Lucene search
+L

88803 matches found

Vulnrichment
Vulnrichment
added 2026/08/19 6:00 a.m.7 views

CVE-2026-13169 Eventin < 4.1.21 - Contributor+ Arbitrary Event Modification, Deletion and Ownership Takeover via IDOR

The Eventin WordPress plugin before 4.1.21 does not properly verify ownership of events before allowing them to be modified, deleted, or reassigned to a different author, allowing users with contributor-level access and above to alter, delete, or take over events created by other users including...

5.3AI score0.00248EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/19 6:00 a.m.8 views

EUVD-2026-62257

The Dinatur WordPress plugin through 1.18 does not sanitize and escape user input before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks. The same handler also performs a database table truncation without any authorization check, allowing any unauthenticat...

8.6CVSS5.8AI score0.00324EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/19 6:00 a.m.9 views

EUVD-2026-62259

The Eventin WordPress plugin before 4.1.21 does not verify the current user's permission to edit other users before assigning roles and updating user metadata during speaker creation, allowing users with contributor-level access and above to modify other users' roles and metadata...

2.7CVSS5.3AI score0.00205EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/19 6:00 a.m.12 views

EUVD-2026-62256

The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access as low as Subscriber to read arbitrary files on the server — including...

8.5CVSS5.6AI score0.00235EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/19 6:00 a.m.15 views

CVE-2026-11565

The Advanced File Manager WordPress plugin before 5.4.13 lacks capability checks in several file management AJAX actions, specifically via the fma_load_fma_ui handler. Any user with file-manager access (as low as Subscriber ) can read arbitrary files on the server—including sensitive configuratio...

8.5CVSS5.6AI score0.00235EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/19 6:00 a.m.29 views

CVE-2026-11565 Advanced File Manager < 5.4.13 - Authenticated Arbitrary File Read and Write via fma_load_fma_ui

The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access as low as Subscriber to read arbitrary files on the server — including...

0.00235EPSS
SaveExploits0References1
NVD
NVD
added 2026/08/19 5:17 a.m.8 views

CVE-2026-19942

The Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the AVCFAbilitiesMedia::register replace-media-file executecallback function in all versions ...

8.1CVSS0.00687EPSS
SaveExploits0References8
NVD
NVD
added 2026/08/19 2:16 a.m.12 views

CVE-2026-15421

The Speed Optimizer – The All-In-One Performance-Boosting Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Image Tag Attributes in all versions up to, and including, 7.8.0 due to insufficient input sanitization and output escaping. This makes it possible for...

6.4CVSS0.00299EPSS
SaveExploits0References9
Cvelist
Cvelist
added 2026/08/19 1:26 a.m.45 views

CVE-2026-15421 Speed Optimizer <= 7.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Tag Attributes

The Speed Optimizer – The All-In-One Performance-Boosting Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Image Tag Attributes in all versions up to, and including, 7.8.0 due to insufficient input sanitization and output escaping. This makes it possible for...

6.4CVSS0.00299EPSS
SaveExploits0References9
CVE
CVE
added 2026/08/19 1:26 a.m.24 views

CVE-2026-15421

The Speed Optimizer – The All-In-One Performance-Boosting Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Image Tag Attributes in all versions up to, and including, 7.8.0 due to insufficient input sanitization and output escaping. This makes it possible for...

6.4CVSS5.5AI score0.00299EPSS
SaveExploits0References9
EUVD
EUVD
added 2026/08/19 12:31 a.m.9 views

EUVD-2026-62211

Missing Authorization vulnerability in Kings Plugins B2BKing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects B2BKing: from n/a through 5.2.30...

5.4CVSS5.2AI score0.00138EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/08/19 12:31 a.m.10 views

EUVD-2025-210740

The PPWP: Password Protect Pages, Posts & Full or Partial Content plugin for WordPress is vulnerable to unauthorized access of data due to a improper capability check on the canaccess function in all versions up to, and including, 1.9.15. This makes it possible for authenticated attackers, with...

4.3CVSS5.4AI score0.00209EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/08/19 12:31 a.m.12 views

EUVD-2026-62210

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in David Lingren Media LIbrary Assistant allows Stored XSS. This issue affects Media LIbrary Assistant: from n/a through 3.39...

6.5CVSS5.2AI score0.00161EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/08/19 12:31 a.m.8 views

EUVD-2026-62208

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in David Artiss Draft List simple-draft-list allows Stored XSS. This issue affects Draft List: from n/a through 2.6.4...

6.5CVSS5.2AI score0.00161EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/08/19 12:00 a.m.7 views

PT-2026-78533

Name of the Vulnerable Software and Affected Versions Elementor Pro versions prior to 4.2.2 Description An unrestricted file upload flaw allows unauthenticated attackers to bypass the file-extension blocklist and upload malicious PHP files. This occurs when a published Form widget contains a File...

9CVSS6.4AI score0.00416EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/08/19 12:00 a.m.9 views

PT-2026-78267

The Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the AVCF Abilities Media::register replace-media-file execute callback function in all versio...

8.1CVSS6.5AI score0.00687EPSS
SaveExploits0References10
Positive Technologies
Positive Technologies
added 2026/08/19 12:00 a.m.6 views

PT-2026-78335

Unauthenticated Cross Site Scripting XSS in Global Gallery = 11.1.2 versions...

7.1CVSS5.1AI score0.00146EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/08/18 11:25 p.m.29 views

CVE-2025-11729 PPWP: Password Protect Pages, Posts & Full or Partial Content <= 1.9.15 - Improper Authorization To Authenticated (Contributor+) Master Password Exposure

The PPWP: Password Protect Pages, Posts & Full or Partial Content plugin for WordPress is vulnerable to unauthorized access of data due to a improper capability check on the canaccess function in all versions up to, and including, 1.9.15. This makes it possible for authenticated attackers, with...

4.3CVSS0.00209EPSS
SaveExploits0References2
NVD
NVD
added 2026/08/18 11:17 p.m.6 views

CVE-2026-66589

Missing Authorization vulnerability in Kings Plugins B2BKing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects B2BKing: from n/a through 5.2.30...

5.4CVSS0.00138EPSS
SaveExploits0References1
NVD
NVD
added 2026/08/18 11:17 p.m.5 views

CVE-2026-66591

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in David Lingren Media LIbrary Assistant allows Stored XSS. This issue affects Media LIbrary Assistant: from n/a through 3.39...

6.5CVSS0.00161EPSS
SaveExploits0References1
Rows per page
Query Builder