100231 matches found
CVE-2026-73366
Unauthenticated PHP Object Injection in Easy Google Maps = 1.13.0 versions...
CVE-2026-73366
The WordPress Easy Google Maps plugin (≤1.13.0) has an unauthenticated PHP Object Injection vulnerability, exploitable remotely without credentials, scoring CVSS 9.8 (Critical). No in-the-wild exploitation or patch details are provided in the documents.
CVE-2026-73365
Unauthenticated SQL Injection in JetAppointment = 2.5.2 versions...
CVE-2026-73362
Unauthenticated Cross Site Scripting XSS in URL Shortify = 2.5.0 versions...
CVE-2026-73362
Affected product: WordPress URL Shortify plugin (versions ≤ 2.5.0). Vulnerability: Unauthenticated Cross-Site Scripting (XSS) — no privileges required. CVSS 3.1 base score 7.1 (HIGH), vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. Exploitation status: not provided. Remediation: upgrade to a patched ...
CVE-2026-73361 WordPress Recipe Card Blocks for Gutenberg & Elementor plugin <= 3.4.18 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Recipe Card Blocks for Gutenberg & Elementor = 3.4.18 versions...
CVE-2026-73361
Unauthenticated reflected/stored XSS affects Recipe Card Blocks for Gutenberg & Elementor WordPress plugin through version 3.4.18; CVSS 7.1 HIGH (network, no auth, user interaction required). No exploitation details provided; update to a newer plugin version when available.
CVE-2026-73360 WordPress Chaty Pro plugin <= 3.5.8 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Chaty Pro = 3.5.8 versions...
CVE-2026-73359 WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.3.9 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting XSS in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent = 4.3.9 versions...
CVE-2026-73359 WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.3.9 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting XSS in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent = 4.3.9 versions...
CVE-2026-73359
The WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin (versions ≤4.3.9) has a Subscriber-level stored XSS vulnerability; a low-privilege authenticated user can inject scripts that execute in other users' browsers, rated MEDIUM (CVSS 6.5). No patch version or exploitation evidence is provi...
EUVD-2026-60783
Subscriber Cross Site Scripting XSS in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent = 4.3.9 versions...
CVE-2026-73358
The Affiliates Manager WordPress plugin (≤2.9.53) is vulnerable to unauthenticated reflected/stored XSS due to insufficient input sanitization, allowing attackers to inject malicious scripts via network-accessible endpoints. CVSS 3.1 scores 7.1 (HIGH) with no privileges required. Exploitation det...
CVE-2026-73358 WordPress Affiliates Manager plugin <= 2.9.53 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Affiliates Manager = 2.9.53 versions...
CVE-2026-73358
Unauthenticated Cross Site Scripting XSS in Affiliates Manager = 2.9.53 versions...
CVE-2026-73356
Unauthenticated Arbitrary Content Deletion in Breeze = 2.5.12 versions...
CVE-2026-73356
The Breeze WordPress plugin (versions
CVE-2026-73355 WordPress Affiliates Manager plugin <= 2.9.53 - SQL Injection vulnerability
Unauthenticated SQL Injection in Affiliates Manager = 2.9.53 versions...
CVE-2026-73355
Unauthenticated SQL injection affects Affiliates Manager plugin ≤2.9.53, allowing remote attackers to extract sensitive database data (CVSS 9.3 critical). Patchstack reports the flaw; no patch version or exploit details are provided in the documents. Upgrade to the latest plugin version once avai...