99230 matches found
EUVD-2026-91769
The All in One SEO WordPress plugin before 5.0.2.1 does not correctly determine which shortcodes are present in content derived from user input before deciding which ones to strip, allowing unauthenticated users to execute arbitrary shortcodes registered on the site. On sites upgraded from older...
WordPress Mindio Magic MCP plugin <= 0.5.6 - Sensitive Data Exposure vulnerability
Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Mindio Magic MCP versions = 0.5.6...
WordPress WebSamurai plugin <= 1.0.7 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WebSamurai versions = 1.0.7...
WordPress Smart One Click Setup – Complete Demo Import & Export plugin <= 1.4.3 - Sensitive Data Exposure vulnerability
Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Smart One Click Setup – Complete Demo Import & Export versions = 1.4.3...
WordPress CMP – Coming Soon & Maintenance plugin < 4.1.20 - Unauthenticated Maintenance Mode Bypass vulnerability
Unauthenticated Maintenance Mode Bypass vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin CMP – Coming Soon & Maintenance versions 4.1.20...
WordPress GiveWP plugin <= 4.16.8.1 - Payment Bypass vulnerability
Payment Bypass vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin GiveWP versions = 4.16.8.1...
WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability
Privilege Escalation vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Ultimate Member versions = 2.13.1...
CVE-2026-97219
The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing any authenticated user with a self-registerable account to change the status of their own unpaid order to a paid or fulfilled state and receive the goods without paying...
CVE-2026-84740
The Events Calendar WordPress plugin before 6.17.5.1 does not validate or sanitise data submitted to an unauthenticated AJAX action before merging it into its rendering context, allowing unauthenticated users to execute arbitrary shortcodes registered on the site...
CVE-2026-90952
The WP Edit Password Protected WordPress plugin before 2.0.7 does not enforce its site-wide access restriction on the WordPress REST API, allowing unauthenticated users to read the content of published posts and pages that the site's access mode was configured to hide...
CVE-2026-90987
The Easy PayPal & Stripe Buy Now Button WordPress plugin before 2.0.6 does not derive the payment amount on the server, taking it from a client-supplied field, so an unauthenticated attacker sets an arbitrary lower price for a purchase...
CVE-2026-1661
The WP Mail Logging WordPress plugin before 1.17.0 does not properly restrict the HTML and CSS of logged emails before rendering them in its admin log screens, allowing unauthenticated users to inject styled content and links, for example through a public contact form, that can deceive an...
CVE-2026-97219
The MStore API WordPress plugin before version 4.22.1 is vulnerable to a payment bypass due to a lack of restriction on which fields of an order a customer can update. This allows any authenticated user with a self-registerable account to modify the status of their own unpaid orders to a paid or ...
EUVD-2026-91216
The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing any authenticated user with a self-registerable account to change the status of their own unpaid order to a paid or fulfilled state and receive the goods without paying...
CVE-2026-92924 Unlimited Elements For Elementor < 2.0.21 - Subscriber+ Arbitrary Shortcode Execution via get_addon_output_data
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not check that a request to render widget output comes from a user allowed to make it, allowing users with a role as low as subscriber to have arbitrary WordPress shortcodes executed on the site. Version 2.0.18 removed the...
CVE-2026-90952
The WP Edit Password Protected WordPress plugin, versions 2.0.0 through 2.0.6 , contains a vulnerability where it fails to enforce site-wide access restrictions on the WordPress REST API . This flaw allows unauthenticated users to read the content of published posts and pages that were specifical...
CVE-2026-84740
The Events Calendar WordPress plugin (versions 6.12.0 through 6.17.5 ) is vulnerable to unauthenticated arbitrary shortcode execution . The root cause is a failure to validate or sanitise data submitted via an unauthenticated AJAX action, specifically involving the 'view_data' parameter, before i...
CVE-2026-85005 Popup Maker WP 1.2.2.1 - 1.4.5 - Subscriber+ Zero-Argument PHP Callable Invocation via Missing Authorization
The Popup Maker WP WordPress plugin through 1.4.5 does not perform authorization checks on several of its actions and exposes its management page to any logged-in user, allowing users with a low-privileged role such as Subscriber to store display-targeting values that are later invoked as...
CVE-2026-79618 WP User Frontend < 4.3.12 - Subscriber+ Post Creation via Subscription-Gated Form
The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately publish posts...
EUVD-2026-91209
The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately publish posts...