156 matches found
CVE-2026-1310 Simple calendar for Elementor <= 1.6.6 - Missing Authorization to Unauthenticated Arbitrary Calendar Entry Deletion
The Simple calendar for Elementor plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.6.6. This is due to missing capability checks on the migaajaxeditorcaldelete function that is hooked to the migaeditorcaldelete AJAX action with both authenticated...
CVE-2026-1310
CVE-2026-1310 affects the WordPress plugin Simple calendar for Elementor. The vulnerability is due to missing capability checks in the miga_ajax_editor_cal_delete handler (hooked to the miga_editor_cal_delete AJAX action), granting unauthenticated access to delete calendar entries. It impacts all...
WordPress Simple calendar for Elementor plugin <= 1.6.6 - Missing Authorization to Unauthenticated Arbitrary Calendar Entry Deletion vulnerability
Missing Authorization to Unauthenticated Arbitrary Calendar Entry Deletion vulnerability discovered by Nabil Irawan - Heroes Cyber Security in WordPress Plugin Simple calendar for Elementor versions = 1.6.6...
CVE-2026-24538 WordPress Omnipress plugin <= 1.6.7 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in omnipressteam Omnipress omnipress allows PHP Local File Inclusion.This issue affects Omnipress: from n/a through = 1.6.7...
PT-2026-4385
Name of the Vulnerable Software and Affected Versions omnipressteam Omnipress versions through 1.6.6 Description The software contains a flaw related to improper control of filename for include/require statements, specifically a PHP Remote File Inclusion issue. This allows for PHP Local File...
OPENSUSE-SU-2026:10034-1 python311-Authlib-1.6.6-1.1 on GA media
These are all security issues fixed in the python311-Authlib-1.6.6-1.1 package on the GA media of openSUSE Tumbleweed...
CVE-2025-14429
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeMove AeroLand aeroland allows PHP Local File Inclusion.This issue affects AeroLand: from n/a through = 1.6.6...
CVE-2025-68158 Authlib: 1-click Account Takeover
Authlib is a Python library which builds OAuth and OpenID Connect servers. In versions 1.0.0 through 1.6.5, cache-backed state/request-token storage is not tied to the initiating user session, so CSRF is possible for any attacker that has a valid state easily obtainable via an attacker-initiated...
CVE-2025-14429
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeMove AeroLand aeroland allows PHP Local File Inclusion.This issue affects AeroLand: from n/a through = 1.6.6...
CVE-2025-14429 WordPress AeroLand theme <= 1.6.6 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeMove AeroLand aeroland allows PHP Local File Inclusion.This issue affects AeroLand: from n/a through = 1.6.6...
WordPress plugin AeroLand 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...
WordPress AeroLand theme <= 1.6.6 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme AeroLand versions = 1.6.6...
CVE-2024-2657
The Font Farsi plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.6.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and...
CVE-2025-59138
Server-Side Request Forgery SSRF vulnerability in Jthemes Genemy genemy allows Server Side Request Forgery.This issue affects Genemy: from n/a through = 1.6.6...
CVE-2025-59138 WordPress Genemy theme <= 1.6.6 - Server Side Request Forgery (SSRF) vulnerability
Server-Side Request Forgery SSRF vulnerability in Jthemes Genemy genemy allows Server Side Request Forgery.This issue affects Genemy: from n/a through = 1.6.6...
EUVD-2025-205997
Server-Side Request Forgery SSRF vulnerability in Jthemes Genemy allows Server Side Request Forgery.This issue affects Genemy: from n/a through 1.6.6...
CVE-2025-59138
CVE-2025-59138 is reported for Genemy, the WordPress theme/landing-page builder, alleging a Server-Side Request Forgery (SSRF) in Genemy
WordPress Genemy theme <= 1.6.6 - Server Side Request Forgery (SSRF) vulnerability
Server Side Request Forgery SSRF vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Genemy versions = 1.6.6...