9808 matches found
CVE-2025-9215
StoreEngine Potente Plugin WordPress eCommerce per Pagamenti, Membership, Affiliati, Vendite e Altro = 1.4.0 - Download Arbitrario di File Autenticato Subscriber+ Il plugin StoreEngine contiene una vulnerabilità nella sua funzionalità di Import/Export CSV che consente a qualsiasi utente autentica...
CVE-2026-76063
The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wfpfeaturedvideourl' parameter in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-76063
The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wfp_featured_video_url parameter in all versions up to and including 1.8.1 . The root cause is insufficient input sanitization and output escaping. The REST endpoint used ...
CVE-2026-76063 FundEngine <= 1.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wfp_featured_video_url' Parameter
The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wfpfeaturedvideourl' parameter in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping. This makes it possible for...
EUVD-2026-65276
The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wfpfeaturedvideourl' parameter in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping. This makes it possible for...
EUVD-2026-65274
The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.8.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated...
CVE-2026-75930
FundEngine – Donation and Crowdfunding Platform for WordPress (all versions up to and including 1.8.1 ) suffers from an authorization bypass due to missing authorization verification. An authenticated attacker with subscriber-level access or above can modify arbitrary posts and pages — overwritin...
CVE-2026-19801
The BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This...
EUVD-2026-65193
The BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This...
CVE-2026-19801 BetterLinks <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Short URL Creation via create_fbs_link AJAX Action
The BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This...
WordPress BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP plugin <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Short URL Creation vulnerability
Missing Authorization to Authenticated Subscriber+ Arbitrary Short URL Creation vulnerability discovered by Wordfence PRISM in WordPress Plugin BetterLinks versions = 3.1.0...
EUVD-2026-65166
Subscriber Privilege Escalation in Booking Hub = 1.3.0 versions...
EUVD-2026-65167
Subscriber PHP Object Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...
EUVD-2026-65165
Subscriber Local File Inclusion in MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator = 1.4 versions...
EUVD-2026-65164
Subscriber Arbitrary File Upload in UltimateAI = 3.1.0 versions...
EUVD-2026-65173
Subscriber Broken Access Control in AutomatorWP = 5.8.3 versions...
EUVD-2026-65160
Subscriber Broken Access Control in Style Kits = 2.6.5 versions...