100147 matches found
WordPress The Events Calendar plugin <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution vulnerability
Unauthenticated PHP Object Injection to Remote Code Execution vulnerability discovered by Chloe Chamberland, Wordfence Argus in WordPress Plugin The Events Calendar versions = 6.17.4...
WordPress The Events Calendar plugin <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution vulnerability
Unauthenticated Code Injection to Remote Code Execution vulnerability discovered by Chloe Chamberland, Wordfence Argus in WordPress Plugin The Events Calendar versions = 6.17.3...
WordPress GEO my WP plugin <= 4.5.5.3 - Unauthenticated Local File Inclusion vulnerability
Unauthenticated Local File Inclusion vulnerability discovered by yck in WordPress Plugin GEO my WordPress versions = 4.5.5.3...
WordPress MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO plugin <= 4.2.1 - Unauthenticated SQL Injection vulnerability
Unauthenticated SQL Injection vulnerability discovered by Nhien Pham nhienit nhienit, thevietronin in WordPress Plugin MPG versions = 4.2.1...
CVE-2026-62140
Unauthenticated Insecure Direct Object References IDOR in Quiz And Survey Master = 11.2.5 versions...
CVE-2026-62113
Contributor Insecure Direct Object References IDOR in Slim SEO = 4.10.0 versions...
CVE-2026-62111
Contributor Cross Site Scripting XSS in Simple Payment = 2.5.4 versions...
WordPress Tutor LMS – eLearning and online course solution plugin <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution vulnerability
Authenticated Subscriber+ PHP Object Injection to Remote Code Execution vulnerability discovered by Chloe Chamberland, Wordfence Argus in WordPress Plugin Tutor LMS versions = 4.0.7...
WordPress bbPress plugin <= 2.6.14 - Sensitive Data Exposure vulnerability
Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin bbPress versions = 2.6.14...
Exploit for CVE-2026-14962
CVE-2026-14962 Wordpress Plugin ELEX WooCommerce Request a Quo...
CVE-2026-62088
The ElasticPress WordPress plugin (by 10up), versions through 5.3.4 , is affected by a Sensitive Data Exposure vulnerability classified as Insertion of Sensitive Information Into Sent Data. An unauthenticated remote attacker can retrieve embedded sensitive data, with a CVSS v3.1 score of 5.3 (Med...
CVE-2026-62088 WordPress ElasticPress plugin <= 5.3.4 - Sensitive Data Exposure vulnerability
Insertion of Sensitive Information Into Sent Data vulnerability in 10up ElasticPress allows Retrieve Embedded Sensitive Data. This issue affects ElasticPress: from n/a through 5.3.4...
CVE-2026-62089
CVE-2026-62089 is a Missing Authorization (Broken Access Control) vulnerability in the WordPress plugin Master Addons for Elementor by Pixar Labs, affecting versions from n/a through 3.2.2 . The flaw allows Privilege Abuse , enabling a low-privilege authenticated user to exploit the missing autho...
WordPress Master Addons for Elementor plugin <= 3.2.2 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by TurboNexic in WordPress Plugin Master Addons for Elementor versions = 3.2.2...
CVE-2026-62139 WordPress Site Kit by Google plugin <= 1.186.0 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery CSRF in Site Kit by Google = 1.186.0 versions...
CVE-2026-62138
A Contributor-level Cross Site Scripting (XSS) vulnerability affects the Visual Composer Website Builder WordPress plugin in versions ≤ 45.16.1 . The flaw, discovered by sungbyeongchan, allows an attacker with Contributor privileges to inject malicious scripts via user interaction. The CVSS 3.1 s...
CVE-2026-62137
An unauthenticated Sensitive Data Exposure vulnerability affects the WordPress bbPress plugin in versions 2.6.14 and earlier , as discovered by Ananda Dhakal via Patchstack . The flaw allows a remote attacker with no prior access to expose sensitive data, carrying a CVSS 3.1 score of 5.3 (Medium)...
CVE-2026-62138 WordPress Visual Composer Website Builder plugin <= 45.16.1 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in Visual Composer Website Builder = 45.16.1 versions...
CVE-2026-62134
An Insecure Direct Object References (IDOR) vulnerability was identified in the WordPress Starter Templates plugin (versions ≤ 4.7.5 ). The flaw allows a contributor-level authenticated user to manipulate objects they should not have access to, resulting in a low integrity impact (CVSS 4.3, MEDIU...