475786 matches found
EUVD-2026-54397
Server-Side request forgery SSRF vulnerability in Revenue Administration Türkiye's E-Signature allows Server Side Request Forgery. This issue affects Türkiye's E-Signature: from 2.4.4.0 before 2.5.1.0...
WordPress REST API Log plugin <= 1.7.1 - Sensitive Data Exposure vulnerability
Sensitive Data Exposure vulnerability discovered by Aydan Arabadzha in WordPress Plugin REST API Log versions = 1.7.1...
WordPress WPJAM Basic plugin <= 7.0.2.1 - Sensitive Data Exposure vulnerability
Sensitive Data Exposure vulnerability discovered by winky in WordPress Plugin WPJAM Basic versions = 7.0.2.1...
WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.10 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Visitor Traffic Real Time Statistics Pro versions = 11.10...
CVE-2026-14205
The WP Events Manager WordPress plugin before 2.2.5 does not validate the requested quantity when registering for a paid event and computes the price from the attacker-controlled quantity, allowing any authenticated user to create a completed booking for a paid event without making a payment...
CVE-2026-16030 MStore API < 4.21.0 - Unauthenticated Account Takeover via Firebase Phone Authentication
The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used to authenticate its phone-based login, allowing unauthenticated attackers who know a registered user's phone number to forge a token and take over that user's account, including...
CVE-2026-16041 MStore API < 4.21.0 - Unauthenticated Product Review Creation
The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST product-review creation route, allowing an unauthenticated attacker to create WooCommerce product reviews with an attacker-chosen reviewer name, email and star rating on stores...
CVE-2026-16038
Summary : CVE-2026-16038 affects the MStore API WordPress plugin prior to 4.21.0. The vulnerability arises because the plugin does not verify payment with the gateway on several payment-completion endpoints, allowing an unauthenticated attacker to mark an arbitrary order as fully paid and obtain ...
CVE-2026-15359
Templately WordPress plugin
CVE-2026-15245
CVE-2026-15245 affects the BNE Testimonials WordPress plugin prior to 2.0.8.2. The vulnerability arises from insufficient escaping of a shortcode attribute in a JavaScript context before echoing into an inline script, enabling stored XSS via the Slider shortcode. Impact is that users with contrib...
CVE-2026-15214
The CVE-2026-15214 entry affects the WooCommerce Subscriptions plugin for WordPress (pre-2.0.1). The vulnerability is an IDOR: an authenticated user can view another customer’s subscription details (subscribed product, status, dates) because the plugin does not verify ownership before rendering t...
CVE-2026-14943 Password Protected < 2.8.4 - Unauthenticated Sensitive Information Exposure via REST API
The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin before 2.8.4 does not restrict REST API access to authenticated users when a specific option is enabled, allowing unauthenticated visitors to bypass the sitewide password gate and read...
CVE-2026-14943
The affected product is the WordPress plugin “Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content” (pre-2.8.4). The vulnerability is an unauthenticated REST API exposure: when a specific option is enabled, unauthenticated users can access REST endpoints to read co...
EUVD-2026-54376
The Subscribe2 WordPress plugin before 10.46 does not properly escape a user-supplied value before reflecting it into a public subscription form, leading to Reflected Cross-Site Scripting that executes in the browser of an unauthenticated visitor who interacts with the form through a crafted link...
CVE-2026-19191
A security vulnerability has been detected in StableBit DrivePool 2.3.13.1687. This vulnerability affects unknown code of the file C:\Program Files\StableBit\DrivePool\DrivePool.Service.exe of the component DrivePoolService. Such manipulation leads to permission issues. The attack must be carried...
CVE-2026-12801
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Range Slider 'data-label' and 'data-separator' attributes in all versions up to, and including, 3.5.43 due to insufficient input sanitization and output escaping. This makes it possible f...
CVE-2026-14364
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to account takeover via improper password reset validation in all versions up to, and including, 1.2.3. This is due to the plugin not properly validating a user's identity before resetting their password...
CVE-2026-14365
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
