319094 matches found
CVE-2026-103695: Improper Neutralization of Special Elements used in an SQL Command
The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks...
CVE-2026-103305: Improper Neutralization of Input During Web Page Generation
The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and CSRF checks when saving its settings, and does not escape some of them when outputting them, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators and site visitors...
CVE-2026-88905: Improper Neutralization of Input During Web Page Generation
The KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check when saving its settings, and does not escape them before output, allowing unauthenticated attackers to store malicious JavaScript that executes when an administrator opens the KeyWord Collector...
CVE-2026-84734: Improper Authentication
The Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied in the request against the visitor's own session before authenticating them, allowing unauthenticated attackers to obtain a session as the administrator account the Mindstien Quick Login WordPress...
PT-2026-110035
Name of the Vulnerable Software and Affected Versions Mindstien Quick Login versions prior to 1.1 Description Improper session validation allows unauthenticated attackers to obtain an authenticated session for the account configured in the plugin. This occurs because the plugin does not correctly...
CVE-2026-85118: Improper Privilege Management
The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capability check on some of its AJAX actions, allowing unauthenticated users to update and delete arbitrary WordPress options, which can be used to gain administrator access to the site...
CVE-2026-104684: Authorization Bypass Through User-Controlled Key
The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user is authorized to read a gallery before rendering it, allowing authors to embed and expose other users' non-public gallery metadata to unauthenticated visitors...
CVE-2026-86717: Missing Authorization
The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to delete arbitrary WordPress options, which can take the site offline and strip every user of their role...
CVE-2026-103694: Improper Privilege Management
The Mobile builder WordPress plugin through 1.4.2 does not properly restrict which user meta keys a logged-in user can update through one of its REST routes, allowing any user with a self-registered account, such as a customer, to grant themselves the administrator role...
CVE-2026-106029: Missing Authorization
The WeddingCity Lite WordPress plugin through 1.0.4 does not perform any authorisation or validity checks before deleting posts, pages and media attachments, allowing unauthenticated attackers to permanently delete arbitrary content site-wide...
CVE-2026-89283: Missing Authorization
The WP Posts Password Batch Manager WordPress plugin through 1.1 does not perform any capability or nonce check on a bulk post-password action that runs on an always-loaded admin handler, allowing unauthenticated attackers to reset or overwrite the password of every published post, disclosing...
CVE-2026-88930: Improper Neutralization of Special Elements used in an SQL Command
The Social Web Suite WordPress plugin through 4.1.12 does not require its shared secret to be set before accepting requests authorised by it, and does not sanitise and escape a parameter before using it in an SQL statement, allowing unauthenticated users to perform SQL injection attacks...
PT-2026-110043
Name of the Vulnerable Software and Affected Versions Web Vitals Tracking WordPress plugin versions prior to 5.4.3 Description Unauthenticated visitors can submit performance measurements that are stored and subsequently output within a script context on an administrative page without proper...
CVE-2026-88903: Improper Neutralization of Input During Web Page Generation
The Topcontent WordPress plugin through 1.2.1 does not properly authorise one of its request handlers and disables HTML sanitisation before storing the submitted content, allowing unauthenticated attackers to publish arbitrary posts containing malicious JavaScript on any site where its API key ha...
PT-2026-110052
Name of the Vulnerable Software and Affected Versions Social Web Suite versions prior to 4.1.13 Description The Social Web Suite WordPress plugin fails to require a shared secret before accepting authorized requests. Additionally, it does not sanitize or escape a parameter used in an SQL statemen...
CVE-2026-81797
Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme = 1.0.2 versions...
CVE-2026-62035
Subscriber Broken Access Control in AWS S3 for WordPress Plugin – Upcasted = 3.1.0 versions...
CVE-2026-57742 WordPress Kids Planet theme <= 2.2.14.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThemeREX Group Kids Planet allows Reflected XSS. This issue affects Kids Planet: from n/a through 2.2.14.2...
