9812 matches found
CVE-2026-81299 WordPress WP Job Portal plugin <= 2.5.9 - Insecure Direct Object References (IDOR) vulnerability
Subscriber Insecure Direct Object References IDOR in WP Job Portal = 2.5.9 versions...
EUVD-2026-67729
Subscriber Insecure Direct Object References IDOR in WP Job Portal = 2.5.9 versions...
WordPress All-in-One WP Migration Unlimited Extension plugin <= 2.84 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'ai1wm_backups_path' Parameter vulnerability
Authenticated Subscriber+ Stored Cross-Site Scripting via 'ai1wmbackupspath' Parameter vulnerability discovered by Rafie Muhammad - Awesome Motive, Inc. in WordPress Plugin All-in-One WP Migration Unlimited Extension versions = 2.84...
CVE-2025-1304
🚨 Tema WordPress NewsBlogger = 0.2.5.1 - Caricamento File Arbitrario CVE-2025-1304 Punteggio CVSS: 8.8 Alto Tipo di Vulnerabilità: Caricamento File Arbitrario Componente: Tema WordPress ID CVE: CVE-2025-1304 🔥 Panoramica della Vulnerabilità Il tema WordPress NewsBlogger versioni = 0.2.5.1 è...
CVE-2024-30485
CVE-2024-30485 Exploit 📌 Übersicht CVE-2024-30485 ist eine Schwachstelle mit hohem Schweregrad, die im Finale Lite -Plugin für WordPress Versionen = 2.18.0 gefunden wurde. Die Schwachstelle ermöglicht authentifizierten Benutzern Subscriber+ das Installieren und Aktivieren beliebiger Plugins ohne...
CVE-2024-1247-PoC
CVE-2024-1247-PoC Post Saint = 1.3.1 Plugin für WordPress Beliebiger Datei-Upload Beschreibung Das Post Saint Plugin für WordPress Versionen bis einschließlich 1.3.1 ist aufgrund fehlender Berechtigungsprüfungen und Dateitypvalidierung anfällig für beliebige Datei-Uploads. Authentifizierte...
WordPress Simple Membership plugin < 4.7.8 - Unauthenticated Stored XSS via PayPal Subscription Subscriber Name vulnerability
Unauthenticated Stored XSS via PayPal Subscription Subscriber Name vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Simple Membership versions 4.7.8...
WordPress WP Maps plugin < 4.9.7 - Subscriber+ Local File Inclusion vulnerability
Subscriber+ Local File Inclusion vulnerability discovered by Jakub Herman in WordPress Plugin WP Maps versions 4.9.7...
WordPress Content Views plugin < 4.5 - Subscriber+ SQL Injection via preview_request vulnerability
Subscriber+ SQL Injection via previewrequest vulnerability discovered by Jakub Herman in WordPress Plugin Content Views versions 4.5...
WordPress Library Management System plugin < 3.6.7 - Subscriber+ SQL Injection via Filter Value vulnerability
Subscriber+ SQL Injection via Filter Value vulnerability discovered by João Ramos Maciel in WordPress Plugin Library Management System versions 3.6.7...
WordPress Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin 8.5-8.9.3 - 8.9.2 - Subscriber+ Arbitrary Image Move vulnerability
WordPress Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin 8.5-8.9.3 - 8.9.2 - Subscriber+ Arbitrary Image Move vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Directorist versions 8.5-8.9.2...
CVE-2026-6128
The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ai1wmbackupspath' parameter in all versions up to, and including, 2.84. This is due to insufficient input sanitization and output escaping on user-supplied attributes combine...
CVE-2026-79995
The User Registration & Membership WordPress plugin before 5.2.5 does not verify that the account whose pending email change is being cancelled belongs to the user making the request, allowing authenticated users with Subscriber-level access and above to cancel any other user's in-progress email...
EUVD-2026-67648
The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ai1wmbackupspath' parameter in all versions up to, and including, 2.84. This is due to insufficient input sanitization and output escaping on user-supplied attributes combine...
CVE-2026-6128
The All-in-One WP Migration Unlimited Extension WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) via the ai1wm_backups_path parameter in all versions up to and including 2.84 . The root cause is insufficient input sanitization and output escaping on user-supplied attributes, co...
CVE-2026-6128 All-in-One WP Migration Unlimited Extension <= 2.84 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'ai1wm_backups_path' Parameter
The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ai1wmbackupspath' parameter in all versions up to, and including, 2.84. This is due to insufficient input sanitization and output escaping on user-supplied attributes combine...
WordPress One User Avatar | User Profile Picture plugin <= 2.5.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via wpua-file Parameter vulnerability
Authenticated Subscriber+ Stored Cross-Site Scripting via wpua-file Parameter vulnerability discovered by Dthangws - PTIT in WordPress Plugin One User Avatar versions = 2.5.4...
EUVD-2026-67574
The User Registration & Membership WordPress plugin before 5.2.5 does not verify that the account whose pending email change is being cancelled belongs to the user making the request, allowing authenticated users with Subscriber-level access and above to cancel any other user's in-progress email...
WordPress User Registration & Membership plugin < 5.2.5 - Subscriber+ Pending Email Change Cancellation vulnerability
Subscriber+ Pending Email Change Cancellation vulnerability discovered by Sai Praneeth Koti in WordPress Plugin User Registration versions 5.2.5...