EUVD-2026-91919

The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Write in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping. This makes it possible f...

CVE-2026-97344 Wp Social Login and Register Social Counter <= 3.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Write

The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Write in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping. This makes it possible f...

User Meta WP Plugin < 3.1 - Sensitive Information Exposure

The User Meta is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0 via the /views/debug.php file. This makes it possible for unauthenticated attackers, with to extract sensitive configuration data. id: CVE-2024-33575 info: name: User Meta WP Plugin 3.1 -...

Ultimate Member < 2.1.12 - Unauthenticated Privilege Escalation via User Meta

An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Meta. An attacker could supply an array parameter for sensitive metadata, such as the wpcapabilities user meta that defines a user's role. During the registration...

CVE-2024-1071-Docker

CVE-2024-1071 с Docker 🎯 Хотите попрактиковаться с новой CVE для WordPress? Следуйте инструкциям Сборка лабораторной среды 1. Установите Docker: https://docs.docker.com/get-docker/ 2. Клонируйте проект: git clone https://github.com/Trackflaw/CVE-2024-1071-Docker.git. 3. Перейдите в проект: cd...

CVE-2026-90992

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User Meta Merge via 'user-mediaurl' Media Field in all versions up to, and including, 4.5.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi...

CVE-2026-90992 Redux Framework <= 4.5.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user-mediaurl' Media Field

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User Meta Merge via 'user-mediaurl' Media Field in all versions up to, and including, 4.5.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi...

EUVD-2026-90562

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User Meta Merge via 'user-mediaurl' Media Field in all versions up to, and including, 4.5.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi...

CVE-2026-90992

The Redux Framework plugin for WordPress (versions up to and including 4.5.14 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping during the 'User Meta Merge' process via the 'user-mediaurl' media field. Authenticated attack...

CVE-2026-999999

X-Trading Portal: Региональная финансовая инфраструктура v1.4.2 Обзор Этот репозиторий содержит основные дистрибутивы и конфигурации развертывания для X-Trading Portal XTP , контейнеризованного решения, предназначенного для розничных банковских и фондовых торговых услуг. Эта версия v1.4.2 включае...

CVE-2025-4334

🔓 Simple User Registration = 6.3 - 인증되지 않은 권한 상승 📄 설명 WordPress용 Simple User Registration 플러그인은 6.3 을 포함한 모든 버전에서 권한 상승 취약점에 노출되어 있습니다. 이는 등록 중에 제공될 수 있는 사용자 메타 값에 대한 제한이 충분하지 않기 때문입니다. 이로 인해 인증되지 않은 공격자 가 관리자 로 등록할 수 있습니다. 🛡️ 취약점 세부 정보 속성| 값 ---|--- 유형| 부적절한 권한 관리 CVE| CVE-2025-4334 CVSS 점수| 9.8...

CVE-2026-13152

CVE-2026-13152: Custom Fields Account Registration For WooCommerce 1.4의 인증되지 않은 권한 상승 -blue.svg 📖 권고 개요 CVE-2026-13152는 보안 연구원 Huynh Kien MinhMinhHK가 발견하고 분석한, Custom Fields Account Registration For WooCommerce WordPress 플러그인 1.4 미만 버전에 영향을 미치는 인증되지 않은 권한 상승 취약점입니다. 이 결함은 플러그인이 보호된 데이터베이스 키를 살균...

CVE-2026-86608

The WP Recipe Maker WordPress plugin (versions 9.8.0-10.8.1 ) is vulnerable to an unauthenticated Denial of Service (DoS) . The flaw exists because one of the plugin's REST routes lacks proper authorization checks and fails to bound the data it stores. This allows unauthenticated attackers to wri...

PT-2026-95789

Name of the Vulnerable Software and Affected Versions Redux Framework versions prior to 4.5.14 Description Stored Cross-Site Scripting occurs via Media field filter values. The issue stems from insufficient input sanitization of nested array values in the user meta save function and unsafe output...

PT-2026-95802

Name of the Vulnerable Software and Affected Versions Redux Framework versions prior to 4.5.14 Description Stored Cross-Site Scripting occurs via the spinner field due to insufficient input sanitization and output escaping. In the user meta save function, scalar values bypass sanitization logic...

WordPress Mapster WP Maps plugin <= 1.23.0 - Authenticated (Subscriber+) Arbitrary User Meta Write vulnerability

Authenticated Subscriber+ Arbitrary User Meta Write vulnerability discovered by Wordfence PRISM in WordPress Plugin Mapster WP Maps versions = 1.23.0...

CVE-2026-12954

The Mapster WP Maps plugin for WordPress is vulnerable to Arbitrary User Meta Write in all versions up to, and including, 1.23.0 via the myprofileupdate function. This is due to the function performing no nonce verification, no capability check, and no allowlist validation on the meta key supplie...

CVE-2026-12954 Mapster WP Maps <= 1.23.0 - Authenticated (Subscriber+) Arbitrary User Meta Write via 'acf-photo-gallery-groups' Parameter

The Mapster WP Maps plugin for WordPress is vulnerable to Arbitrary User Meta Write in all versions up to, and including, 1.23.0 via the myprofileupdate function. This is due to the function performing no nonce verification, no capability check, and no allowlist validation on the meta key supplie...

EUVD-2026-82756

The Mapster WP Maps plugin for WordPress is vulnerable to Arbitrary User Meta Write in all versions up to, and including, 1.23.0 via the myprofileupdate function. This is due to the function performing no nonce verification, no capability check, and no allowlist validation on the meta key supplie...

CVE-2026-12954

The Mapster WP Maps WordPress plugin (≤ 1.23.0) is vulnerable to Arbitrary User Meta Write via the my_profile_update() function. The function performs no nonce verification, capability check, or allowlist validation on the meta key supplied through the acf-photo-gallery-groups POST parameter befo...