100028 matches found
WordPress Hummingbird - Speed Optimization, Caching, Minify, Compress & CDN plugin <= 3.21.0 - Unauthenticated Remote Code Execution via Cookie Name in Page Cache Debug Log vulnerability
WordPress Hummingbird - Speed Optimization, Caching, Minify, Compress & CDN plugin = 3.21.0 - Unauthenticated Remote Code Execution via Cookie Name in Page Cache Debug Log vulnerability discovered by Kuba in WordPress Plugin Hummingbird versions = 3.21.0...
WordPress Dear Flipbook plugin <= 2.4.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via '.dvcss' Element Class Attribute vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via '.dvcss' Element Class Attribute vulnerability discovered by tipsen in WordPress Plugin DearFlip versions = 2.4.30...
WordPress Theme My Login plugin <= 7.1.15 - Authenticated (Subscriber+) Missing Authorization to Unauthorized Multisite Subsite Creation via 'gimmeanotherblog' Signup Stage vulnerability
Authenticated Subscriber+ Missing Authorization to Unauthorized Multisite Subsite Creation via 'gimmeanotherblog' Signup Stage vulnerability discovered by Maksim Hayder trjan - Iron Digital Labs LLC in WordPress Plugin Theme My Login versions = 7.1.15...
WordPress MStore API plugin <= 4.20.0 - Unauthenticated Authentication Bypass via 'id_token' Parameter JWT Forgery vulnerability
Unauthenticated Authentication Bypass via 'idtoken' Parameter JWT Forgery vulnerability discovered by t4g0 in WordPress Plugin MStore API versions = 4.20.0...
WordPress Dear Flipbook plugin <= 2.4.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via '.df-element' Element Inner HTML vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via '.df-element' Element Inner HTML vulnerability discovered by tipsen in WordPress Plugin DearFlip versions = 2.4.30...
WordPress Welcart e-Commerce plugin <= 2.12.1 - Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callback vulnerability
Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callback vulnerability discovered by daroo in WordPress Plugin Welcart e-Commerce versions = 2.12.1...
WordPress Events Manager - Calendar, Bookings, Tickets, and more! plugin <= 7.3.3 - Unauthenticated Stored Cross-Site Scripting via Event Attributes vulnerability
WordPress Events Manager - Calendar, Bookings, Tickets, and more! plugin = 7.3.3 - Unauthenticated Stored Cross-Site Scripting via Event Attributes vulnerability discovered by shark3y in WordPress Plugin Events Manager versions = 7.3.3...
NPM: CodeWhale: Project config `allow_shell` override enables arbitrary shell command execution via cloned repository
NPM: CodeWhale: Project config allowshell override enables arbitrary shell command execution via cloned repository vulnerability discovered by ? in WordPress Npm codewhale versions = 0.8.41, 0.8.64...
Exploit for CVE-2026-19632
CVE-2026-19632 — TranslatePress ≤ 3.3.1 Unauthenticated Accoun...
Exploit for CVE-2026-11613
CVE-2026-11613 — Divi Ajax Filter RCE | | | |---|---| | Plug...
CVE-2026-12483
The LearnDash LMS plugin for WordPress is vulnerable to Unrestricted File Type Upload in versions up to and including 5.1.5. This is due to insufficient input validation in the 'learndashfileuploadprocess' function, which iterates through an entire array and validates only the first file. This...
CVE-2026-12483 LearnDash LMS <= 5.1.5 - Authenticated (Subscriber+) Arbitrary File Upload via Assignment Upload Handler
The LearnDash LMS plugin for WordPress is vulnerable to Unrestricted File Type Upload in versions up to and including 5.1.5. This is due to insufficient input validation in the 'learndashfileuploadprocess' function, which iterates through an entire array and validates only the first file. This...
CVE-2026-12483
The LearnDash LMS plugin for WordPress (versions ≤ 5.1.5 ) is vulnerable to an Unrestricted File Type Upload caused by insufficient input validation in the learndash_fileupload_process function, which validates only the first file in a multi-file array. Authenticated users with subscriber-level a...
CVE-2026-12483 LearnDash LMS <= 5.1.5 - Authenticated (Subscriber+) Arbitrary File Upload via Assignment Upload Handler
The LearnDash LMS plugin for WordPress is vulnerable to Unrestricted File Type Upload in versions up to and including 5.1.5. This is due to insufficient input validation in the 'learndashfileuploadprocess' function, which iterates through an entire array and validates only the first file. This...
EUVD-2026-71098
The LearnDash LMS plugin for WordPress is vulnerable to Unrestricted File Type Upload in versions up to and including 5.1.5. This is due to insufficient input validation in the 'learndashfileuploadprocess' function, which iterates through an entire array and validates only the first file. This...
WordPress Restaurant Menu and Food Ordering plugin < 2.4.12 - Unauthenticated Payment Bypass vulnerability
Unauthenticated Payment Bypass vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Restaurant Menu by MotoPress versions 2.4.12...
CVE-2026-84045
The E-cab Taxi Booking Manager for Woocommerce WordPress plugin before 2.0.5 does not validate a client-supplied trip distance and base-price value on the server before pricing a booking, allowing unauthenticated attackers to manipulate the order total down to zero and place real taxi-booking...
CVE-2026-27347
Missing Authorization vulnerability in Crocoblock JetPopup allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects JetPopup: from n/a through 2.0.20.2...
CVE-2026-27347 WordPress JetPopup plugin <= 2.0.20.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in Crocoblock JetPopup allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects JetPopup: from n/a through 2.0.20.2...