100231 matches found
CVE-2026-73997 WordPress Starter Templates by Kadence WP plugin <= 2.3.3 - Denial of Service Attack vulnerability
Unauthenticated Denial of Service Attack in Starter Templates by Kadence WP = 2.3.3 versions...
EUVD-2026-60811
Unauthenticated Denial of Service Attack in Starter Templates by Kadence WP = 2.3.3 versions...
CVE-2026-73996 WordPress Masteriyo - LMS plugin <= 2.3.2 - Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in ThemeGrill Masteriyo - LMS learning-management-system allows Upload a Web Shell to a Web Server.This issue affects Masteriyo - LMS: from n/a through 2.3.2...
CVE-2026-73996 WordPress Masteriyo - LMS plugin <= 2.3.2 - Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in ThemeGrill Masteriyo - LMS learning-management-system allows Upload a Web Shell to a Web Server.This issue affects Masteriyo - LMS: from n/a through 2.3.2...
CVE-2026-73995 WordPress User Registration plugin <= 5.2.6 - Broken Authentication vulnerability
Subscriber Broken Authentication in User Registration = 5.2.6 versions...
EUVD-2026-60808
Unauthenticated Broken Access Control in Charitable = 1.8.11.3 versions...
CVE-2026-73404 WordPress MasterStudy LMS plugin <= 3.7.41 - Broken Access Control vulnerability
Subscriber Broken Access Control in MasterStudy LMS = 3.7.41 versions...
CVE-2026-73400 WordPress Restaurant Menu by MotoPress plugin <= 2.4.11 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress = 2.4.11 versions...
EUVD-2026-60806
Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress = 2.4.11 versions...
CVE-2026-73400
Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress = 2.4.11 versions...
CVE-2026-73397 WordPress Youzify plugin <= 1.3.7 - Deserialization of untrusted data vulnerability
Unauthenticated Deserialization of untrusted data in Youzify = 1.3.7 versions...
CVE-2026-73396 WordPress MWB HubSpot for WooCommerce plugin <= 1.6.7 - Broken Authentication vulnerability
Subscriber Broken Authentication in MWB HubSpot for WooCommerce = 1.6.7 versions...
CVE-2026-73397
Unauthenticated Deserialization of untrusted data in Youzify = 1.3.7 versions...
CVE-2026-73395 WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Insecure Direct Object References (IDOR) vulnerability
Unauthenticated Insecure Direct Object References IDOR in Booking calendar, Appointment Booking System = 3.2.36 versions...
CVE-2026-73395 WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Insecure Direct Object References (IDOR) vulnerability
Unauthenticated Insecure Direct Object References IDOR in Booking calendar, Appointment Booking System = 3.2.36 versions...
CVE-2026-73395
The WordPress plugin Booking calendar, Appointment Booking System (versions ≤ 3.2.36) has an unauthenticated IDOR flaw, discovered by Jakub Herman, allowing remote attackers to access or modify objects without authentication. CVSS 3.1 scores 6.5 (Medium) with no in-the-wild exploitation reported....
CVE-2026-73393
The WordPress Subscribe2 plugin (versions ≤ 10.46) contains an unauthenticated reflected XSS flaw, exploitable via network without privileges; CVSS 7.1 (High). Patchstack is the CNA. No exploitation evidence or fix version is provided in the documents. Monitor for updates. Patchstack advisory: ht...
CVE-2026-73393 WordPress Subscribe2 plugin <= 10.46 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Subscribe2 = 10.46 versions...