in Ditty = 3.1.67 versions...
CVE-2026-81279
Subscriber Broken Access Control in Push Notification for Post and BuddyPress = 3.20 versions...
CVE-2026-78285
Subscriber SQL Injection in Like Button Rating = 2.6.61 versions...
CVE-2026-80433
Subscriber Sensitive Data Exposure in SureFeedback Client Site = 1.2.12 versions...
CVE-2026-78273
Subscriber Cross Site Scripting XSS in Fluent Boards Pro = 2.0.11 versions...
CVE-2026-32550
Subscriber SQL Injection in Kadence Shop Kit = 3.0.6 versions...
CVE-2026-32564
Subscriber SQL Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...
CVE-2026-81274
The WordPress Ditty (News Ticker) plugin (versions
CVE-2026-81274 WordPress Ditty plugin <= 3.1.67 - Broken Access Control vulnerability
Subscriber Broken Access Control in Ditty = 3.1.67 versions...