100172 matches found
CVE-2026-32566 WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...
CVE-2026-32566
The ACPT (Pro) - Custom Post Types Plugin for WordPress is affected by an unauthenticated privilege escalation vulnerability in versions prior to 2.0.64 . This flaw allows an attacker to create a WordPress administrator account by exploiting two different routes: the REST API and the admin-ajax e...
CVE-2026-32566 WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...
EUVD-2026-66991
Unauthenticated Privilege Escalation in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...
EUVD-2026-66990
Subscriber SQL Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...
CVE-2026-32564 WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - SQL Injection vulnerability
Subscriber SQL Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...
CVE-2026-32550 WordPress Kadence Shop Kit plugin <= 3.0.6 - SQL Injection vulnerability
Subscriber SQL Injection in Kadence Shop Kit = 3.0.6 versions...
CVE-2026-32564
CVE-2026-32564 is a Subscriber-level SQL Injection in the ACPT (Pro) – Custom Post Types Plugin for WordPress (versions ≤ 2.0.63 ), discovered by VDsec. The vulnerability allows a low-privilege (Subscriber) authenticated user to inject SQL, resulting in HIGH confidentiality impact with changed sc...
CVE-2026-32550
CVE-2026-32550 is a SQL Injection vulnerability in the WordPress Kadence Shop Kit plugin , affecting versions ≤ 3.0.6 . The vulnerability requires Subscriber-level privileges (low) and can be exploited over the network with no user interaction, as indicated by the CVSS 3.1 vector (AV:N/AC:L/PR:L/...
CVE-2026-32550 WordPress Kadence Shop Kit plugin <= 3.0.6 - SQL Injection vulnerability
Subscriber SQL Injection in Kadence Shop Kit = 3.0.6 versions...
CVE-2026-32564 WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - SQL Injection vulnerability
Subscriber SQL Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...
CVE-2026-32479 WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.17 - SQL Injection vulnerability
Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro = 11.17 versions...
CVE-2026-27330 WordPress Mobile App for WooCommerce plugin <= 0.4.62 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Mobile App for WooCommerce = 0.4.62 versions...
CVE-2026-81279
The WordPress plugin Push Notification for Post and BuddyPress versions
CVE-2026-81279 WordPress Push Notification for Post and BuddyPress plugin <= 3.20 - Broken Access Control vulnerability
Subscriber Broken Access Control in Push Notification for Post and BuddyPress = 3.20 versions...
WordPress Slim SEO plugin < 4.9.11 - Contributor+ Arbitrary Post Meta Disclosure vulnerability
Contributor+ Arbitrary Post Meta Disclosure vulnerability discovered by Shivamani Vastrala in WordPress Plugin Slim SEO versions 4.9.11...
WordPress AI Engine plugin < 3.6.4 - Editor+ Sensitive Information Disclosure of API Key and Bearer Tokens vulnerability
Editor+ Sensitive Information Disclosure of API Key and Bearer Tokens vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin AI Engine versions 3.6.4...
WordPress MultiVendorX plugin < 5.0.11 - Store Owner+ Cross-Store Commission Data Disclosure via commissions REST Endpoint vulnerability
Store Owner+ Cross-Store Commission Data Disclosure via commissions REST Endpoint vulnerability discovered by ryan fabella in WordPress Plugin MultiVendorX versions 5.0.11...
WordPress User Registration & Membership plugin < 5.2.6 - Unauthenticated Account Creation While Registration Disabled vulnerability
Unauthenticated Account Creation While Registration Disabled vulnerability discovered by Nguyễn Đức Hòa in WordPress Plugin User Registration versions 5.2.6...
WordPress Create Block Theme plugin < 2.10.0 - Admin+ PHP Code Injection via Pattern Save (Multisite) vulnerability
Admin+ PHP Code Injection via Pattern Save Multisite vulnerability discovered by Pavan Saxena Rootkid in WordPress Plugin Create Block Theme versions 2.10.0...