271857 matches found
EUVD-2026-51712
The YOP Poll WordPress plugin before 7.0.6 does not validate the connection's origin IP address and instead trusts client-controlled forwarding headers when enforcing its per-IP vote restriction, allowing unauthenticated attackers to bypass the vote limit and cast unlimited votes on a public poll...
EUVD-2026-51711
The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowing unauthenticated users to retrieve the title and full content of any post regardless of its status, including unpublished draft, pending, private, and...
CVE-2026-14840 YOP Poll < 7.0.6 - Unauthenticated Vote Restriction Bypass via IP Header Spoofing
The YOP Poll WordPress plugin before 7.0.6 does not validate the connection's origin IP address and instead trusts client-controlled forwarding headers when enforcing its per-IP vote restriction, allowing unauthenticated attackers to bypass the vote limit and cast unlimited votes on a public poll...
CVE-2026-14840
The YOP Poll WordPress plugin before 7.0.6 does not validate the connection's origin IP address and instead trusts client-controlled forwarding headers when enforcing its per-IP vote restriction, allowing unauthenticated attackers to bypass the vote limit and cast unlimited votes on a public poll...
EUVD-2026-51709
The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not perform any authorization check on one of its order-management REST endpoints, allowing unauthenticated users to change the status of existing orders...
CVE-2026-14561 Authora - Easy Login with Mobile Number < 1.7.7 - Unauthenticated Account Takeover via OTP Disclosure
The Authora : Easy login with mobile number WordPress plugin before 1.7.7 does not keep its one-time login code confidential, returning the code and a valid verification token in the response of an unauthenticated action, allowing unauthenticated attackers to log in as any user whose registered...
CVE-2026-14561
The Authora : Easy login with mobile number WordPress plugin before 1.7.7 does not keep its one-time login code confidential, returning the code and a valid verification token in the response of an unauthenticated action, allowing unauthenticated attackers to log in as any user whose registered...
CVE-2026-14822 Event Tickets < 5.29.0.1 - Unauthenticated PayPal Order Status Manipulation
The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not perform any authorization check on one of its order-management REST endpoints, allowing unauthenticated users to change the status of existing orders...
CVE-2026-14292
The Download Manager WordPress plugin before 3.3.66 does not properly escape a package's title before outputting it in the front-end package templates, allowing users with the Author role or above to store a title that results in arbitrary JavaScript execution in the browser of any user, includin...
CVE-2026-14214
The CVE concerns the Booking for Appointments and Events Calendar WordPress plugin (pre-2.4.4). The root cause is that the customer import does not restrict which fields can be written, allowing an Amelia Manager to arbitrarily modify columns in stored user records via the import request. This yi...
EUVD-2026-51706
The Download Manager WordPress plugin before 3.3.66 does not properly escape a package's title before outputting it in the front-end package templates, allowing users with the Author role or above to store a title that results in arbitrary JavaScript execution in the browser of any user, includin...
CVE-2026-14315
The Pixel Tag Manager for WooCommerce WordPress plugin is vulnerable in versions before 2.2.1 due to missing authorization on one AJAX action. This allows unauthenticated users to submit forged e-commerce conversion events to the site’s configured server‑side advertising conversion APIs using sto...
CVE-2026-14214 Amelia < 2.4.4 - Amelia Manager+ Arbitrary User-Field Modification via Mass Assignment
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.4 does not restrict which fields can be written through its customer import, allowing a user with the Amelia Manager role to modify arbitrary columns of any stored user record by supplying them in the import request...
EUVD-2026-51705
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.4 does not restrict which fields can be written through its customer import, allowing a user with the Amelia Manager role to modify arbitrary columns of any stored user record by supplying them in the import request...
CVE-2026-14292
The CVE-2026-14292 entry concerns the WordPress plugin Download Manager (before 3.3.66). The issue is a lack of proper escaping of a package title in front-end templates, enabling stored XSS via a package title by users with the Author role or higher. Impact described: arbitrary JavaScript execut...
CVE-2026-14214
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.4 does not restrict which fields can be written through its customer import, allowing a user with the Amelia Manager role to modify arbitrary columns of any stored user record by supplying them in the import request...
CVE-2026-14292 WordPress Download Manager < 3.3.66 - Author+ Stored XSS via Package Title
The Download Manager WordPress plugin before 3.3.66 does not properly escape a package's title before outputting it in the front-end package templates, allowing users with the Author role or above to store a title that results in arbitrary JavaScript execution in the browser of any user, includin...
CVE-2026-14823
CVE-2026-14823 relates to the WordPress plugin Event Tickets and Registration prior to version 5.29.0.1. The issue is an authorization flaw in seating actions (IDOR-like behavior) that allows users with contributor-level access and above to overwrite the seating layout, ticket inventory, and atte...
CVE-2026-14315
The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.1 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to submit forged e-commerce conversion events to the site's configured server-side advertising conversion APIs using the site's...
WordPress Booking for Appointments and Events Calendar plugin < 2.4.4 - Amelia Manager+ Arbitrary User-Field Modification vulnerability
Amelia Manager+ Arbitrary User-Field Modification vulnerability discovered by Manuel Martínez Casasola in WordPress Plugin Amelia versions 2.4.4...