100231 matches found
CVE-2026-66600 WordPress Media LIbrary Assistant plugin <= 3.39 - Arbitrary File Upload vulnerability
Author Arbitrary File Upload in Media LIbrary Assistant = 3.39 versions...
CVE-2026-66600
Media Library Assistant WordPress plugin (versions ≤ 3.39) allows users with the Author role to upload arbitrary files, potentially enabling remote code execution. CVSS 9.1 (Critical) reflects network-exploitable, low-complexity attack with full confidentiality, integrity, and availability impact...
CVE-2026-66601
Subscriber-level authenticated users can inject arbitrary JavaScript into the Media Library Assistant plugin (≤3.39) admin interface, enabling session hijacking or data theft. CVSS 6.5 (MEDIUM). Update to version 3.40 or later; no in-the-wild exploitation reported. See: https://patchstack.com/dat...
CVE-2026-66598 WordPress B2BKing Premium plugin <= 5.6.07 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in B2BKing Premium = 5.6.07 versions...
EUVD-2026-63340
Unauthenticated Cross Site Scripting XSS in B2BKing Premium = 5.6.07 versions...
EUVD-2026-63339
Unauthenticated Cross Site Scripting XSS in wpDataTables = 6.5.1.4 versions...
CVE-2026-66595 WordPress WP Data Access plugin <= 5.5.80 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in WP Data Access = 5.5.80 versions...
EUVD-2026-63338
Unauthenticated Broken Access Control in WP Data Access = 5.5.80 versions...
CVE-2026-66595 WordPress WP Data Access plugin <= 5.5.80 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in WP Data Access = 5.5.80 versions...
CVE-2026-66595
The WordPress WP Data Access plugin (versions ≤ 5.5.80) has an unauthenticated broken access control flaw allowing remote, no-auth access to restricted functionality with HIGH confidentiality impact (CVSS 5.9). No patch version or exploitation details are provided; monitor Patchstack's advisory f...
CVE-2026-66593
CVE-2026-66593 is an unauthenticated SQL injection vulnerability in the WordPress plugin Security & Malware scan by CleanTalk , affecting versions ≤ 2.184 . The flaw allows a remote attacker to execute arbitrary SQL queries without authentication, leading to high confidentiality impact and low av...
EUVD-2026-63336
Unauthenticated SQL Injection in Security & Malware scan by CleanTalk = 2.184 versions...
CVE-2026-66593 WordPress Security & Malware scan by CleanTalk plugin <= 2.184 - SQL Injection vulnerability
Unauthenticated SQL Injection in Security & Malware scan by CleanTalk = 2.184 versions...
CVE-2026-66593 WordPress Security & Malware scan by CleanTalk plugin <= 2.184 - SQL Injection vulnerability
Unauthenticated SQL Injection in Security & Malware scan by CleanTalk = 2.184 versions...
CVE-2026-66592 WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.11 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress buddypress-media allows Blind SQL Injection.This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through 4.7.11...
CVE-2026-66590 WordPress Tagembed plugin <= 7.4 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Tagembed = 7.4 versions...
CVE-2026-66582 WordPress TranslatePress plugin <= 3.3.2 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in TranslatePress = 3.3.2 versions...
CVE-2026-66582 WordPress TranslatePress plugin <= 3.3.2 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in TranslatePress = 3.3.2 versions...