96465 matches found
PT-2026-65694
The PayU CommercePro Plugin WordPress plugin through 3.8.9 does not verify the payment-gateway signature before applying order modifications, allowing unauthenticated attackers to tamper with the totals, shipping and metadata of arbitrary WooCommerce orders...
PT-2026-65770
The Cost Calculator Builder PRO plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.0.3 via the js to php function. This is due to insufficient sanitization of the orderDetails.originalValue field, which is injected verbatim into a calculator formul...
PT-2026-65688
The Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … plugin for WordPress is vulnerable to Authentication Bypass via a Hardcoded Backdoor in version 10.8.7. The vulnerability exists because the arve uc init function — registered on WordPress's init hook at priority 1 ...
PT-2026-65680
The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'filterMobileText' Block Attribute in all versions up to, and including, 4.4.24 due to insufficient input sanitization and output escaping. This makes it possible fo...
PT-2026-65726
The WP-Lister Lite for eBay plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.8.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...
PT-2026-65679
The Contact Form to Any API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cf7anyapi form field' Post Meta in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
WordPress MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin <= 3.7.23 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Attachment Deletion vulnerability
Insecure Direct Object Reference to Authenticated Instructor+ Arbitrary Attachment Deletion vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan in WordPress Plugin MasterStudy LMS versions = 3.7.23...
WordPress WP CTA – Call Now Button, Sticky Button & Call to Action Builder plugin 2.1.2-2.1.2 - Authenticated (Administrator+) Server-Side Request Forgery vulnerability
Authenticated Administrator+ Server-Side Request Forgery vulnerability discovered by Nguyen Quang Truong, Chu Thao Mai in WordPress Plugin WordPress CTA versions 2.1.2-2.1.2...
CVE-2026-4912
The Media Cleaner: Clean your WordPress! plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.0.3. This is due to the geturlsfromhtml function using DOMDocument::loadHTMLFile to fetch iframe source URLs with an insufficient hostname validation...
CVE-2026-15304
The Plugin Organizer plugin for WordPress is vulnerable to SQL Injection via the 'POpluginpath' parameter in versions up to, and including, 10.2.4. This is due to insufficient escaping on the user-supplied parameter in the performpluginsearch function, where escsql output is passed as the...
CVE-2026-15992
The WP Password Policy plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 3.7.1. This is due to missing authorization checks and nonce verification in the getuser function of the ModulePasswordHint class, which unconditionally calls WPUser::setrole with...
CVE-2026-4912
The Media Cleaner: Clean your WordPress! plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.0.3. This is due to the geturlsfromhtml function using DOMDocument::loadHTMLFile to fetch iframe source URLs with an insufficient hostname validation...
CVE-2026-5114 SpeedyCache <= 1.3.8 - Authenticated (Administrator+) Arbitrary File Read
The SpeedyCache plugin for WordPress is vulnerable to Arbitrary File Read via Path Traversal in all versions up to, and including, 1.3.8. This is due to a mismatch between CSS URL validation which allows query strings like .css?... and path resolution which strips query strings, combined with no...
CVE-2026-5114
The CVE-2026-5114 entry concerns the SpeedyCache WordPress plugin, affecting all versions up to 1.3.8. The root cause is a mismatch between CSS URL validation (accepts query strings like .css?...) and path resolution (strips query strings), plus no validation that the resolved file is a CSS file....
CVE-2026-4912 Media Cleaner: Clean your WordPress! <= 7.0.3 - Authenticated (Administrator+) Server-Side Request Forgery
The Media Cleaner: Clean your WordPress! plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.0.3. This is due to the geturlsfromhtml function using DOMDocument::loadHTMLFile to fetch iframe source URLs with an insufficient hostname validation...
CVE-2026-4912 Media Cleaner: Clean your WordPress! <= 7.0.3 - Authenticated (Administrator+) Server-Side Request Forgery
The Media Cleaner: Clean your WordPress! plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.0.3. This is due to the geturlsfromhtml function using DOMDocument::loadHTMLFile to fetch iframe source URLs with an insufficient hostname validation...
CVE-2026-5114
The SpeedyCache plugin for WordPress is vulnerable to Arbitrary File Read via Path Traversal in all versions up to, and including, 1.3.8. This is due to a mismatch between CSS URL validation which allows query strings like .css?... and path resolution which strips query strings, combined with no...
CVE-2026-15304 Plugin Organizer <= 10.2.4 - Authenticated (Subscriber+) SQL Injection
The Plugin Organizer plugin for WordPress is vulnerable to SQL Injection via the 'POpluginpath' parameter in versions up to, and including, 10.2.4. This is due to insufficient escaping on the user-supplied parameter in the performpluginsearch function, where escsql output is passed as the...
CVE-2026-15304 Plugin Organizer <= 10.2.4 - Authenticated (Subscriber+) SQL Injection
The Plugin Organizer plugin for WordPress is vulnerable to SQL Injection via the 'POpluginpath' parameter in versions up to, and including, 10.2.4. This is due to insufficient escaping on the user-supplied parameter in the performpluginsearch function, where escsql output is passed as the...
Wordfence PRISM Detected Backdoored WordPress Plugin within Two Hours of it Being Introduced
On July 28th, 2026, our autonomous AI vulnerability intelligence agent, Wordfence PRISM, identified a critical Authentication Bypass backdoor in Advanced Responsive Video Embedder, a WordPress plugin with approximately 20,000 active installations, less than two hours after the malicious code was...