22633 matches found
EUVD-2026-36979
Unauthenticated Cross Site Scripting XSS in Coupon Affiliates = 7.5.3 versions...
EUVD-2026-36972
Unauthenticated Cross Site Scripting XSS in Notification for Telegram = 3.5 versions...
EUVD-2026-36937
Contributor PHP Object Injection in Post Duplicator = 3.0.10 versions...
EUVD-2026-36935
Author PHP Object Injection in ShortPixel Image Optimizer = 6.4.3 versions...
EUVD-2026-36955
Subscriber Insecure Direct Object References IDOR in EventPrime = 4.3.0.0 versions...
EUVD-2026-36928
Unauthenticated Cross Site Scripting XSS in Contact Form to Any API = 3.0.3 versions...
EUVD-2026-36952
Unauthenticated Broken Access Control in Easy Appointments = 3.12.21 versions...
EUVD-2026-36916
Editor Privilege Escalation in AI Engine = 3.4.9 versions...
EUVD-2026-36926
Unauthenticated SQL Injection in Feed KuantoKusta for WooCommerce – Free = 5.3 versions...
EUVD-2026-36913
Unauthenticated PHP Object Injection in Broadcast Live Video 7.1.3 versions...
EUVD-2026-36909
Unauthenticated Cross Site Scripting XSS in Redirection for Contact Form 7 = 3.2.8 versions...
EUVD-2025-210159
Subscriber Broken Access Control in bunny.net = 2.3.6 versions...
EUVD-2026-36757
Bludit CMS before version 3.18.4 allows Remote Code Execution RCE via the API Plugin. The POST /api/files/key endpoint in bl-plugins/api/plugin.php fails to perform authorization checks and lacks file extension validation. An attacker with a valid API token can upload a malicious PHP script and...
CVE-2026-52700
Subscriber SQL Injection in WCMultiShipping = 3.0.2 versions...
CVE-2026-48889
Subscriber Privilege Escalation in Amelia = 2.3 versions...
CVE-2026-48883
Unauthenticated Broken Access Control in WPC Product Bundles for WooCommerce = 8.5.3 versions...
CVE-2026-48838
Unauthenticated Cross Site Scripting XSS in Post SMTP = 3.6.2 versions...
CVE-2026-45441
Unauthenticated Other Vulnerability Type in WpEvently = 5.3.3 versions...