Lucene search
+L

269273 matches found

CVE
CVE
added 10 hours ago5 views

CVE-2026-16069

The Brizy WordPress plugin before 2.8.19 does not sanitize or escape featured-image focal-point coordinates submitted through one of its AJAX actions before storing them and later echoing them into HTML attributes in the post editor's Featured Image meta box, allowing users with the Contributor...

6.8CVSS5.8AI score
SaveExploits0References1
CVE
CVE
added 10 hours ago5 views

CVE-2026-16295

The Clearfy Cache WordPress plugin before 2.4.3 does not perform a capability check in one of its admin-page dispatch paths, allowing any authenticated user such as a Subscriber to render admin-only settings pages and disclose their contents, including administrative nonces, while the canonical...

4.3CVSS5.5AI score
SaveExploits0References1
CVE
CVE
added 10 hours ago8 views

CVE-2026-16296

The Clearfy Cache WordPress plugin before 2.4.3 does not validate the redirect target in its Cyrlitera old-URL redirect handler, passing a decoded request URI to an unsafe redirect function, which allows unauthenticated attackers to redirect visitors to an arbitrary external URL when a non-defaul...

4.7CVSS5.6AI score
SaveExploits0References1
EUVD
EUVD
added 10 hours ago7 views

EUVD-2026-52595

The Brizy WordPress plugin before 2.8.19 does not properly verify authorization on the object being modified before updating a template's type meta, validating a request parameter that is different from the one used in the write operation, allowing users with Contributor-level access and above to...

2.7CVSS5.5AI score
SaveExploits0References1
EUVD
EUVD
added 10 hours ago7 views

EUVD-2026-52594

The Brizy WordPress plugin before 2.8.19 does not sanitize or escape featured-image focal-point coordinates submitted through one of its AJAX actions before storing them and later echoing them into HTML attributes in the post editor's Featured Image meta box, allowing users with the Contributor...

6.8CVSS5.8AI score
SaveExploits0References1
EUVD
EUVD
added 10 hours ago9 views

EUVD-2026-52596

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.16.11 does not sanitise and escape some of its Podcast Episode settings, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is...

6.8CVSS5.5AI score
SaveExploits0References1
EUVD
EUVD
added 10 hours ago7 views

EUVD-2026-52598

The Clearfy Cache WordPress plugin before 2.4.3 does not validate the redirect target in its Cyrlitera old-URL redirect handler, passing a decoded request URI to an unsafe redirect function, which allows unauthenticated attackers to redirect visitors to an arbitrary external URL when a non-defaul...

4.7CVSS5.6AI score
SaveExploits0References1
Cvelist
Cvelist
added 10 hours ago6 views

CVE-2026-16295 Clearfy < 2.4.3 - Subscriber+ Sensitive Information Disclosure via Factory Page-Action Dispatcher

The Clearfy Cache WordPress plugin before 2.4.3 does not perform a capability check in one of its admin-page dispatch paths, allowing any authenticated user such as a Subscriber to render admin-only settings pages and disclose their contents, including administrative nonces, while the canonical...

SaveExploits0References1
CVE
CVE
added 10 hours ago6 views

CVE-2026-16293

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.16.11 does not sanitise and escape some of its Podcast Episode settings, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is...

6.8CVSS5.5AI score
SaveExploits0References1
Cvelist
Cvelist
added 10 hours ago8 views

CVE-2026-16546 Wired Impact Volunteer Management < 2.8.2 - Subscriber+ Arbitrary RSVP Removal via wivm_remove_rsvp

The Wired Impact Volunteer Management WordPress plugin before 2.8.2 does not have authorisation checks in one of its AJAX actions, and does not verify that the RSVP being removed belongs to the requesting user, allowing users with a role as low as Subscriber to remove arbitrary users' RSVPs from...

