4445 matches found
EUVD-2026-65276
The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wfpfeaturedvideourl' parameter in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping. This makes it possible for...
EUVD-2026-65274
The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.8.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated...
CVE-2026-75930
FundEngine – Donation and Crowdfunding Platform for WordPress (all versions up to and including 1.8.1 ) suffers from an authorization bypass due to missing authorization verification. An authenticated attacker with subscriber-level access or above can modify arbitrary posts and pages — overwritin...
CVE-2026-19801
The BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This...
EUVD-2026-65193
The BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This...
CVE-2026-19801 BetterLinks <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Short URL Creation via create_fbs_link AJAX Action
The BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This...
WordPress BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP plugin <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Short URL Creation vulnerability
Missing Authorization to Authenticated Subscriber+ Arbitrary Short URL Creation vulnerability discovered by Wordfence PRISM in WordPress Plugin BetterLinks versions = 3.1.0...
EUVD-2026-65166
Subscriber Privilege Escalation in Booking Hub = 1.3.0 versions...
EUVD-2026-65167
Subscriber PHP Object Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...
EUVD-2026-65164
Subscriber Arbitrary File Upload in UltimateAI = 3.1.0 versions...
EUVD-2026-65165
Subscriber Local File Inclusion in MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator = 1.4 versions...
PT-2026-81124
The BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This...
CVE-2026-32563
Subscriber PHP Object Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...
CVE-2026-32559
Subscriber Arbitrary File Upload in UltimateAI = 3.1.0 versions...
CVE-2026-32563 WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - PHP Object Injection vulnerability
Subscriber PHP Object Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...
CVE-2026-32563 WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - PHP Object Injection vulnerability
Subscriber PHP Object Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...
CVE-2026-32560 WordPress MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator plugin <= 1.4 - Local File Inclusion vulnerability
Subscriber Local File Inclusion in MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator = 1.4 versions...
CVE-2026-32560 WordPress MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator plugin <= 1.4 - Local File Inclusion vulnerability
Subscriber Local File Inclusion in MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator = 1.4 versions...
CVE-2026-32560
MagicAI for WordPress (AI Text, Image, Chat, Code, and Voice Generator) plugin versions ≤ 1.4 are affected by a Local File Inclusion (LFI) vulnerability accessible to authenticated users with the Subscriber role. The vulnerability is rated CVSS 8.8 (HIGH) by Patchstack, with a network attack vect...