270269 matches found
CVE-2026-15979
The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to Arbitrary File Deletion via Path Traversal in versions up to and including 11.3.0. This is due to insufficient validation of the 'imgfile' field within the ceggdata post metadata: the value passe...
WordPress Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin <= 1.9.0 - Broken Authentication vulnerability
Broken Authentication vulnerability discovered by Jakub Herman in WordPress Plugin Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder versions = 1.9.0...
CVE-2026-15979
The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to Arbitrary File Deletion via Path Traversal in versions up to and including 11.3.0. This is due to insufficient validation of the 'imgfile' field within the ceggdata post metadata: the value passe...
EUVD-2026-53341
The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to Arbitrary File Deletion via Path Traversal in versions up to and including 11.3.0. This is due to insufficient validation of the 'imgfile' field within the ceggdata post metadata: the value passe...
CVE-2026-15979 Content Egg <= 11.3.0 - Authenticated (Author+) Arbitrary File Deletion
The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to Arbitrary File Deletion via Path Traversal in versions up to and including 11.3.0. This is due to insufficient validation of the 'imgfile' field within the ceggdata post metadata: the value passe...
EUVD-2026-53340
The wiseCampaign – WooCommerce Conversions Made Easy plugin for WordPress is vulnerable to unauthorized modification and disclosure of data due to every one of its REST API endpoints being registered with permissioncallback = 'returntrue' in all versions up to, and including, 1.1.16. This makes i...
CVE-2026-17506
CVE-2026-17506 affects the Independent Analytics plugin for WordPress up to version 2.15.0. The vulnerability is a Stored XSS in the 404 not_found_url tracking parameter caused by get_cell_content() applying urldecode() after esc_url() when rendering the URL column for 404 entries, allowing perce...
CVE-2026-17506 Independent Analytics <= 2.15.0 - Unauthenticated Stored Cross-Site Scripting
The Independent Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 404 notfoundurl tracking parameter in versions up to, and including, 2.15.0. This is due to the getcellcontent function applying urldecode after escurl when rendering the URL column for 404 entries...
EUVD-2026-53339
The Independent Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 404 notfoundurl tracking parameter in versions up to, and including, 2.15.0. This is due to the getcellcontent function applying urldecode after escurl when rendering the URL column for 404 entries...
CVE-2026-17506
The Independent Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 404 notfoundurl tracking parameter in versions up to, and including, 2.15.0. This is due to the getcellcontent function applying urldecode after escurl when rendering the URL column for 404 entries...
CVE-2026-7456 Udimi Tools <= 3.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Configuration Reset via 'disconnect' AJAX Action
The Udimi Tools plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxdisconnect function in all versions up to, and including, 3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete...
EUVD-2026-53338
The Udimi Tools plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxdisconnect function in all versions up to, and including, 3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete...
CVE-2026-7456
The Udimi Tools plugin for WordPress (versions
WordPress Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin <= 6.11.3 - Reflected Cross-Site Scripting vulnerability
Reflected Cross-Site Scripting vulnerability discovered by Tarcísio Luchesi De Almeida Silva Poystick in WordPress Plugin Instagram Feed versions = 6.11.3...
WordPress Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin <=5.0.2-<=5.0.2 - Missing Authorization to Authenticated (Vendor+) Privilege Escalation vulnerability
Missing Authorization to Authenticated Vendor+ Privilege Escalation vulnerability discovered by kai63001 in WordPress Plugin Dokan versions =5.0.2-=5.0.2...
WordPress VikRentItems Flexible Rental Management System plugin <= 1.2.1 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by nthng in WordPress Plugin VikRentItems Flexible Rental Management System versions = 1.2.1...
Exploit for Interpretation Conflict in Wordpress
wp2shell-PoC ⚠ This tool is created solely for educationa...
WordPress Layouts for WPBakery plugin <= 1.1.3 - Missing Authorization to Unauthenticated Template Cache Manipulation vulnerability
Missing Authorization to Unauthenticated Template Cache Manipulation vulnerability discovered by murd0ck, Patricio Briones CyberDoomer in WordPress Plugin Layouts for WPBakery versions = 1.1.3...
CVE-2026-18933
The wp-downloadmanager WordPress plugin, in version 1.68.11 also affecting the 6.9.4 release line, allows an admin-privileged user currentusercan'managedownloads' to upload arbitrary files via download-add.php with no extension or MIME-type validation of any kind - no wpcheckfiletypeandext, no...
EUVD-2026-53330
The wp-downloadmanager WordPress plugin, in version 1.68.11 also affecting the 6.9.4 release line, allows an admin-privileged user currentusercan'managedownloads' to upload arbitrary files via download-add.php with no extension or MIME-type validation of any kind - no wpcheckfiletypeandext, no...