100035 matches found
CVE-2026-75860: Improper Privilege Management
The JSON Options WordPress plugin through 0.0.4 does not have any capability check or nonce verification on one of its actions, which runs on every request and is available to unauthenticated users, allowing them to update arbitrary WordPress options. This can be leveraged to enable user...
PT-2026-79516
Name of the Vulnerable Software and Affected Versions WP Social Media Login versions prior to 1.0.7 Description The WP Social Media Login WordPress plugin fails to verify if a social login process was successfully completed with the identity provider before authenticating a visitor. This allows...
PT-2026-78980
Name of the Vulnerable Software and Affected Versions Abandoned Cart Pro for WooCommerce versions prior to 10.4.1 Description An issue allows unauthenticated users to perform privilege escalation. Recommendations Update Abandoned Cart Pro for WooCommerce to version 10.4.1 or later...
NPM: SearXNG Basic Authentication Credentials Exposed Through MCP Logs and JSON-RPC Error Responses
NPM: SearXNG Basic Authentication Credentials Exposed Through MCP Logs and JSON-RPC Error Responses vulnerability discovered by ? in WordPress Npm mcp-searxng versions 1.12.0...
CVE-2026-18315
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key leading to Account Takeover in all versions up to, and including, 1.2.6. This is due to the adminusercreatecus AJAX handler lacking any authentication o...
CVE-2026-32475 WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files. This issue affects Elementor Pro: from n/a through 4.2.1...
WordPress GenesisExpo Core plugin <= 1.3.9 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by Bonds in WordPress Plugin GenesisExpo Core versions = 1.3.9...
CVE-2026-73391
Unauthenticated SQL Injection in Total Donations = 2.0.5 versions...
CVE-2026-73389
Unauthenticated PHP Object Injection in Kalles Addons = 1.0.6 versions...
CVE-2026-73390
Unauthenticated Privilege Escalation in Total Donations = 2.0.5 versions...
CVE-2026-73364
Customer PHP Object Injection in Flexible Subscriptions = 1.8.1 versions...
CVE-2026-73384
Unauthenticated Sensitive Data Exposure in Pay with Contact Form 7 = 1.0.4 versions...
CVE-2026-73184
Unauthenticated Cross Site Scripting XSS in Global Gallery = 11.1.2 versions...
CVE-2026-66596
Unauthenticated Cross Site Scripting XSS in Newsletter = 9.3.3 versions...
CVE-2026-66668
Subscriber SQL Injection in Community by PeepSo = 9.0.5.2 versions...
CVE-2026-61986
Unauthenticated Cross Site Scripting XSS in Contest Gallery = 30.0.5 versions...
EUVD-2026-62392
Unauthenticated SQL Injection in Total Donations = 2.0.5 versions...
EUVD-2026-62391
Unauthenticated Privilege Escalation in Total Donations = 2.0.5 versions...