99981 matches found
WordPress WPGraphQL plugin <= 2.23.1 - Sensitive Data Exposure vulnerability
Sensitive Data Exposure vulnerability discovered by Heinrihs Skrodelis in WordPress Plugin WPGraphQL versions = 2.24.2...
CVE-2026-89271
The WP-BusinessDirectory WordPress plugin through 4.0.2 does not restrict the type or destination of files saved by an unauthenticated upload handler, allowing unauthenticated attackers to write files with arbitrary content to arbitrary locations, though not to execute code on a default server...
CVE-2026-89269
The WP Testimonials WordPress plugin through 1.4.13 does not properly escape testimonial content and reverses WordPress's HTML sanitization when rendering it, allowing users with the Author role and above to store JavaScript that executes in the session of any user viewing the testimonials,...
WordPress YouTube Showcase plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by dzaku in WordPress Plugin YouTube Showcase versions = 4.1.0...
CVE-2026-89271 WP-BusinessDirectory <= 4.0.2 - Unauthenticated Arbitrary File Write via uploadFile
The WP-BusinessDirectory WordPress plugin through 4.0.2 does not restrict the type or destination of files saved by an unauthenticated upload handler, allowing unauthenticated attackers to write files with arbitrary content to arbitrary locations, though not to execute code on a default server...
CVE-2026-89271 WP-BusinessDirectory <= 4.0.2 - Unauthenticated Arbitrary File Write via uploadFile
The WP-BusinessDirectory WordPress plugin through 4.0.2 does not restrict the type or destination of files saved by an unauthenticated upload handler, allowing unauthenticated attackers to write files with arbitrary content to arbitrary locations, though not to execute code on a default server...
VulnCheck KEV: CVE-2024-1756
The WooCommerce Customers Manager WordPress plugin before 29.8 does not have authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber, to call it and retrieve the list of customer email addresses along with their id, first name and last name...
VulnCheck KEV: CVE-2024-4180
The Events Calendar WordPress plugin before 6.4.0.1 does not properly sanitize user-submitted content when rendering some views via AJAX...
VulnCheck KEV: CVE-2026-16263
The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not properly validate a user-controlled path before using it in a file inclusion, allowing users with a Subscriber account to include and execute arbitrary existing local PHP files on...
VulnCheck KEV: CVE-2026-15381
The WP Go Maps WordPress plugin before 10.1.04 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...
VulnCheck KEV: CVE-2023-6063
The WP Fastest Cache WordPress plugin before 1.2.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...
WordPress MDTF plugin <= 1.3.9 - Arbitrary Code Execution vulnerability
Arbitrary Code Execution vulnerability discovered by Peter Tang in WordPress Plugin MDTF versions = 1.3.9...
CVE-2026-108481 WordPress Patreon WordPress plugin <= 1.10.0 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from n/a through 1.10.0...
WordPress Patreon WordPress plugin <= 1.10.0 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by mamgad in WordPress Plugin Patreon WordPress versions = 1.10.0...
WordPress Broadcast Live Video plugin <= 7.3.6 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Peter Tang in WordPress Plugin Broadcast Live Video versions = 7.3.6...
WordPress paymendo plugin <= 1.1 - Subscriber+ SQLi vulnerability
Subscriber+ SQLi vulnerability discovered by Erwan LR WPScan in WordPress Plugin paymendo versions = 1.1...
WordPress Loja Automática plugin <= 1.0.0 - Unauthenticated SQLi vulnerability
Unauthenticated SQLi vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Loja Automática versions = 1.0.0...
WordPress Site Setup Wizard plugin <= 1.5.8 - Unauthenticated SQLi vulnerability
Unauthenticated SQLi vulnerability discovered by João Ramos Maciel in WordPress Plugin Site Setup Wizard versions = 1.5.8...
CVE-2024-28000
LiteSpeed Cache Privilege Escalation PoC - CVE-2024-28000 🎤 README Translation English فارسی 📸 Screenshot 💎 Introduction This repository contains a Proof of Concept PoC for a critical privilege escalation vulnerability discovered in the LiteSpeed Cache WordPress plugin. The vulnerability,...
