Exploit for CVE-2026-18315

CVE-2026-18315-PoC Proof-of-concep...

CVE-2026-28164 WordPress Easy Elementor Addons plugin <= 2.3.7 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in HashThemes Easy Elementor Addons allows Cross Site Request Forgery. This issue affects Easy Elementor Addons: from n/a through 2.3.7...

CVE-2026-28163

The New User Approve WordPress plugin (versions ≤ 3.2.8) has a broken access control vulnerability discovered by Austin Ginder. Unauthenticated remote attackers can exploit incorrectly configured access control security levels, achieving low integrity impact (CVSS 5.3 MEDIUM). No patch version or...

WordPress Easy Elementor Addons plugin <= 2.3.7 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Asim Alshaya in WordPress Plugin Easy Elementor Addons versions = 2.3.7...

WordPress New User Approve plugin <= 3.2.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Austin Ginder in WordPress Plugin New User Approve versions = 3.2.8...

CVE-2026-74011

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in revmakx InfiniteWP Client allows Blind SQL Injection. This issue affects InfiniteWP Client: from n/a through 1.13.9...

WordPress InfiniteWP Client plugin <= 1.13.9 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin InfiniteWP Client versions = 1.13.9...

CVE-2026-68564

Unauthenticated Cross Site Scripting XSS in NotificationX Pro = 3.1.4 versions...

CVE-2026-73402

Subscriber Cross Site Scripting XSS in WP BASE Booking = 6.3.2 versions...

CVE-2026-68566

Unauthenticated SQL Injection in BookingPress Appointment Booking Pro = 6.0.2 versions...

CVE-2026-66615

Unauthenticated Cross Site Scripting XSS in Podlove Podcast Publisher = 4.5.4 versions...

CVE-2026-66616

Unauthenticated Cross Site Scripting XSS in Form Maker by 10Web = 1.15.46 versions...

CVE-2026-66677

Subscriber Broken Authentication in Leyka = 3.32.3 versions...

CVE-2026-66606

Unauthenticated Cross Site Scripting XSS in SmartSMTP = 1.2.0 versions...

CVE-2026-66601

Subscriber Cross Site Scripting XSS in Media LIbrary Assistant = 3.39 versions...

CVE-2026-66597

Unauthenticated Cross Site Scripting XSS in wpDataTables = 6.5.1.4 versions...

CVE-2026-66593

Unauthenticated SQL Injection in Security & Malware scan by CleanTalk = 2.184 versions...

EUVD-2026-63318

Subscriber Arbitrary File Upload in Warehouse Cargo = 2.6.9 versions...

CVE-2026-74014

A Subscriber (low-privileged WordPress user) in the IT Residence theme

CVE-2026-74013 WordPress eShipper Commerce plugin <= 2.16.13 - SQL Injection vulnerability

Subscriber SQL Injection in eShipper Commerce = 2.16.13 versions...