99981 matches found
PT-2026-114318
The Tickera WordPress plugin before 3.6.0.4 does not correctly verify the integrity of incoming payment notifications, and the validated signature does not cover the order or the amount, allowing unauthenticated attackers to forge a payment confirmation and mark arbitrary orders as paid without...
PT-2026-113783
The WPCode WordPress plugin before 2.4.0 does not correctly verify that a request is genuinely for the login screen before entering its snippet safe mode, allowing unauthenticated visitors to disable all of the site's automatically inserted snippets for their own requests...
PT-2026-113690
The Tainacan WordPress plugin before 1.4.0 does not restrict its reports REST endpoints to users with a management capability, allowing any authenticated subscriber to read the email addresses of the repository's staff...
CVE-2026-101301: Improper Access Control
The WPCode WordPress plugin before 2.4.0 does not correctly verify that a request is genuinely for the login screen before entering its snippet safe mode, allowing unauthenticated visitors to disable all of the site's automatically inserted snippets for their own requests...
CVE-2026-91076: Missing Authorization
The Robokassa payment gateway for Woocommerce WordPress plugin before 1.9.0 does not verify the authenticity of an incoming payment-notification request before acting on the order named in it, allowing unauthenticated attackers to force any WooCommerce order into a failed state. Order identifiers...
CVE-2026-82844: Insufficient Verification of Data Authenticity
The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was completed before accepting a submission on forms using its PayPal Commerce gateway, allowing unauthenticated visitors to submit paid forms without paying. The form's confirmation is delivered and its...
CVE-2026-108069: Insufficient Verification of Data Authenticity
The Sunshine Photo Cart WordPress plugin before 3.7.4 does not check whether a visitor is permitted to access a restricted gallery before accepting comment submissions for its images, while it does perform that check when displaying comments, allowing unauthenticated attackers to inject...
CVE-2026-96904: Exposure of Sensitive Information to an Unauthorized Actor
The AWP Classifieds WordPress plugin before 4.4.9 does not verify that a request is authorised to view a listing when a payment transaction is referenced, allowing unauthenticated attackers to bypass the ownership check on the ad submission page and read the private contact email stored on any...
CVE-2026-107158: Missing Authorization
The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or validation on one of its REST routes that writes to the database, allowing unauthenticated users to modify some of the LTL Freight Quotes WordPress plugin before 4.2.19's stored settings...
CVE-2026-87968: Improper Access Control
The Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin before 5.3.2 does not perform a nonce or capability check on the AJAX action that registers the store with its feed service and exposes it to unauthenticated users, so any visito...
PT-2026-113684
The Trust Payments Gateway for WooCommerce WordPress plugin before 3.1.0 does not verify the authenticity of the payment provider's response when a customer returns from the hosted payment page, nor bind that response to the targeted order or check the amount, allowing unauthenticated attackers t...
WordPress Mang Board plugin <= 2.4.3 - Authenticated (Custom+) Stored Cross-Site Scripting vulnerability
Authenticated Custom+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Mang Board WP versions = 2.4.3...
WordPress Cryptocurrency Donation Box – Bitcoin & Crypto Donations plugin <= 2.2.13 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Spy0x7 in WordPress Plugin Cryptocurrency Donation Box – Bitcoin & Crypto Donations versions = 2.2.13...
WordPress BP Profile Search plugin <= 5.9 - Unauthenticated Local File Inclusion to Remote Code Execution vulnerability
Unauthenticated Local File Inclusion to Remote Code Execution vulnerability discovered by snr in WordPress Plugin BP Profile Search versions = 5.9...
WordPress Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin <= 2.10.6 - Unauthenticated Privilege Escalation vulnerability
Unauthenticated Privilege Escalation vulnerability discovered by crow in WordPress Plugin Bit Integrations versions = 2.10.6...
WordPress Broken Link Checker plugin <= 2.4.14.1 - Content Injection vulnerability
Content Injection vulnerability discovered by changsheng in WordPress Plugin Broken Link Checker versions = 2.4.14.1...
WordPress Amelia plugin <= 2.4.10 - SQL Injection vulnerability
SQL Injection vulnerability discovered by AndrewN in WordPress Plugin Amelia versions = 2.4.10...
WordPress MLS On The Fly plugin <= 1.8.1.5 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Rafie Muhammad in WordPress Plugin MLS On The Fly versions = 1.8.1.5...
WordPress Prime Slider – Addons For Elementor plugin <= 4.7.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin Prime Slider – Addons For Elementor versions = 4.7.1...