3999 matches found
CVE-2026-45436: Missing Authorization
Subscriber Broken Access Control in WPBakery Page Builder = 8.7.2 versions...
CVE-2026-54805: Incorrect Privilege Assignment
Subscriber Privilege Escalation in Falang multilanguage = 1.4.2 versions...
CVE-2026-25446: Unrestricted Upload of File with Dangerous Type
Subscriber Arbitrary File Upload in WishList Member X = 3.29.0 versions...
CVE-2026-48967: Improper Neutralization of Special Elements used in an SQL Command
Subscriber SQL Injection in Geo Mashup = 1.13.19 versions...
CVE-2026-40749: Unrestricted Upload of File with Dangerous Type
Subscriber Arbitrary File Upload in Charity Zone = 1.1.1 versions...
CVE-2026-40748: Unrestricted Upload of File with Dangerous Type
Subscriber Arbitrary File Upload in Kids Gift Shop = 0.5.4 versions...
CVE-2026-40723: Missing Authorization
Subscriber Broken Access Control in Bricks Builder = 2.1.4 versions...
CVE-2026-39546: Incorrect Privilege Assignment
Subscriber Privilege Escalation in MultiLoca = 4.2.15 versions...
CVE-2026-39433: Missing Authorization
Subscriber Arbitrary Content Deletion in WPAMS 49.5.3 versions...
CVE-2026-24575: Missing Authorization
Subscriber Broken Access Control in WishList Member X = 3.29.0 versions...
CVE-2025-60218: Unrestricted Upload of File with Dangerous Type
Subscriber Arbitrary File Upload in PT Luxa Addons = 1.2.2 versions...
WordPress Plugin: wc-frontend-manager-ultimate: CVE-2026-22335: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Subscriber SQL Injection in WooCommerce Frontend Manager – Ultimate 6.7.7 versions...
CVE-2025-69135: Improper Neutralization of Special Elements used in an SQL Command
Subscriber SQL Injection in Events Schedule - WordPress Events Calendar Plugin = 2.7.2 versions...
CVE-2025-69137: Missing Authorization
Subscriber Broken Access Control in Genemy = 1.6.6 versions...
CVE-2026-8442 WP Review Slider Pro <= 12.6.8 - Authenticated (Subscriber+) Arbitrary File Deletion via 'myaction' Parameter
The WP Review Slider Pro plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 12.6.8. This is due to missing authorization checks on the wpfbhidereview and wprpsavereviewadmin AJAX handlers combined with insufficient path validation in the wpfbhidereviewaj...
CVE-2026-8444
CVE-2026-8444 affects WordPress WP Review Slider Pro (get_results() without $wpdb->prepare(). This allows authenticated attackers with Subscriber-level access or higher to append additional SQL queries to existing queries and potentially extract sensitive database information. The provided met...
CVE-2026-6933
The Premmerce Dev Tools plugin for WordPress is vulnerable to Remote Code Execution via missing authorization in versions up to and including 2.0. This is due to the 'generatePluginHandler' function lacking any authorization check before processing user-supplied POST data, combined with the...
CVE-2026-8443 WP Review Slider Pro <= 12.6.8 - Authenticated (Subscriber+) SQL Injection via 'stypes' Parameter
The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'stypes' and 'slocations' parameters of the wpprogetoverallchartdata AJAX action in versions up to, and including, 12.6.8. This is due to the use of stripslashes on user-supplied JSON strings prior to jsondecode,...
CVE-2026-10093: Improper Neutralization of Input During Web Page Generation
The File Sharing & Download Manager – User Private Files plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fldrttl' parameter in all versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
CVE-2026-8443: Improper Neutralization of Special Elements used in an SQL Command
The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'stypes' and 'slocations' parameters of the wpprogetoverallchartdata AJAX action in versions up to, and including, 12.6.8. This is due to the use of stripslashes on user-supplied JSON strings prior to jsondecode,...