10 matches found
CVE-2026-16779
The Kubio AI Page Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...
WordPress Plugin Administrative Shortcodes Security Vulnerability
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There ar...
PT-2025-51077
Name of the Vulnerable Software and Affected Versions Extensive VC Addons for WPBakery page builder plugin for WordPress versions prior to 1.9.2 Description The software is susceptible to a Local File Inclusion issue due to insufficient path normalization and validation of the shortcode name...
CVE-2024-6305
Rejected reason: REJECT Accidental Reservation making this a duplicate. Please use CVE-2024-31111...
CVE-2024-6306
CVE-2024-6306 is a duplicate of CVE-2024-32111. Connected sources detail a Path Traversal vulnerability in WordPress core, describing improper pathname handling that allowed relative path traversal across multiple versions. The OSV/NVD entries specify affected versions up to WordPress 6.5.4 and i...
WordPress Core < 6.5.5 - Cross Site Scripting (XSS) via template-part vulnerability
Cross Site Scripting XSS via template-part vulnerability discovered by Rafie Muhammad Patchstack in WordPress core versions 6.5.5...
WordPress < 6.5.5 - Contributor+ Path Traversal in Template-Part Block
Description WordPress does not properly escape the "file" attribute in the "Template Part block" allowing high-privileged users to perform Path Traversal on Windows servers, leading to arbitrary File Reads...
WordPress < 6.5.5 - Contributor+ Stored XSS in Template-Part Block
Description WordPress does not properly escape the "tagName" attribute in the "Template Part block" allowing high-privileged users to perform Stored Cross-Site Scripting XSS attacks. As a contributor, add a "Template Part" block to a post, click on "Start Blank" and then Create. Go into Editor mo...
WordPress < 6.5.5 - Contributor+ Stored XSS in Template-Part Block
Description WordPress does not properly escape the "tagName" attribute in the "Template Part block" allowing high-privileged users to perform Stored Cross-Site Scripting XSS attacks. PoC As a contributor, add a "Template Part" block to a post, click on "Start Blank" and then Create. Go into Edito...