44928 matches found
CVE-2026-48835 WordPress Contact Form by WPForms plugin <= 1.10.0.4 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Contact Form by WPForms = 1.10.0.4 versions...
EUVD-2026-36836
Subscriber Cross Site Scripting XSS in Modula Image Gallery = 2.14.23 versions...
EUVD-2026-36833
Unauthenticated Broken Authentication in Email Marketing for WooCommerce by Omnisend = 1.18.0 versions...
CVE-2026-42667
The CVE details an unauthenticated sensitive data exposure in the WordPress Bookly plugin, version
CVE-2026-42659 WordPress Advanced Form Integration plugin <= 1.126.12 - Broken Access Control vulnerability
Subscriber Broken Access Control in Advanced Form Integration = 1.126.12 versions...
CVE-2026-42657 WordPress Contest Gallery plugin <= 28.1.7 - Other Vulnerability Type vulnerability
Unauthenticated Other Vulnerability Type in Contest Gallery = 28.1.7 versions...
CVE-2026-42656 WordPress Contest Gallery plugin <= 28.1.6 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting XSS in Contest Gallery = 28.1.6 versions...
EUVD-2026-36820
Unauthenticated Bypass Vulnerability in Best Payments Plugin for WP = 4.6.19 versions...
CVE-2026-42655 WordPress Best Payments Plugin for WP plugin <= 4.6.19 - Payment Bypass vulnerability
Unauthenticated Bypass Vulnerability in Best Payments Plugin for WP = 4.6.19 versions...
CVE-2026-42640 WordPress Classified Listing plugin <= 5.3.8 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Classified Listing = 5.3.8 versions...
CVE-2026-42381 WordPress Funnel Builder by FunnelKit plugin <= 3.15.0.1 - SQL Injection vulnerability
Unauthenticated SQL Injection in Funnel Builder by FunnelKit = 3.15.0.1 versions...
CVE-2026-40796
CVE-2026-40796 affects WordPress WPPizza plugin versions
CVE-2026-40794
The CVE concerns WordPress plugin myCred ≤ 3.0.3 with a Broken Access Control vulnerability. Affected software: WordPress plugin myCred (versions up to 3.0.3). The provided sources identify the issue but do not disclose the exact root cause, affected functions/files, or concrete impact details be...
CVE-2026-40785 WordPress AutomatorWP plugin <= 5.6.7 - Broken Authentication vulnerability
Subscriber Broken Authentication in AutomatorWP = 5.6.7 versions...
CVE-2026-40775
WordPress plugin Royal MCP (for the WordPress ecosystem) is affected up to version 1.4.2. The CVE describes an Unauthenticated Broken Access Control vulnerability, i.e., an attacker without credentials can access restricted functionality. The CVSS metrics (CVSS:3.1, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:...
CVE-2026-40741 WordPress Redsys for WooCommerce Light plugin <= 7.0.0 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Redsys for WooCommerce Light = 7.0.0 versions...
CVE-2026-39587
CVE-2026-39587 affects WordPress WP BASE Booking plugin versions
CVE-2026-39540
CVE-2026-39540 concerns WordPress plugin Shipment Tracker for Woocommerce (versions up to and including 1.5.3.2). The vulnerability is a Cross Site Scripting (XSS) issue in subscriber-facing context. Public sources indicate a CVSSv3.1 base score of 6.5 (Medium) with network attack vector, low att...