91553 matches found
6Storage Rentals < 2.29.0 - Unauthenticated Account Takeover via 'email' Parameter
Description The 6Storage Rentals plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.28.0 This is due to the sixstoragecreatewpuser AJAX handler being registered on wpajaxnoprivsixstoragecreatewpuser without any nonce, capability, credential, or ownersh...
CVE-2026-73340
Contributor Cross Site Scripting XSS in Featured Image from URL = 5.3.3 versions...
CVE-2026-66704
Unauthenticated Server Side Request Forgery SSRF in Gutenverse Companion = 2.5.1 versions...
CVE-2026-66661
Subscriber Privilege Escalation in Directories Pro = 2.0.5 versions...
CVE-2026-66658
Subscriber SQL Injection in Reviewer = 3.14.2 versions...
CVE-2026-66469
Unauthenticated Broken Access Control in Arvow AI SEO Writer = 1.5.3 versions...
CVE-2026-66478
Unauthenticated SQL Injection in Church Admin = 5.1.1 versions...
CVE-2026-66464
Unauthenticated Broken Access Control in Internal Link Optimiser = 5.2.7 versions...
CVE-2026-66449
Unauthenticated Cross Site Scripting XSS in Geo Mashup = 1.13.18 versions...
CVE-2026-66456
Subscriber Cross Site Scripting XSS in Profile Extra Fields by BestWebSoft = 1.3.4 versions...
CVE-2026-66450
Unauthenticated Local File Inclusion in Geo Mashup = 1.13.18 versions...
CVE-2026-66454
Unauthenticated Broken Access Control in WP Social Avatar = 1.5 versions...
CVE-2026-66441
Unauthenticated Broken Access Control in MultiVendorX = 5.0.10 versions...
CVE-2026-66443
Unauthenticated Sensitive Data Exposure in REST API Log = 1.7.1 versions...
CVE-2026-66444
Subscriber Sensitive Data Exposure in Payment Forms for Paystack = 4.0.5 versions...
CVE-2026-65582
Subscriber Arbitrary File Download in AI Hub = 1.3.10 versions...
CVE-2026-66429
Unauthenticated Cross Site Scripting XSS in Visitor Traffic Real Time Statistics Pro = 11.10 versions...
CVE-2026-66430
Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro = 11.10 versions...