100178 matches found
PT-2026-72877
Name of the Vulnerable Software and Affected Versions User Profile Builder versions prior to 3.16.5 Description An authentication bypass exists due to type confusion within the wppb log in user function. When a registration request is submitted using the username parameter with a length between 6...
PT-2026-71964
Name of the Vulnerable Software and Affected Versions Bit Form versions prior to 3.2.1 Description The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress contains a generic SQL Injection flaw. This occurs because the plugin fails to...
6Storage Rentals < 2.29.0 - Unauthenticated Account Takeover via 'email' Parameter
Description The 6Storage Rentals plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.28.0 This is due to the sixstoragecreatewpuser AJAX handler being registered on wpajaxnoprivsixstoragecreatewpuser without any nonce, capability, credential, or ownersh...
wp-forge
wp-forge wp-forge scans WordPress.org plugins for serious PHP...
CVE-2026-73340
Contributor Cross Site Scripting XSS in Featured Image from URL = 5.3.3 versions...
CVE-2026-66704
Unauthenticated Server Side Request Forgery SSRF in Gutenverse Companion = 2.5.1 versions...
CVE-2026-66661
Subscriber Privilege Escalation in Directories Pro = 2.0.5 versions...
CVE-2026-66658
Subscriber SQL Injection in Reviewer = 3.14.2 versions...
CVE-2026-66469
Unauthenticated Broken Access Control in Arvow AI SEO Writer = 1.5.3 versions...
CVE-2026-66478
Unauthenticated SQL Injection in Church Admin = 5.1.1 versions...
CVE-2026-66464
Unauthenticated Broken Access Control in Internal Link Optimiser = 5.2.7 versions...
CVE-2026-66449
Unauthenticated Cross Site Scripting XSS in Geo Mashup = 1.13.18 versions...
CVE-2026-66456
Subscriber Cross Site Scripting XSS in Profile Extra Fields by BestWebSoft = 1.3.4 versions...
CVE-2026-66450
Unauthenticated Local File Inclusion in Geo Mashup = 1.13.18 versions...
CVE-2026-66454
Unauthenticated Broken Access Control in WP Social Avatar = 1.5 versions...
CVE-2026-66441
Unauthenticated Broken Access Control in MultiVendorX = 5.0.10 versions...
CVE-2026-66443
Unauthenticated Sensitive Data Exposure in REST API Log = 1.7.1 versions...
CVE-2026-66444
Subscriber Sensitive Data Exposure in Payment Forms for Paystack = 4.0.5 versions...