100164 matches found
PT-2026-84100
The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom id' shortcode attribute of the dslc modules section and dslc modules area shortcodes in versions up to, and including, 2.1.19. This is due to insufficient input...
PT-2026-84123
The WP Fastest Cache WordPress plugin before 1.5.1 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered under their own request context stored under, and served...
PT-2026-84134
The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dslc module projects output Shortcode in all versions up to, and including, 2.1.19 due to insufficient input sanitization and output escaping. This makes it possible for...
PT-2026-84110
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'date' Shortcode Attribute in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping...
PT-2026-84116
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping. This...
PT-2026-84099
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tag' Shortcode Attribute in all versions up to, and including, 3.29.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
PT-2026-84107
The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.2.17. This is due to the plugin not properly verifying that a user is authorized to perform an...
PT-2026-84133
The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dslc module testimonials output Shortcode in all versions up to, and including, 2.1.19 due to insufficient input sanitization and output escaping. This makes it possible for...
PT-2026-84112
The LearnPress plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the export order csv AJAX action in versions up to, and including, 4.4.4. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...
PT-2026-84106
Name of the Vulnerable Software and Affected Versions Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System versions prior to 1.4.53 Description An authentication bypass exists that allows for administrator account takeover. The issue resides in the guest ticket...
miniOrange 5.4.3 - Unauthenticated Auth Bypass
Exploit Title: miniOrange 5.4.3 - Unauthenticated Auth Bypass Google Dork: inurl:/wp-content/plugins/miniorange-saml-20-single-sign-on/ Date: 2026-07-27 Exploit Author: zer0dayf Vendor Homepage: https://plugins.wordpress.org/miniorange-saml-20-single-sign-on/ Software Link:...
VulnCheck KEV: CVE-2026-9055
The Booking for Appointments and Events Calendar – Amelia Premium plugin for WordPress is vulnerable to Privilege Escalation in versions 8.0 - 9.6.2. This is due to insufficient validation of the attacker-controlled 'type' parameter in the customer update endpoint, which allows customers to set...
PT-2026-84124
The MW WP Form WordPress plugin before 5.1.5 does not prevent shortcodes in user-submitted values from being executed when it merges those values into a message that it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site. Exploitation require...
PT-2026-84104
The Affiliate Super Assistent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘doCommentShortcode’ function in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
VulnCheck KEV: CVE-2024-0250
The Analytics Insights for Google Analytics 4 AIWP WordPress plugin before 6.3 is vulnerable to Open Redirect due to insufficient validation on the redirect oauth2callback.php file. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can...
PT-2026-84075
Name of the Vulnerable Software and Affected Versions WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode versions prior to 4.4.2 Description An arbitrary file upload issue exists due to missing file type validation in the saas upload logo function combin...
PT-2026-84148
The Simple Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in versions up to, and including, 4.8.0. This is due to improper identity verification during the public registration flow in WordPress Multisite environments, where the...
Malicious code in addthis-wordpress-plugin (npm)
Source: ossf-package-analysis 6d8ae72ce3501b8463193222bf9bebe2913ee52bf39fb10c8c9aa2f2049ebaa5 The OpenSSF Package Analysis project identified 'addthis-wordpress-plugin' @ 2.0.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with maliciou...
