87577 matches found
CVE-2026-13331
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'search' parameter in all versions up to, and including, 4.5.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
PT-2026-53058
Name of the Vulnerable Software and Affected Versions Quiz and Survey Master QSM – Easy Quiz and Survey Maker versions prior to 11.1.5 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attacker...
PT-2026-53046
Name of the Vulnerable Software and Affected Versions MaxButtons – Create buttons plugin for WordPress versions prior to 9.8.6 Description Reflected Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary we...
PT-2026-53057
Name of the Vulnerable Software and Affected Versions Frisbii Pay versions prior to 1.9.0 Description Authenticated users with Subscriber-level access and above can perform unauthorized modification of data. This is caused by missing capability checks in the upload csv and process batch functions...
PT-2026-53043
Name of the Vulnerable Software and Affected Versions Invoice Generator versions prior to 1.0.1 Description The Invoice Generator plugin for WordPress allows privilege escalation because it fails to perform a capability check on the pravel invoice edit account AJAX action. The handler is exposed...
PT-2026-53041
Name of the Vulnerable Software and Affected Versions CodePeople Post Map for Google Maps versions prior to 1.2.7 Description Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access and above to perform Stored Cross-Site Scripting. This is...
PT-2026-53049
Name of the Vulnerable Software and Affected Versions Surbma | Infusionsoft Shortcode versions prior to 2.0.2 Description Stored Cross-Site Scripting occurs via the 'infusionsoft-form' shortcode. The issue stems from insufficient input sanitization and output escaping within the surbma infusionso...
PT-2026-53050
Name of the Vulnerable Software and Affected Versions Masteriyo LMS – LMS Course Builder, Quizzes & Certificates versions prior to 2.2.2 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This allows...
CVE-2026-57661
Subscriber Broken Access Control in WPComplete = 2.9.5.5 versions...
CVE-2026-57628
Administrator SQL Injection in WP All Import = 4.0.1 versions...
CVE-2026-54824
Unauthenticated Sensitive Data Exposure in Ads by WPQuads = 3.0.3 versions...
CVE-2026-57661 WordPress WPComplete plugin <= 2.9.5.5 - Broken Access Control vulnerability
Subscriber Broken Access Control in WPComplete = 2.9.5.5 versions...
CVE-2026-57660
The CVE-2026-57660 entry is supported by connected documents showing an Unauthenticated Broken Access Control flaw in the WordPress Booking and Rental Manager plugin, affecting versions
CVE-2026-57657
The connected sources confirm an unauthenticated Cross Site Request Forgery (CSRF) vulnerability in the WordPress Gmail SMTP plugin, affecting versions up to 1.2.3.19. The issue is documented across CVE entries and third-party listings as CVE-2026-57657 and specifies the affected product as the W...
CVE-2026-57658
CVE-2026-57658 concerns the WordPress TemplateSpare plugin, specifically versions
CVE-2026-57655 WordPress Child theme Wizard plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery CSRF in Child Theme Wizard = 1.4 versions...
CVE-2026-57654 WordPress Affiliates Manager plugin <= 2.9.49 - Broken Access Control vulnerability
Affiliate Broken Access Control in Affiliates Manager = 2.9.49 versions...
EUVD-2026-39768
Contributor SQL Injection in WP Job Portal = 2.5.2 versions...