90627 matches found
CVE-2026-66591 WordPress Media LIbrary Assistant plugin <= 3.39 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in David Lingren Media LIbrary Assistant allows Stored XSS. This issue affects Media LIbrary Assistant: from n/a through 3.39...
CVE-2026-66591
A Stored Cross-Site Scripting (XSS) vulnerability exists in the WordPress plugin Media Library Assistant by David Lingren, affecting versions up to and including 3.39 . The flaw stems from improper neutralization of input during web page generation , allowing malicious scripts to be permanently s...
CVE-2026-66602
A CSRF vulnerability (CVSS 8.8, HIGH) affects the HashBar – WordPress Notification Bar plugin through version 2.0.0, discovered by Brian Willows. An attacker can force an authenticated admin to perform unintended actions (e.g., changing settings) via a crafted link. Exploitation evidence includes...
WordPress HashBar – WordPress Notification Bar plugin <= 2.0.0 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by Brian Willows in WordPress Plugin HashBar – WordPress Notification Bar versions = 2.0.0...
CVE-2026-66603 WordPress Draft List plugin <= 2.6.4 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in David Artiss Draft List simple-draft-list allows Stored XSS. This issue affects Draft List: from n/a through 2.6.4...
WordPress WPC Admin Columns plugin < 2.3.4 - Subscriber+ Arbitrary User/Post/Term Meta Disclosure vulnerability
Subscriber+ Arbitrary User/Post/Term Meta Disclosure vulnerability discovered by Farid Narimanov in WordPress Plugin WPC Admin Columns versions 2.3.4...
WordPress WP Photo Album Plus plugin < 9.2.07.002 - Reflected XSS via lbstart vulnerability
Reflected XSS via lbstart vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin WP Photo Album Plus versions 9.2.07.002...
CVE-2026-19500
CVE-2026-19500 affects the Entries component of the Brainstorm Force SureForms WordPress plugin (versions below 2.12.3 ). The root cause is the absence of adequate limits on user-controlled form fields and submitted content during processing and rendering. A remote, unauthenticated attacker can s...
CVE-2026-74007
Unauthenticated Sensitive Data Exposure in 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery = 1.16.20 versions...
CVE-2026-74008
Unauthenticated Sensitive Data Exposure in Shortcodes and extra features for Phlox theme = 2.17.22 versions...
CVE-2026-73997
Unauthenticated Denial of Service Attack in Starter Templates by Kadence WP = 2.3.3 versions...
CVE-2026-73397
Unauthenticated Deserialization of untrusted data in Youzify = 1.3.7 versions...
CVE-2026-73393
Unauthenticated Cross Site Scripting XSS in Subscribe2 = 10.46 versions...
CVE-2026-73380
Unauthenticated PHP Object Injection in Popup by Supsystic = 1.13.0 versions...
CVE-2026-73381
Unauthenticated Broken Authentication in Popup by Supsystic = 1.13.0 versions...
CVE-2026-73358
Unauthenticated Cross Site Scripting XSS in Affiliates Manager = 2.9.53 versions...
CVE-2026-73366
Unauthenticated PHP Object Injection in Easy Google Maps = 1.13.0 versions...
CVE-2026-73350
Unauthenticated Broken Authentication in SupportCandy = 3.5.1 versions...