319115 matches found
CVE-2026-84734: Improper Authentication
The Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied in the request against the visitor's own session before authenticating them, allowing unauthenticated attackers to obtain a session as the administrator account the Mindstien Quick Login WordPress...
PT-2026-110035
Name of the Vulnerable Software and Affected Versions Mindstien Quick Login versions prior to 1.1 Description Improper session validation allows unauthenticated attackers to obtain an authenticated session for the account configured in the plugin. This occurs because the plugin does not correctly...
CVE-2026-85118: Improper Privilege Management
The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capability check on some of its AJAX actions, allowing unauthenticated users to update and delete arbitrary WordPress options, which can be used to gain administrator access to the site...
CVE-2026-104684: Authorization Bypass Through User-Controlled Key
The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user is authorized to read a gallery before rendering it, allowing authors to embed and expose other users' non-public gallery metadata to unauthenticated visitors...
CVE-2026-86717: Missing Authorization
The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to delete arbitrary WordPress options, which can take the site offline and strip every user of their role...
CVE-2026-103694: Improper Privilege Management
The Mobile builder WordPress plugin through 1.4.2 does not properly restrict which user meta keys a logged-in user can update through one of its REST routes, allowing any user with a self-registered account, such as a customer, to grant themselves the administrator role...
CVE-2026-106029: Missing Authorization
The WeddingCity Lite WordPress plugin through 1.0.4 does not perform any authorisation or validity checks before deleting posts, pages and media attachments, allowing unauthenticated attackers to permanently delete arbitrary content site-wide...
CVE-2026-89283: Missing Authorization
The WP Posts Password Batch Manager WordPress plugin through 1.1 does not perform any capability or nonce check on a bulk post-password action that runs on an always-loaded admin handler, allowing unauthenticated attackers to reset or overwrite the password of every published post, disclosing...
CVE-2026-88930: Improper Neutralization of Special Elements used in an SQL Command
The Social Web Suite WordPress plugin through 4.1.12 does not require its shared secret to be set before accepting requests authorised by it, and does not sanitise and escape a parameter before using it in an SQL statement, allowing unauthenticated users to perform SQL injection attacks...
PT-2026-110046
Name of the Vulnerable Software and Affected Versions BuddyPress Instant Chat versions prior to 1.7 Description Unauthenticated users can store arbitrary web scripts that execute in the session of any member who views the affected conversation. This occurs because the plugin fails to verify if th...
PT-2026-110050
Name of the Vulnerable Software and Affected Versions Topcontent versions prior to 1.2.2 Description An issue exists where a request handler is not properly authorized and HTML sanitization is disabled before storing submitted content. This allows unauthenticated attackers to publish arbitrary...
CVE-2026-81797
Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme = 1.0.2 versions...
CVE-2026-62035
Subscriber Broken Access Control in AWS S3 for WordPress Plugin – Upcasted = 3.1.0 versions...
CVE-2026-57742 WordPress Kids Planet theme <= 2.2.14.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThemeREX Group Kids Planet allows Reflected XSS. This issue affects Kids Planet: from n/a through 2.2.14.2...
CVE-2026-107434
The WordPress MicroPayments plugin versions
CVE-2026-107434 WordPress MicroPayments plugin <= 3.2.9 - Bypass Vulnerability vulnerability
Subscriber Bypass Vulnerability in MicroPayments = 3.2.9 versions...
CVE-2026-81797 WordPress Buzz Stone | Magazine & Viral Blog WordPress Theme theme <= 1.0.2 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme = 1.0.2 versions...
EUVD-2026-96531
Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme = 1.0.2 versions...