3996 matches found
CVE-2026-57328: Improper Neutralization of Input During Web Page Generation
Subscriber Cross Site Scripting XSS in Business Directory = 6.4.22 versions...
CVE-2026-57330: Improper Neutralization of Input During Web Page Generation
Subscriber Cross Site Scripting XSS in MasterStudy LMS = 3.7.27 versions...
CVE-2026-57329: Improper Neutralization of Input During Web Page Generation
Subscriber Cross Site Scripting XSS in WooCommerce Designer Pro = 1.9.34 versions...
CVE-2026-57332: Missing Authorization
Subscriber Broken Access Control in Wallet System for WooCommerce = 2.7.6 versions...
CVE-2026-9676: Undefined Security Weakness
The F4 Post Tree WordPress plugin before 2.0.5 does not perform capability checks or CSRF/nonce verification on one of its AJAX actions, allowing authenticated users with Subscriber-level access and above to modify the parent and menu order of arbitrary posts...
EUVD-2026-39968
The Frontend File Manager Plugin plugin for WordPress is vulnerable to Authenticated Arbitrary File Deletion in versions up to and including 23.6. This is due to a case-sensitive bypass of the wpfmdirpath parameter sanitization in the wpfmfilemetaupdate AJAX handler, where supplying WPFMDIRPATH i...
CVE-2026-8095
The Frontend File Manager Plugin plugin for WordPress is vulnerable to Authenticated Arbitrary File Deletion in versions up to and including 23.6. This is due to a case-sensitive bypass of the wpfmdirpath parameter sanitization in the wpfmfilemetaupdate AJAX handler, where supplying WPFMDIRPATH i...
CVE-2026-8095: External Control of File Name or Path
The Frontend File Manager Plugin plugin for WordPress is vulnerable to Authenticated Arbitrary File Deletion in versions up to and including 23.6. This is due to a case-sensitive bypass of the wpfmdirpath parameter sanitization in the wpfmfilemetaupdate AJAX handler, where supplying WPFMDIRPATH i...
CVE-2026-3462
The Frisbii Pay plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the 'uploadcsv' and 'processbatch' functions in all versions up to, and including, 1.8.9. This makes it possible for authenticated attackers, with Subscriber-level access an...
EUVD-2026-39954
The Spexo theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the activateplugin function in all versions up to, and including, 2.0.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate a limited set o...
CVE-2026-11987: Authorization Bypass Through User-Controlled Key
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.0.4 via the 'id' parameter due to missing validation on a user controlled key. This...
CVE-2026-12471: Missing Authorization
The Spexo theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the activateplugin function in all versions up to, and including, 2.0.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate a limited set o...
CVE-2026-3462: Missing Authorization
The Frisbii Pay plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the 'uploadcsv' and 'processbatch' functions in all versions up to, and including, 1.8.9. This makes it possible for authenticated attackers, with Subscriber-level access an...
CVE-2026-57627: Server-Side Request Forgery (SSRF)
Subscriber Server Side Request Forgery SSRF in Kirki = 6.0.11 versions...
CVE-2026-57316: Exposure of Sensitive System Information to an Unauthorized Control Sphere
Subscriber Sensitive Data Exposure in GetGenie = 4.4.2 versions...
CVE-2026-56059: Unrestricted Upload of File with Dangerous Type
Subscriber Arbitrary File Upload in Travel Booking = 2.2.5 versions...
CVE-2026-56046: Improper Neutralization of Input During Web Page Generation
Subscriber Cross Site Scripting XSS in ListingPro = 2.9.11 versions...
CVE-2025-63078: Missing Authorization
Subscriber Broken Access Control in Restaurant Menu by MotoPress = 2.4.11 versions...