9812 matches found
EUVD-2026-63317
Subscriber Arbitrary File Upload in Smart Cleaning = 4.8.6 versions...
CVE-2026-74014
A Subscriber (low-privileged WordPress user) in the IT Residence theme
CVE-2026-74016 WordPress Smart Cleaning theme <= 4.8.6 - Arbitrary File Upload vulnerability
Subscriber Arbitrary File Upload in Smart Cleaning = 4.8.6 versions...
CVE-2026-74016
The WordPress Smart Cleaning theme (≤4.8.6) allows any logged-in subscriber to upload arbitrary files, enabling remote code execution. Patchstack reports this as critical (CVSS 9.9) with a fix available in newer theme versions; upgrading the theme is the primary mitigation. No in-the-wild exploit...
CVE-2026-74014 WordPress IT Residence theme <= 3.2.1 - Arbitrary File Upload vulnerability
Subscriber Arbitrary File Upload in IT Residence = 3.2.1 versions...
CVE-2026-74013
eShipper Commerce WordPress plugin (versions
CVE-2026-74013 WordPress eShipper Commerce plugin <= 2.16.13 - SQL Injection vulnerability
Subscriber SQL Injection in eShipper Commerce = 2.16.13 versions...
EUVD-2026-63315
Subscriber SQL Injection in eShipper Commerce = 2.16.13 versions...
CVE-2026-73998
The WordPress WP w3all phpBB plugin (≤ 3.0.5) has a SQL injection vulnerability exploitable by authenticated subscribers with network access; no patch version or in-the-wild exploitation details are provided in the documents.
EUVD-2026-63313
Subscriber SQL Injection in WP w3all phpBB = 3.0.5 versions...
CVE-2026-73998 WordPress WP w3all phpBB plugin <= 3.0.5 - SQL Injection vulnerability
Subscriber SQL Injection in WP w3all phpBB = 3.0.5 versions...
CVE-2026-73992 WordPress Query Wrangler plugin <= 1.5.57 - Remote Code Execution (RCE) vulnerability
Subscriber Remote Code Execution RCE in Query Wrangler = 1.5.57 versions...
EUVD-2026-63311
Subscriber Remote Code Execution RCE in Query Wrangler = 1.5.57 versions...
CVE-2026-73992
The WordPress Query Wrangler plugin (versions ≤ 1.5.57) allows authenticated subscribers to execute arbitrary code remotely, yielding full server compromise (CVSS 9.9 Critical, network-exploitable with low complexity). No in-the-wild exploitation or patch version is documented in the provided sou...
CVE-2026-73402 WordPress WP BASE Booking plugin <= 6.3.2 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting XSS in WP BASE Booking = 6.3.2 versions...
EUVD-2026-63310
Subscriber Cross Site Scripting XSS in WP BASE Booking = 6.3.2 versions...
CVE-2026-73402
WP BASE Booking (a WordPress plugin for managing appointments, services, and events) versions ≤ 6.3.2 are affected by a Subscriber Cross-Site Scripting (XSS) vulnerability. The flaw requires low privileges and user interaction , with a changed scope indicating cross-origin impact. CVSS 3.1 base s...
EUVD-2026-63305
Subscriber Broken Authentication in Leyka = 3.32.3 versions...