100239 matches found
CVE-2026-3835 Prevent Direct Access – Protect WordPress Files <= 2.8.8.8 - Unauthenticated Protected File Access
The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token validation in the getadvancefilebyurl method in all versions up to, and including, 2.8.8.8 The method uses a SQL LIKE operator for token looku...
EUVD-2026-57720
The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token validation in the getadvancefilebyurl method in all versions up to, and including, 2.8.8.8 The method uses a SQL LIKE operator for token looku...
CVE-2026-3835
The CVE covers the WordPress plugin Prevent Direct Access – Protect WordPress Files. All versions up to 2.8.8.8 are affected due to insufficient token validation in get_advance_file_by_url(), which uses a SQL LIKE without escaping wildcards via $wpdb->esc_like(). This allows unauthenticated us...
CVE-2026-3835 Prevent Direct Access – Protect WordPress Files <= 2.8.8.8 - Unauthenticated Protected File Access
The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token validation in the getadvancefilebyurl method in all versions up to, and including, 2.8.8.8 The method uses a SQL LIKE operator for token looku...
PT-2026-71519
Name of the Vulnerable Software and Affected Versions Service Finder Booking versions prior to 6.3 Description The Service Finder Bookings plugin for WordPress allows authenticated users with Subscriber-level access or higher to elevate their privileges to the administrator level. Recommendations...
PT-2026-71522
Name of the Vulnerable Software and Affected Versions Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce versions prior to 4.1.20 Description An unauthorized access issue exists due to a missing capability check in a function. This allows authenticated attackers with...
PT-2026-71563
Subscriber Cross Site Scripting XSS in Profile Extra Fields by BestWebSoft = 1.3.4 versions...
PT-2026-71561
Unauthenticated Broken Access Control in WP Social Avatar = 1.5 versions...
PT-2026-71565
Unauthenticated Broken Access Control in AI for SEO = 2.4.2 versions...
PT-2026-71587
Customer Cross Site Scripting XSS in WpBookingly = 1.3.2 versions...
PT-2026-71525
Name of the Vulnerable Software and Affected Versions Booking Activities versions prior to 1.18.5 Description The Booking Activities plugin for WordPress allows unauthenticated attackers to perform PHP Object Injection through the deserialization of untrusted input. PHP Object Injection occurs wh...
PT-2026-72166
Name of the Vulnerable Software and Affected Versions ECS WordPress plugin versions prior to 4.3.8 Description Insufficient capability and ownership checks in dynamic repeater actions allow users with contributor-level accounts or higher to read, modify, and delete the binding configuration of...
PT-2026-71555
Unauthenticated Sensitive Data Exposure in REST API Log = 1.7.1 versions...
PT-2026-71401
The Link Factory WordPress plugin is a backdoor. Distributed as a "homepage sentence publisher", it exposes an operator-controlled REST API under /wp-json/link-factory/v1/ - authenticated by a detached Ed25519 signature verified against a hardcoded operator public key except for the health check...
PT-2026-71512
Name of the Vulnerable Software and Affected Versions Headless Single Sign On versions prior to 1.7 Description An unauthenticated bypass issue exists that allows users to circumvent the authentication process. Recommendations Update to a version newer than 1.6...
PT-2026-71392
Name of the Vulnerable Software and Affected Versions Booking for Appointments and Events Calendar versions prior to 2.4.6 Description An Insecure Direct Object Reference IDOR exists where the plugin fails to verify if an authenticated employee provider is assigned to the appointment being...
PT-2026-71398
Name of the Vulnerable Software and Affected Versions PPWP – Password Protect Pages versions prior to 1.9.22 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping on user supplied attributes within the ppwp shortcode. This allows authenticated...
PT-2026-71532
Name of the Vulnerable Software and Affected Versions Hydra Booking versions prior to 1.2.3 Description The Hydra Booking plugin for WordPress contains a broken access control issue. A missing capability check in a function allows unauthenticated attackers to perform unauthorized actions...
PT-2026-71557
Subscriber SQL Injection in If-So Dynamic Content Personalization = 1.10 versions...
PT-2026-71389
Name of the Vulnerable Software and Affected Versions Food Menu versions prior to 6.0.2 Description An issue exists where the plugin fails to perform capability or ownership checks on the reservation-status update action. This action is exposed to unauthenticated users and is protected only by a...