3951 matches found
CVE-2026-18512: Improper Neutralization of Input During Web Page Generation
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Approved Comment Body Rendered in Translation Editor Strings Dropdown in all versions up to, and including, 3.2.6 due to insufficient input sanitization and...
CVE-2026-75930: Missing Authorization
The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.8.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated...
CVE-2026-78266
AutomatorWP , a WordPress plugin , is affected by a Broken Access Control vulnerability in versions ≤ 5.8.3 . The flaw allows a Subscriber -level authenticated user to perform actions beyond their expected permissions, resulting in a high integrity impact (CVSS 3.1 base score 6.5 / MEDIUM ). The ...
CVE-2026-32561: Incorrect Privilege Assignment
Subscriber Privilege Escalation in Booking Hub = 1.3.0 versions...
CVE-2026-27364: Missing Authorization
Subscriber Broken Access Control in Style Kits = 2.6.5 versions...
CVE-2026-78272: Missing Authorization
Subscriber Broken Access Control in Fluent Support Pro = 2.3.1 versions...
CVE-2026-32478: Improper Neutralization of Special Elements used in an SQL Command
Subscriber SQL Injection in WP Project Manager Pro = 4.0.1 versions...
CVE-2026-32559: Unrestricted Upload of File with Dangerous Type
Subscriber Arbitrary File Upload in UltimateAI = 3.1.0 versions...
CVE-2026-78266: Missing Authorization
Subscriber Broken Access Control in AutomatorWP = 5.8.3 versions...
CVE-2026-14853: Missing Authorization
The WooCommerce Bookings WordPress plugin before 3.9.0 does not perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by omitting the token, allowing users with Subscriber-level access and above to create draft bookable products...
CVE-2026-16149: Improper Privilege Management
The Security Hardener plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.4. The vulnerability exists because the plugin's user-enumeration protection, which is enabled by default, hooks the restendpoints filter via secureuserendpoints and...
CVE-2026-18027: Improper Limitation of a Pathname to a Restricted Directory
The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.9.8 via the getimagesrcinbase64 function. This makes it possible for authenticated attackers, with...
CVE-2026-76057: Missing Authorization
The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an...
CVE-2026-19883: Improper Privilege Management
The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the wpematicoimportsettings function in all versions up to, and including, 2.8.24. This makes it possible for...
CVE-2026-76074: Missing Authorization
The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an...
CVE-2026-74013: Improper Neutralization of Special Elements used in an SQL Command
Subscriber SQL Injection in eShipper Commerce = 2.16.13 versions...
CVE-2026-73998: Improper Neutralization of Special Elements used in an SQL Command
Subscriber SQL Injection in WP w3all phpBB = 3.0.5 versions...
CVE-2026-73992: Improper Control of Generation of Code
Subscriber Remote Code Execution RCE in Query Wrangler = 1.5.57 versions...