88681 matches found
CVE-2026-73998
The WordPress WP w3all phpBB plugin (≤ 3.0.5) has a SQL injection vulnerability exploitable by authenticated subscribers with network access; no patch version or in-the-wild exploitation details are provided in the documents.
CVE-2026-73998 WordPress WP w3all phpBB plugin <= 3.0.5 - SQL Injection vulnerability
Subscriber SQL Injection in WP w3all phpBB = 3.0.5 versions...
CVE-2026-73992 WordPress Query Wrangler plugin <= 1.5.57 - Remote Code Execution (RCE) vulnerability
Subscriber Remote Code Execution RCE in Query Wrangler = 1.5.57 versions...
EUVD-2026-63311
Subscriber Remote Code Execution RCE in Query Wrangler = 1.5.57 versions...
CVE-2026-73992
The WordPress Query Wrangler plugin (versions ≤ 1.5.57) allows authenticated subscribers to execute arbitrary code remotely, yielding full server compromise (CVSS 9.9 Critical, network-exploitable with low complexity). No in-the-wild exploitation or patch version is documented in the provided sou...
CVE-2026-68566
The WordPress BookingPress Appointment Booking Pro plugin (versions ≤ 6.0.2) contains an unauthenticated SQL injection vulnerability exploitable over the network with no credentials required, scoring 9.3 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L). High confidentiality impact is possi...
EUVD-2026-63309
Unauthenticated SQL Injection in BookingPress Appointment Booking Pro = 6.0.2 versions...
CVE-2026-68566 WordPress BookingPress Appointment Booking Pro plugin <= 6.0.2 - SQL Injection vulnerability
Unauthenticated SQL Injection in BookingPress Appointment Booking Pro = 6.0.2 versions...
CVE-2026-66680 WordPress Locatoraid Store Locator plugin <= 3.9.72 - SQL Injection vulnerability
Unauthenticated SQL Injection in Locatoraid Store Locator = 3.9.72 versions...
CVE-2026-66677
Subscriber Broken Authentication in Leyka = 3.32.3 versions...
CVE-2026-66677 WordPress Leyka plugin <= 3.32.3 - Broken Authentication vulnerability
Subscriber Broken Authentication in Leyka = 3.32.3 versions...
CVE-2026-66649 WordPress Directory Pro plugin <= 2.5.8 - SQL Injection vulnerability
Unauthenticated SQL Injection in Directory Pro = 2.5.8 versions...
CVE-2026-66649
The WordPress Directory Pro plugin (versions ≤ 2.5.8) has an unauthenticated SQL injection vulnerability exploitable over the network with low complexity, scoring 9.3 critical. Patchstack advises upgrading to a patched version; no in-the-wild exploitation details are provided in the documents.
CVE-2026-66615 WordPress Podlove Podcast Publisher plugin <= 4.5.4 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Podlove Podcast Publisher = 4.5.4 versions...
CVE-2026-66616 WordPress Form Maker by 10Web plugin <= 1.15.46 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Form Maker by 10Web = 1.15.46 versions...
CVE-2026-66615
Podlove Podcast Publisher WordPress plugin versions ≤ 4.5.4 has an unauthenticated reflected/stored XSS flaw (CVSS 7.1 HIGH, network-exploitable, no auth required). No exploitation data is provided. Update to a patched version beyond 4.5.4; see the Patchstack advisory for details.
EUVD-2026-63295
Unauthenticated SQL Injection in TheGem Elementor = 5.12.3 versions...
EUVD-2026-63293
Unauthenticated Cross Site Scripting XSS in SmartSMTP = 1.2.0 versions...
CVE-2026-66606
An unauthenticated reflected/stored XSS vulnerability exists in the WordPress SmartSMTP plugin through version 1.2.0. An attacker can inject malicious scripts without authentication; a victim triggering the payload could have their session cookies stolen or admin actions hijacked. CVSS 3.1 scores...