CVE-2026-65518

The CVE concerns the WordPress plugin “Accept Donations with PayPal & Stripe” (v <= 1.5.5) and reports a Cross Site Scripting (XSS) vulnerability. Affected product is the WordPress plugin; vulnerability arises from an XSS issue in versions up to 1.5.5 as described in the CVE records. Public re...

CVE-2026-15690

A vulnerability was identified in open62541 up to 1.5.5. Affected by this issue is the function responseReadNamespacesArray of the file src/client/uaclientconnect.c of the component Shared Client Library. Such manipulation of the argument ServerNamespaceArray leads to null pointer dereference. Th...

CVE-2026-57787 WordPress CWS SVGicons plugin <= 1.5.5 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in CreativeWS CWS SVGicons cws-svgicons allows Blind SQL Injection.This issue affects CWS SVGicons: from n/a through = 1.5.5...

CVE-2026-32346

The CVE-2026-32346 entry concerns the WordPress Travel Agency theme (raratheme) &lt;= 1.5.5 with a Missing Authorization vulnerability. The issue stems from incorrectly configured access control allowing bypass of authorization to access restricted functionality or data. Affected software: Travel...

PT-2026-4013

Name of the Vulnerable Software and Affected Versions TheNa versions through 1.5.5 Description The software contains a flaw due to improper handling of user-supplied data when creating web pages, leading to a Reflected Cross-site Scripting XSS condition. This allows an attacker to inject maliciou...

WordPress TheNa theme <= 1.5.5 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme TheNa versions = 1.5.5...

CVE-2025-67470 WordPress Portfolio and Projects plugin <= 1.5.5 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Essential Plugin Portfolio and Projects portfolio-and-projects allows Retrieve Embedded Sensitive Data.This issue affects Portfolio and Projects: from n/a through = 1.5.5...

EUVD-2025-198448

Missing Authorization vulnerability in Essential Plugin Featured Post Creative featured-post-creative allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Featured Post Creative: from n/a through = 1.5.5...

CVE-2025-57974

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in tuyennv TZ PlusGallery tz-plus-gallery allows Stored XSS.This issue affects TZ PlusGallery: from n/a through = 1.5.5...

CVE-2025-57974

CVE-2025-57974 documents a Cross‑Site Scripting (Stored XSS) vulnerability in the WordPress plugin TZ Plus Gallery. Affected range: TZ Plus Gallery

CVE-2025-58660 WordPress Oshine Core Plugin <= 1.5.5 - Broken Access Control Vulnerability

Missing Authorization vulnerability in brandexponents Oshine Core oshine-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Oshine Core: from n/a through = 1.5.5...

CVE-2025-54693

Unrestricted Upload of File with Dangerous Type vulnerability in epiphyt Form Block form-block allows Upload a Web Shell to a Web Server.This issue affects Form Block: from n/a through = 1.5.5...

CVE-2025-54693 WordPress Form Block Plugin <= 1.5.5 - Arbitrary File Upload Vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in epiphyt Form Block form-block allows Upload a Web Shell to a Web Server.This issue affects Form Block: from n/a through = 1.5.5...

CVE-2025-31769

Cross-Site Request Forgery CSRF vulnerability in NiteoThemes CLP – Custom Login Page by NiteoThemes clp-custom-login-page allows Cross Site Request Forgery.This issue affects CLP – Custom Login Page by NiteoThemes: from n/a through = 1.5.5...

CVE-2024-12437 Marketplace Items <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Marketplace Items plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'envato' shortcode in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

WordPress Do That Task plugin <= 1.5.5 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Plugin Do That Task versions = 1.5.5...

PT-2024-22736 · Zaytech · Zaytech Smart Online Order For Clover

Name of the Vulnerable Software and Affected Versions: Zaytech Smart Online Order for Clover versions 1.5.5 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an...

CVE-2023-23882

Missing Authorization vulnerability in Brainstorm Force Ultimate Addons for Beaver Builder – Lite.This issue affects Ultimate Addons for Beaver Builder – Lite: from n/a through 1.5.5...

CVE-2022-45838

Unauth. Stored Cross-Site Scripting XSS vulnerability in Repute InfoSystems ARForms Form Builder plugin = 1.5.5 versions...

CVE-2023-1080

The GN Publisher plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...