Lucene search
+L

270620 matches found

Cvelist
Cvelist
added 2026/08/03 6:0 a.m.50 views

CVE-2026-16057 Contest Gallery < 30.0.7 - Author+ Arbitrary Post Deletion via post_cg_youtube_delete_from_library

The Contest Gallery WordPress plugin before 30.0.7 does not perform per-object capability or nonce checks in one of its post-deletion handlers, gating it only by a coarse role-membership test, which allows any Author-level or higher user to permanently delete arbitrary posts, pages, and other...

0.00232EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/03 6:0 a.m.8 views

EUVD-2026-52162

The Contest Gallery WordPress plugin before 30.0.7 does not perform per-object capability or nonce checks in one of its post-deletion handlers, gating it only by a coarse role-membership test, which allows any Author-level or higher user to permanently delete arbitrary posts, pages, and other...

5.6AI score0.00232EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/03 6:0 a.m.8 views

EUVD-2026-52163

The Classified Listing WordPress plugin before 5.4.4 does not perform a capability or ownership check on an AJAX action that returns a post's content, allowing users with contributor-level access and above to read the content of any post, page, or custom post type on the site — including drafts,...

5.3AI score0.00179EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/03 6:0 a.m.8 views

EUVD-2026-52165

The Link Library WordPress plugin before 7.9.3 does not properly sanitise and escape a user-supplied value before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...

9.1CVSS5.7AI score0.00262EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/03 6:0 a.m.35 views

CVE-2026-15254

The issue affects the Simply Schedule Appointments WordPress plugin prior to version 1.6.12.11. A missing capability check on an administrative appointment-listing shortcode, combined with per-user result scoping that fails open, allows users with the Contributor role and above to disclose all cu...

6.5CVSS5.4AI score0.00201EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/03 6:0 a.m.37 views

CVE-2026-16057

The CVE affects the Contest Gallery WordPress plugin prior to version 30.0.7. One post-deletion handler omits per-object capability checks and nonce validation, gating the action only by a coarse role-membership test. This allows any user with Author-level or higher privileges to permanently dele...

6.5CVSS5.6AI score0.00232EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/03 6:0 a.m.41 views

CVE-2026-16532

The CVE-2026-16532 affects the Link Library WordPress plugin prior to version 7.9.3. The defect stems from improper sanitisation/escaping of a user-supplied value used in a SQL query, enabling unauthenticated SQL injection via the front-end link submission form. Impact is unauthenticated access w...

9.1CVSS5.7AI score0.00262EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/03 6:0 a.m.6 views

EUVD-2026-52164

The Classified Listing WordPress plugin before 5.4.4 does not perform a capability check on an AJAX action that returns aggregated store revenue totals, allowing users with contributor-level access and above to read daily revenue figures normally restricted to administrators and report managers...

5.5AI score0.00179EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/03 6:0 a.m.46 views

CVE-2026-16276 Classified Listing < 5.4.4 - Contributor+ Store Revenue Total Disclosure via rtcl_revenue_order_search

The Classified Listing WordPress plugin before 5.4.4 does not perform a capability check on an AJAX action that returns aggregated store revenue totals, allowing users with contributor-level access and above to read daily revenue figures normally restricted to administrators and report managers...

0.00179EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/03 6:0 a.m.51 views

CVE-2026-16274 Classified Listing < 5.4.4 - Contributor+ Unpublished Post Content Disclosure via rtcl_block_css_get_posts

The Classified Listing WordPress plugin before 5.4.4 does not perform a capability or ownership check on an AJAX action that returns a post's content, allowing users with contributor-level access and above to read the content of any post, page, or custom post type on the site — including drafts,...

0.00179EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/03 6:0 a.m.34 views

CVE-2026-16276

The CVE concerns the Classified Listing WordPress plugin prior to version 5.4.4. An AJAX action (rtcl_revenue_order_search) does not perform a required capability check, allowing users with contributor-level access and above to read daily store revenue totals that are normally restricted to admin...

2.7CVSS5.5AI score0.00179EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/03 6:0 a.m.8 views

EUVD-2026-52166

The Import and export users and customers WordPress plugin before 2.4.2 does not enforce WordPress's role-assignment and per-user edit permissions during CSV import, allowing a user holding only the user-creation capability to create an administrator account and to overwrite an existing...

9.1CVSS5.5AI score0.00232EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/03 6:0 a.m.42 views

CVE-2026-16274

CVE-2026-16274 affects the Classified Listing WordPress plugin (versions before 5.4.4). A missing capability/ownership check on an AJAX action that returns a post’s content allows users with contributor-level access and above to read the content of any post, page, or custom post type, including d...

2.7CVSS5.3AI score0.00179EPSS
SaveExploits0References1
Nuclei
Nuclei
added 2026/08/03 4:1 a.m.80 views

WordPress InfiniteWP <1.9.4.5 - Authorization Bypass

WordPress InfiniteWP plugin before 1.9.4.5 for WordPress contains an authorization bypass vulnerability via a missing authorization check in iwpmmbsetrequest in init.php. An attacker who knows the username of an administrator can log in, thereby making it possible to obtain sensitive information,...

9.8CVSS7.7AI score0.88049EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/08/03 4:1 a.m.616 views

WordPress Automatic Plugin <3.92.1 - Arbitrary File Download and SSRF

WordPress Automatic plugin 3.92.1 is vulnerable to unauthenticated Arbitrary File Download and SSRF Located in the downloader.php file, could permit attackers to download any file from a site. Sensitive data, including login credentials and backup files, could fall into the wrong hands. This...

9.9CVSS8AI score0.93971EPSS
SaveExploits18References3
Nuclei
Nuclei
added 2026/08/03 3:0 a.m.174 views

WordPress wpDiscuz <=7.0.4 - Remote Code Execution

WordPress wpDiscuz plugin versions version 7.0 through 7.0.4 are susceptible to remote code execution. This flaw gave unauthenticated attackers the ability to upload arbitrary files, including PHP files, and achieve remote code execution on a vulnerable site's server. id: CVE-2020-24186 info: nam...

10CVSS8.7AI score0.94535EPSS
SaveExploits19References5
GithubExploit
GithubExploit
added 2026/08/02 5:21 p.m.29 views

Exploit for CVE-2026-13714

CVE-2026-13714 Realtyna Organic IDX plugin + WPL Real Estate &...

9.8CVSS6AI score0.00462EPSS
SaveExploits1
NVD
NVD
added 2026/08/02 9:16 a.m.12 views

CVE-2026-12231

The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ exadinfoboximage’ parameter in all versions up to, and including, 2.7.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

6.4CVSS0.00256EPSS
SaveExploits0References5
ATTACKERKB
ATTACKERKB
added 2026/08/02 8:33 a.m.14 views

CVE-2026-12231

The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ exadinfoboximage’ parameter in all versions up to, and including, 2.7.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

6.4CVSS5.7AI score0.00256EPSS
SaveExploits0References6
Cvelist
Cvelist
added 2026/08/02 8:33 a.m.37 views

CVE-2026-12231 Exclusive Addons for Elementor <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'exad_infobox_image'

The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ exadinfoboximage’ parameter in all versions up to, and including, 2.7.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

6.4CVSS0.00256EPSS
SaveExploits0References5
Rows per page
Query Builder