89701 matches found
CVE-2026-18315
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key leading to Account Takeover in all versions up to, and including, 1.2.6. This is due to the adminusercreatecus AJAX handler lacking any authentication o...
CVE-2026-32475 WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files. This issue affects Elementor Pro: from n/a through 4.2.1...
CVE-2026-73390
Unauthenticated Privilege Escalation in Total Donations = 2.0.5 versions...
CVE-2026-73389
Unauthenticated PHP Object Injection in Kalles Addons = 1.0.6 versions...
CVE-2026-73391
Unauthenticated SQL Injection in Total Donations = 2.0.5 versions...
CVE-2026-73364
Customer PHP Object Injection in Flexible Subscriptions = 1.8.1 versions...
CVE-2026-73384
Unauthenticated Sensitive Data Exposure in Pay with Contact Form 7 = 1.0.4 versions...
CVE-2026-73184
Unauthenticated Cross Site Scripting XSS in Global Gallery = 11.1.2 versions...
CVE-2026-66596
Unauthenticated Cross Site Scripting XSS in Newsletter = 9.3.3 versions...
CVE-2026-66668
Subscriber SQL Injection in Community by PeepSo = 9.0.5.2 versions...
CVE-2026-61986
Unauthenticated Cross Site Scripting XSS in Contest Gallery = 30.0.5 versions...
EUVD-2026-62392
Unauthenticated SQL Injection in Total Donations = 2.0.5 versions...
CVE-2026-73389 WordPress Kalles Addons plugin <= 1.0.6 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Kalles Addons = 1.0.6 versions...
CVE-2026-73390 WordPress Total Donations plugin <= 2.0.5 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Total Donations = 2.0.5 versions...
EUVD-2026-62391
Unauthenticated Privilege Escalation in Total Donations = 2.0.5 versions...
EUVD-2026-62390
Unauthenticated PHP Object Injection in Kalles Addons = 1.0.6 versions...
CVE-2026-73390
The Total Donations WordPress plugin (versions ≤ 2.0.5) has an unauthenticated privilege escalation vulnerability allowing network attackers to gain elevated access without credentials. CVSS 9.8 (Critical) reflects high confidentiality, integrity, and availability impact. No root cause, patch ver...
CVE-2026-73388 WordPress Nikstore Core plugin <= 1.5 - SQL Injection vulnerability
Unauthenticated SQL Injection in Nikstore Core = 1.5 versions...
CVE-2026-73386
The WordPress plugin "Track Geolocation Of Users Using Contact Form 7" through version 3.0.2 exposes sensitive data to unauthenticated users over the network (CVSS 7.5 HIGH, C:H/I:N/A:N). No exploitation status or remediation details are provided in the documents. Monitor for plugin updates. Patc...