SaveExploits0References1
Cvelist
Cvelist
added 10 hours ago7 views

CVE-2026-16070 Brizy - Page Builder < 2.8.19 - Contributor+ Template Type Update via IDOR

The Brizy WordPress plugin before 2.8.19 does not properly verify authorization on the object being modified before updating a template's type meta, validating a request parameter that is different from the one used in the write operation, allowing users with Contributor-level access and above to...

SaveExploits0References1
Cvelist
Cvelist
added 10 hours ago7 views

CVE-2026-16069 Brizy - Page Builder < 2.8.19 - Contributor+ Stored XSS via Featured Image Focal Point

The Brizy WordPress plugin before 2.8.19 does not sanitize or escape featured-image focal-point coordinates submitted through one of its AJAX actions before storing them and later echoing them into HTML attributes in the post editor's Featured Image meta box, allowing users with the Contributor...

SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 10 hours ago2 views

CVE-2026-16546

The Wired Impact Volunteer Management WordPress plugin before 2.8.2 does not have authorisation checks in one of its AJAX actions, and does not verify that the RSVP being removed belongs to the requesting user, allowing users with a role as low as Subscriber to remove arbitrary users' RSVPs from...

5.7AI score
SaveExploits0References1
CVE
CVE
added 10 hours ago5 views

CVE-2026-16070

The Brizy WordPress plugin before 2.8.19 does not properly verify authorization on the object being modified before updating a template's type meta, validating a request parameter that is different from the one used in the write operation, allowing users with Contributor-level access and above to...

2.7CVSS5.5AI score
SaveExploits0References1
EUVD
EUVD
added 10 hours ago10 views

EUVD-2026-52599

The Wired Impact Volunteer Management WordPress plugin before 2.8.2 does not have authorisation checks in one of its AJAX actions, and does not verify that the RSVP being removed belongs to the requesting user, allowing users with a role as low as Subscriber to remove arbitrary users' RSVPs from...

4.3CVSS5.7AI score
SaveExploits0References1
CVE
CVE
added 10 hours ago6 views

CVE-2026-16068

The Brizy WordPress plugin vulnerable to stored XSS (CVE-2026-16068) affects versions before 2.8.19. Authenticated users with Author-level access or higher can modify site-global design data and, due to incomplete sanitisation, store arbitrary JavaScript that is served unsanitised on front-end pa...

5.7AI score
SaveExploits0References1
CVE
CVE
added 10 hours ago7 views

CVE-2026-16035

The CVE concerns the miniOrange 2FA WordPress plugin prior to version 6.2.7. It allows a low-privilege user to trigger OTP sends to arbitrary recipients and to bind OTP delivery to the enrolling user’s address is not enforced, enabling misuse to email one-time-passcodes to unintended recipients a...

5.6AI score
SaveExploits0References1
EUVD
EUVD
added 10 hours ago11 views

EUVD-2026-52590

The Easy Integration for Dropbox WordPress plugin before 2.2.0 does not perform authorization checks on several of its file-management AJAX actions that it also registers for unauthenticated users, allowing an unauthenticated attacker to list, download and upload arbitrary files across the...

5.6AI score
SaveExploits0References1
EUVD
EUVD
added 10 hours ago7 views

EUVD-2026-52591

The miniOrange 2FA WordPress plugin before 6.2.7 does not restrict who can trigger its second-factor configuration OTP send, nor bind the OTP recipient to the enrolling user's own address, allowing a low-privileged user to send one-time-passcode emails to arbitrary recipients and to exhaust the...

5.6AI score
SaveExploits0References1
CVE
CVE
added 10 hours ago7 views

CVE-2026-16056

The CVE concerns the Contest Gallery WordPress plugin prior to version 30.0.7, where a handler fails to enforce capability/nonce checks, allowing any authenticated user down to the Subscriber role to read the site’s entire stored OpenAI prompt history. Affected component: Contest Gallery plugin f...

5.5AI score
SaveExploits0References1
Rows per page
Query Builder