88681 matches found
EUVD-2026-63343
Unauthenticated Cross Site Scripting XSS in GeoDirectory = 2.8.173 versions...
CVE-2026-66604
An unauthenticated reflected/stored XSS vulnerability exists in the GeoDirectory WordPress plugin (versions ≤ 2.8.173), allowing an attacker to inject malicious scripts into pages viewed by other users without authentication, enabling session hijacking or credential theft. No in-the-wild exploita...
CVE-2026-66600 WordPress Media LIbrary Assistant plugin <= 3.39 - Arbitrary File Upload vulnerability
Author Arbitrary File Upload in Media LIbrary Assistant = 3.39 versions...
CVE-2026-66600
Media Library Assistant WordPress plugin (versions ≤ 3.39) allows users with the Author role to upload arbitrary files, potentially enabling remote code execution. CVSS 9.1 (Critical) reflects network-exploitable, low-complexity attack with full confidentiality, integrity, and availability impact...
CVE-2026-66601
Subscriber-level authenticated users can inject arbitrary JavaScript into the Media Library Assistant plugin (≤3.39) admin interface, enabling session hijacking or data theft. CVSS 6.5 (MEDIUM). Update to version 3.40 or later; no in-the-wild exploitation reported. See: https://patchstack.com/dat...
EUVD-2026-63340
Unauthenticated Cross Site Scripting XSS in B2BKing Premium = 5.6.07 versions...
CVE-2026-66598 WordPress B2BKing Premium plugin <= 5.6.07 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in B2BKing Premium = 5.6.07 versions...
EUVD-2026-63339
Unauthenticated Cross Site Scripting XSS in wpDataTables = 6.5.1.4 versions...
CVE-2026-66595 WordPress WP Data Access plugin <= 5.5.80 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in WP Data Access = 5.5.80 versions...
EUVD-2026-63338
Unauthenticated Broken Access Control in WP Data Access = 5.5.80 versions...
CVE-2026-66595
The WordPress WP Data Access plugin (versions ≤ 5.5.80) has an unauthenticated broken access control flaw allowing remote, no-auth access to restricted functionality with HIGH confidentiality impact (CVSS 5.9). No patch version or exploitation details are provided; monitor Patchstack's advisory f...
CVE-2026-66593
Unauthenticated SQL Injection in Security & Malware scan by CleanTalk = 2.184 versions...
EUVD-2026-63336
Unauthenticated SQL Injection in Security & Malware scan by CleanTalk = 2.184 versions...
CVE-2026-66593 WordPress Security & Malware scan by CleanTalk plugin <= 2.184 - SQL Injection vulnerability
Unauthenticated SQL Injection in Security & Malware scan by CleanTalk = 2.184 versions...
CVE-2026-66592 WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.11 - SQL Injection vulnerability
Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress = 4.7.11 versions...
CVE-2026-66590 WordPress Tagembed plugin <= 7.4 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Tagembed = 7.4 versions...
CVE-2026-66582 WordPress TranslatePress plugin <= 3.3.2 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in TranslatePress = 3.3.2 versions...
CVE-2026-28150 WordPress Golo Framework plugin < 1.7.5 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Golo Framework 1.7.5 versions...