88698 matches found
WordPress W3 Total Cache plugin < 2.10.5 - Unauthenticated Arbitrary Directory File Write and .htaccess Overwrite via Path Traversal in the Page Cache Key vulnerability
Unauthenticated Arbitrary Directory File Write and .htaccess Overwrite via Path Traversal in the Page Cache Key vulnerability discovered by Jakub Herman in WordPress Plugin W3 Total Cache versions 2.10.5...
WordPress TabaPay Gateway plugin <= 1.4.0 - Unauthenticated Account Takeover via Payment Callback vulnerability
Unauthenticated Account Takeover via Payment Callback vulnerability discovered by moonge in WordPress Plugin TabaPay Gateway versions = 1.4.0...
WordPress Product Shortlist plugin <= 1.0.4 - Unauthenticated SQL Injection via get_shortlisted_products vulnerability
Unauthenticated SQL Injection via getshortlistedproducts vulnerability discovered by João Ramos Maciel in WordPress Plugin Product Shortlist versions = 1.0.4...
WordPress Simple File List plugin <= 6.3.11 - Unauthenticated Stored XSS via File Description vulnerability
Unauthenticated Stored XSS via File Description vulnerability discovered by Ruwantha Harshamal in WordPress Plugin Simple File List versions = 6.3.11...
WordPress Simple File List plugin <= 6.3.11 - Unauthenticated Arbitrary File Read and Move via Path Traversal vulnerability
Unauthenticated Arbitrary File Read and Move via Path Traversal vulnerability discovered by Sanjar Tulkinov in WordPress Plugin Simple File List versions = 6.3.11...
WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Unauthenticated Stored XSS via SVG File Upload vulnerability
Unauthenticated Stored XSS via SVG File Upload vulnerability discovered by Samdup Choephel in WordPress Plugin Booking calendar, Appointment Booking System versions = 3.2.36...
CVE-2026-19435
The Duplicate Post WordPress plugin before 1.5.6 does not check the user's capabilities before returning post data, allowing users with a delegated role to read the content, metadata and passwords of posts they are not allowed to access, including other users' private and draft content...
CVE-2026-75796
The AI Engine WordPress plugin (versions 2.8.0–3.6.0) fails to verify authorization before performing privileged user management via MCP User Tools, enabling a sub-site Administrator to take over any network account, including the Network Administrator. Upgrade to version 3.6.1 or later. Exploita...
CVE-2026-16959
The Media Library Assistant WordPress plugin before 3.40 does not validate a search parameter before concatenating it into a SQL query in one of its media-library query handlers, allowing users with the Author role to perform SQL injection...
CVE-2026-14601
The Link Whisper Free WordPress plugin before 0.9.7 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with the Editor role or above to perform SQL injection attacks...
CVE-2026-16577
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not validate a client-supplied payment amount against the vendor's actual outstanding balance when recording a reverse-withdrawal payment, allowing a vendor to credit their reverse-withdrawal...
CVE-2025-15671
The Welcart e-Commerce WordPress plugin before 2.12.1 accepts a session identifier from the user-supplied uscesid parameter and never regenerates it after login, enabling unauthenticated session fixation and account takeover via a crafted link. Update to 2.12.1. Exploitation details are not provi...
CVE-2026-13736
The NewPath WildApricotPress Add-on WordPress plugin (≤1.0.0) exposes a REST API route without authentication checks, letting anonymous visitors retrieve member email addresses and phone numbers meant to be members-only. No exploit code or in-the-wild exploitation is reported; no fixed version is...
Exploit for CVE-2026-18315
CVE-2026-18315-PoC Proof-of-concep...
CVE-2026-28164 WordPress Easy Elementor Addons plugin <= 2.3.7 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in HashThemes Easy Elementor Addons allows Cross Site Request Forgery. This issue affects Easy Elementor Addons: from n/a through 2.3.7...
CVE-2026-28163
The New User Approve WordPress plugin (versions ≤ 3.2.8) has a broken access control vulnerability discovered by Austin Ginder. Unauthenticated remote attackers can exploit incorrectly configured access control security levels, achieving low integrity impact (CVSS 5.3 MEDIUM). No patch version or...
WordPress Easy Elementor Addons plugin <= 2.3.7 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by Asim Alshaya in WordPress Plugin Easy Elementor Addons versions = 2.3.7...
WordPress New User Approve plugin <= 3.2.8 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Austin Ginder in WordPress Plugin New User Approve versions = 3.2.8...
CVE-2026-74011
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in revmakx InfiniteWP Client allows Blind SQL Injection. This issue affects InfiniteWP Client: from n/a through 1.13.9...