279179 matches found
CVE-2026-78528
CVE-2026-78528 affects the WordPress plugin BerqWP in versions 4.1.15 and earlier . The vulnerability is an unauthenticated Broken Access Control flaw, discovered by z3r0s , meaning any remote user can exploit it without prior authentication. The CVSS 3.1 score is 5.3 (MEDIUM) , with a vector of ...
CVE-2026-78294
The Geo Mashup WordPress plugin (versions ≤ 1.13.21 ) is affected by a Contributor-level Cross-Site Scripting (XSS) vulnerability discovered by JunHee CHO and reported via Patchstack. A low-privileged user (Contributor) can inject scripts that execute in the context of a higher-privileged user's ...
CVE-2026-74017
WordPress User Registration plugin versions ≤ 5.2.7 contain an unauthenticated Broken Access Control vulnerability. The flaw allows a remote attacker with no prior privileges to access data they should not, resulting in a low confidentiality impact with no impact on integrity or availability. The...
CVE-2026-74005
CVE-2026-74005 is an unauthenticated Cross Site Request Forgery (CSRF) vulnerability in the WordPress PublishPress Series plugin (versions ≤ 3.1.3 ), discovered by researcher benzdeus . The flaw allows an attacker to forge requests on behalf of a user, with a CVSS 3.1 score of 5.4 (MEDIUM) — requ...
CVE-2026-74005 WordPress PublishPress Series plugin <= 3.1.3 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery CSRF in PublishPress Series = 3.1.3 versions...
CVE-2026-74002
CVE-2026-74002 is an unauthenticated Broken Access Control vulnerability in the WordPress Booking Calendar plugin , affecting versions 11.7 and earlier . The flaw was discovered by Ananda Dhakal via Patchstack and carries a CVSS 3.1 score of 5.3 (MEDIUM) , with low integrity impact and no impact ...
CVE-2026-74000
CVE-2026-74000 affects the WordPress Simple Membership plugin in versions ≤ 4.8.2 . The vulnerability is a Broken Access Control flaw discovered by Ananda Dhakal (Patchstack). The CVSS 3.1 score is 5.3 (Medium) with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N , indicating a network-exploitable...
CVE-2026-73999
The Cooked WordPress plugin (versions
CVE-2026-66676
CVE-2026-66676 is an unauthenticated Broken Access Control vulnerability in the WordPress Easy Invoice plugin, affecting versions 2.3.8 and below . The vulnerability was discovered by Rahul Yadav and allows a remote attacker to access data with low confidentiality impact (CVSS 3.1: 5.3 MEDIUM ). ...
CVE-2026-66631
CVE-2026-66631 affects the MC Woocommerce Wishlist WordPress plugin (plugin slug: smart-wishlist-for-more-convert ) in versions
CVE-2026-66630
SQL Injection vulnerability in the WordPress PublishPress Series plugin (versions ≤ 3.1.3 ), discovered by Ananda Dhakal via Patchstack . The flaw requires administrator-level privileges but changes scope, allowing an authenticated admin to inject SQL and achieve high confidentiality impact and l...
CVE-2026-66631 WordPress MC Woocommerce Wishlist plugin <= 1.9.21 - SQL Injection vulnerability
Administrator SQL Injection in MC Woocommerce Wishlist = 1.9.21 versions...
CVE-2026-66628
A SQL Injection vulnerability was identified in the shop manager functionality of the WordPress plugin WP-Lister Lite for eBay , affecting versions
CVE-2026-66626
CVE-2026-66626 is an Editor SQL Injection vulnerability in the WordPress plugin SKT Addons for Elementor (versions ≤ 4.0 ), discovered by Ananda Dhakal via Patchstack. The flaw allows an authenticated user with high privileges to inject SQL through the editor functionality. The CVSS 3.1 score is ...
CVE-2026-66625
Administrator SQL Injection in WC Vendors Marketplace = 2.7.2.1 versions...
CVE-2026-66624
WPMasterToolKit , a WordPress plugin, is affected by an Administrator-level SQL Injection in versions ≤ 2.22.0 , discovered by Ananda Dhakal (Patchstack). The vulnerability carries a CVSS 3.1 score of 7.6 (HIGH) with a vector of AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L, indicating that a privileged (a...
CVE-2026-66619
CVE-2026-66619 is an Administrator SQL Injection vulnerability in the WordPress Newsletters plugin , affecting versions 4.18 and below . The vulnerability was discovered by Ananda Dhakal via Patchstack. The CVSS 3.1 base score is 7.6 (HIGH) with a vector of AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L, in...
CVE-2026-66624 WordPress WPMasterToolKit plugin <= 2.22.0 - SQL Injection vulnerability
Administrator SQL Injection in WPMasterToolKit = 2.22.0 versions...
CVE-2026-66618
CVE-2026-66618 is an Administrator-level SQL Injection vulnerability in the WP Maps WordPress plugin, affecting versions 4.9.9 and below . The flaw was discovered by Ananda Dhakal (Patchstack) and carries a CVSS 3.1 score of 7.6 (HIGH) , with a vector of AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L , indi...