Lucene search
+L

88759 matches found

EUVD
EUVD
added 2026/08/21 6:00 a.m.7 views

EUVD-2026-63816

The Link Whisper Free WordPress plugin before 0.9.7 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with the Editor role or above to perform SQL injection attacks...

6.8CVSS5.8AI score0.00162EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/21 6:00 a.m.14 views

CVE-2026-16577

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not validate a client-supplied payment amount against the vendor's actual outstanding balance when recording a reverse-withdrawal payment, allowing a vendor to credit their reverse-withdrawal...

2.7CVSS5.5AI score0.00132EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/21 6:00 a.m.16 views

CVE-2026-14601

The Link Whisper Free WordPress plugin before 0.9.7 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with the Editor role or above to perform SQL injection attacks...

6.8CVSS5.8AI score0.00162EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/21 6:00 a.m.12 views

CVE-2026-14601 Link Whisper < 0.9.7 - Editor+ SQL Injection via domain Parameter

The Link Whisper Free WordPress plugin before 0.9.7 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with the Editor role or above to perform SQL injection attacks...

0.00162EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/21 6:00 a.m.11 views

CVE-2026-14325 Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Admin+ Stored XSS via drag_n_drop_heading_tag Setting

The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not escape one of its settings before using it as an HTML tag name in front-end output, allowing users with administrator access to inject arbitrary web scripts that execute on any front-end page...

0.00158EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/21 6:00 a.m.18 views

CVE-2025-15671

CVE-2025-15671 affects the Welcart e-Commerce WordPress plugin prior to version 2.12.1 . The plugin does not regenerate the session identifier upon authentication and instead sets it from the user-supplied uscesid request parameter. This allows an unauthenticated attacker to fixate a shop member'...

5.4CVSS5.4AI score0.00177EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/21 6:00 a.m.9 views

EUVD-2025-210759

The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on authentication and sets the session identifier from a user-supplied request parameter, allowing an unauthenticated attacker to fixate a shop member's session and take over their customer account...

5.4CVSS5.4AI score0.00177EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/21 6:00 a.m.19 views

CVE-2026-13736

The NewPath WildApricotPress Add-on WordPress plugin (Member Directory) through 1.0.0 fails to enforce members-only field privacy on an unauthenticated REST route. This allows anonymous visitors to read member email addresses and phone numbers that are configured to be visible only to authenticat...

5.3CVSS5.3AI score0.00132EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/21 6:00 a.m.8 views

EUVD-2026-63813

The NewPath WildApricotPress Add-on WordPress plugin through 1.0.0 does not enforce its members-only field privacy on an unauthenticated REST route, allowing anonymous visitors to read member email addresses and phone numbers that are configured to be visible to members only...

5.3CVSS5.3AI score0.00132EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/21 6:00 a.m.14 views

CVE-2026-13736 NewPath WildApricotPress Add-on – Member Directory <= 1.0.0 - Unauthenticated Member PII Disclosure via REST API

The NewPath WildApricotPress Add-on WordPress plugin through 1.0.0 does not enforce its members-only field privacy on an unauthenticated REST route, allowing anonymous visitors to read member email addresses and phone numbers that are configured to be visible to members only...

0.00132EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/21 6:00 a.m.9 views

EUVD-2026-63815

The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not escape one of its settings before using it as an HTML tag name in front-end output, allowing users with administrator access to inject arbitrary web scripts that execute on any front-end page...

3.5CVSS5.7AI score0.00158EPSS
SaveExploits0References1
GithubExploit
GithubExploit
added 2026/08/20 5:33 p.m.18 views

Exploit for CVE-2026-18315

CVE-2026-18315-PoC Proof-of-concep...

9.8CVSS5.3AI score0.00443EPSS
SaveExploits1
Wordfence Blog
Wordfence Blog
added 2026/08/20 1:59 p.m.8 views

Critical Arbitrary File Upload Vulnerability Patched in Elementor Pro WordPress Plugin

On July 24th, 2026, we received a submission for an Unauthenticated Arbitrary File Upload vulnerability in Elementor Pro, a WordPress plugin with an estimated 6,000,000 active installations. This vulnerability makes it possible for unauthenticated attackers to upload arbitrary files, including...

9CVSS7.4AI score0.00416EPSS
SaveExploits0
Cvelist
Cvelist
added 2026/08/20 12:38 p.m.29 views

CVE-2026-28164 WordPress Easy Elementor Addons plugin <= 2.3.7 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in HashThemes Easy Elementor Addons allows Cross Site Request Forgery. This issue affects Easy Elementor Addons: from n/a through 2.3.7...

9.6CVSS0.00146EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/20 12:36 p.m.17 views

CVE-2026-28163

The New User Approve WordPress plugin (versions ≤ 3.2.8) has a broken access control vulnerability discovered by Austin Ginder. Unauthenticated remote attackers can exploit incorrectly configured access control security levels, achieving low integrity impact (CVSS 5.3 MEDIUM). No patch version or...

5.3CVSS5.3AI score0.00176EPSS
SaveExploits0References1
Patchstack
Patchstack
added 2026/08/20 12:36 p.m.9 views

WordPress Easy Elementor Addons plugin <= 2.3.7 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Asim Alshaya in WordPress Plugin Easy Elementor Addons versions = 2.3.7...

9.6CVSS5.3AI score0.00146EPSS
SaveExploits0Affected Software1
Patchstack
Patchstack
added 2026/08/20 12:35 p.m.9 views

WordPress New User Approve plugin <= 3.2.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Austin Ginder in WordPress Plugin New User Approve versions = 3.2.8...

5.3CVSS5.2AI score0.00176EPSS
SaveExploits0Affected Software1
CVE
CVE
added 2026/08/20 12:32 p.m.17 views

CVE-2026-74011

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in revmakx InfiniteWP Client allows Blind SQL Injection. This issue affects InfiniteWP Client: from n/a through 1.13.9...

7.6CVSS5.8AI score0.00226EPSS
SaveExploits0References1
Patchstack
Patchstack
added 2026/08/20 12:31 p.m.6 views

WordPress InfiniteWP Client plugin <= 1.13.9 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin InfiniteWP Client versions = 1.13.9...

7.6CVSS5.9AI score0.00226EPSS
SaveExploits0Affected Software1
NVD
NVD
added 2026/08/20 12:16 p.m.6 views

CVE-2026-68564

Unauthenticated Cross Site Scripting XSS in NotificationX Pro = 3.1.4 versions...

7.1CVSS0.0018EPSS
SaveExploits0References1
Rows per page
Query Builder