99550 matches found
EUVD-2026-85797
The 10Web Booster WordPress plugin before 2.34.0 does not restrict access to the routine which issues the shared secret that authenticates its cloud connection, disclosing that secret to unauthenticated visitors and letting them delete it repeatedly, preventing an administrator from completing a...
CVE-2026-82195 10Web Booster < 2.34.0 - Unauthenticated Connection Secret Disclosure and Deletion
The 10Web Booster WordPress plugin before 2.34.0 does not restrict access to the routine which issues the shared secret that authenticates its cloud connection, disclosing that secret to unauthenticated visitors and letting them delete it repeatedly, preventing an administrator from completing a...
EUVD-2026-85795
The CMB2 WordPress plugin before 2.13.0 does not perform any capability check on one of its AJAX actions, allowing users with a role as low as Subscriber to create arbitrary WordPress options and corrupt existing ones, which can break core site settings and take the site offline. Exploitation...
CVE-2026-80338
The CMB2 WordPress plugin before version 2.13.0 is vulnerable to a flaw where it fails to perform capability checks on one of its AJAX actions . This allows users with a role as low as Subscriber to create arbitrary WordPress options and corrupt existing ones, potentially breaking core site setti...
PT-2026-97715
Name of the Vulnerable Software and Affected Versions MasterStudy LMS WordPress Plugin versions prior to 3.7.50 Description An issue exists where the plugin fails to verify if a user is enrolled in a course before recording lesson completions. This allows any authenticated user, including those...
PT-2026-97712
Name of the Vulnerable Software and Affected Versions MasterStudy LMS WordPress Plugin versions prior to 3.7.50 Description Insufficient validation of a display-style setting allows users with the Contributor role and above to perform Local File Inclusion LFI, which is a technique used to trick a...
CVE-2026-89005: Improper Neutralization of Input During Web Page Generation
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitise and escape one of its campaign configuration fields when a certain feature is enabled, which allows users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the session ...
CVE-2026-88847: Missing Authorization
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that a user is enrolled in a course before recording lesson completions against it, allowing any authenticated user, such as a subscriber, to create course progress records for courses they have no access to...
CVE-2026-88846: Missing Authorization
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not check whether user registration is enabled on the site before creating an account through one of its front-end registration flows, allowing unauthenticated users to create accounts, and be logged into them, on sites wher...
CVE-2026-88845: Missing Authorization
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform any capability or nonce checks on an administrative maintenance action, allowing any authenticated user, such as a subscriber, to trigger it and create published content on the site attributed to their own accoun...
CVE-2026-82850: Exposure of Sensitive Information to an Unauthorized Actor
The Masteriyo LMS WordPress plugin before 3.4.2 does not restrict access to quiz answer keys, allowing any authenticated user, such as a student, to retrieve the correct answers for any quiz on the site, including quizzes in courses they are not enrolled in. The redaction that hides them is appli...
CVE-2026-80513: Deserialization of Untrusted Data
The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing authenticated users with Subscriber-level access and above to inject a PHP Object. No POP chain is present in the wpForo Forum...
CVE-2026-88843: Improper Limitation of a Pathname to a Restricted Directory
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not validate one of its display-style settings before using it to build a template path, allowing users with the Contributor role and above to include and execute arbitrary local PHP files on the server. An equivalent path w...
PT-2026-97713
Name of the Vulnerable Software and Affected Versions MasterStudy LMS WordPress Plugin versions prior to 3.7.50 Description An issue exists where the plugin fails to perform capability or nonce checks on an administrative maintenance action. A nonce is a unique token used to protect against...
PT-2026-97720
Name of the Vulnerable Software and Affected Versions Events Manager versions prior to 7.4.5 Description An issue exists in the Events Manager WordPress plugin where the scope of logged-in event and location searches is not enforced when a user provides a custom owner value. This allows a...
PT-2026-97714
Name of the Vulnerable Software and Affected Versions MasterStudy LMS WordPress Plugin versions prior to 3.7.50 Description The plugin fails to verify if user registration is enabled on the site before processing account creation through its front-end registration flows. This allows unauthenticat...
PT-2026-97706
Name of the Vulnerable Software and Affected Versions CMB2 WordPress plugin versions prior to 2.13.0 Description An issue exists where a lack of capability checks on an AJAX action allows users with Subscriber roles to create or corrupt arbitrary WordPress options. This can lead to the disruption...
WordPress YOP Poll plugin <= 7.0.10 - Unauthenticated Origin Validation Error to Administrator Account Takeover vulnerability
Unauthenticated Origin Validation Error to Administrator Account Takeover vulnerability discovered by Supakiad S. m3ez in WordPress Plugin YOP Poll versions = 7.0.10...
WordPress Category Discount Woocommerce plugin <= 5.18 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Category Discount Woocommerce versions = 5.18...