270511 matches found
EUVD-2026-52580
The Simple Google Calendar Outlook Events Widget WordPress plugin before 3.1.0 does not validate a user-supplied URL before performing a server-side request, allowing unauthenticated attackers to perform Server-Side Request Forgery attacks and, in some cases, read the response of the internal...
CVE-2026-16618 ImproveSEO <= 2.0.11 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution
The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking only the file content type while writing the file with the attacker-supplied extension into a publicly accessible directory, allowing unauthenticated users to upload executable PHP files and achiev...
CVE-2026-16536
The Simple Google Calendar Outlook Events Widget WordPress plugin before 3.1.0 is affected by an unauthenticated Server-Side Request Forgery (SSRF) due to not validating a user-supplied URL before performing a server-side request (via the calendar_id flow). Root cause: absence of URL validation i...
CVE-2026-16623
The CVE concerns the Create Block WordPress plugin (before 2.10.0). It fails to properly escape user input when writing to a generated PHP pattern file, enabling a multisite subsite administrator—who has the gating capability for this action but lacks the PHP file editing capability—to inject and...
CVE-2026-16623 Create Block Theme < 2.10.0 - Admin+ PHP Code Injection via Pattern Save (Multisite)
The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text before writing it into a generated PHP pattern file, allowing a multisite subsite administrator who holds the capability gating this action but is denied the capability that normally gates PHP file editin...
EUVD-2026-52578
The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking only the file content type while writing the file with the attacker-supplied extension into a publicly accessible directory, allowing unauthenticated users to upload executable PHP files and achiev...
EUVD-2026-52579
The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text before writing it into a generated PHP pattern file, allowing a multisite subsite administrator who holds the capability gating this action but is denied the capability that normally gates PHP file editin...
CVE-2026-16618
The CVE concerns the WordPress plugin Improve SEO (version up to 2.0.11). The vulnerability arises from improper validation of uploaded files: the plugin checks only the file content type while saving the file with an attacker-supplied extension into a publicly accessible directory. This allows u...
NPM: Sequelize: SQL Injection (Oracle DB)
NPM: Sequelize: SQL Injection Oracle DB vulnerability discovered by ? in WordPress Npm sequelize versions 6.37.4...
NPM: ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass
NPM: ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass vulnerability discovered by ? in WordPress Npm ip-address versions = 10.3.0...
NPM: undici vulnerable to downstream response desynchronization via retry interceptor
NPM: undici vulnerable to downstream response desynchronization via retry interceptor vulnerability discovered by ? in WordPress Npm undici versions 6.28.0...
NPM: Socket.IO: Zero-attachment Memory Exhaustion
NPM: Socket.IO: Zero-attachment Memory Exhaustion vulnerability discovered by ? in WordPress Npm socket.io-parser versions 3.3.6...
NPM: PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset
NPM: PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when from is unset vulnerability discovered by ? in WordPress Npm postcss versions = 8.5.22...
WordPress EmbedPress plugin <= 4.5.6 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin EmbedPress versions = 4.5.6...
WordPress JetEngine plugin <= 3.8.13.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin JetEngine versions = 3.8.13.1...
WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.14 - Arbitrary File Download vulnerability
Arbitrary File Download vulnerability discovered by TurboNexic in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions = 2.0.14...
WordPress NextGEN Gallery plugin <= 4.2.3 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin NextGEN Gallery versions = 4.2.3...
WordPress Forminator plugin <= 1.56.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Forminator versions = 1.56.0...
