273319 matches found
WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.10 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Abdullah Kareem "cyberkareem" in WordPress Plugin rtMedia for WordPress, BuddyPress and bbPress versions = 4.7.10...
WordPress AWP Classifieds plugin <= 4.4.7 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Thaer Assfour in WordPress Plugin AWP Classifieds versions = 4.4.7...
WordPress 3D Flipbook PDF Viewer & Embedder plugin <= 1.4.2 - Server Side Request Forgery (SSRF) vulnerability
Server Side Request Forgery SSRF vulnerability discovered by Nabil Irawan in WordPress Plugin 3D Flipbook PDF Viewer & Embedder versions = 1.4.2...
CVE-2026-65512
Cross-Site request forgery CSRF vulnerability in Melapress WP Activity Log and Melapress WP Activity Log Premium allows Cross Site Request Forgery. This issue affects WP Activity Log: through 5.6.4; WP Activity Log Premium: through 5.6.4...
WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.10 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Zainul Anwar Adi Putra in WordPress Plugin rtMedia for WordPress, BuddyPress and bbPress versions = 4.7.10...
CVE-2026-65475
The CVE concerns the WP Chill Modula Image Gallery WordPress plugin, specifically versions 2.14.25–2.14.30, affected by an Improper Neutralization of Input During Web Page Generation (Stored XSS). The root cause is the improper handling of user input during page generation in Modula Image Gallery...
CVE-2026-65475 WordPress Modula Image Gallery plugin 2.14.25-2.14.30 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Chill Modula Image Gallery allows Stored XSS. This issue affects Modula Image Gallery: from 2.14.25 through 2.14.30...
CVE-2026-61945
The CVE-2026-61945 entry concerns the WordPress WooCommerce Product Stock Alert plugin (versions up to 3.0.6) from MultiVendorX. Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability allows retrieval of embedded sensitive data. Affected software: Wo...
WordPress Byteflows Travel & Hotel Booking plugin <= 1.0.0 - Sensitive Data Exposure vulnerability
Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Byteflows Travel & Hotel Booking versions = 1.0.0...
WordPress Paid Member Subscriptions plugin <= 3.0.7 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Paid Member Subscriptions versions = 3.0.7...
CVE-2026-57626
The CVE-2026-57626 entry concerns a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress MailPoet plugin, affecting versions 5.30.0 through 5.33.0. Affected component: MailPoet plugin for WordPress. Root cause and exact exploit details are not provided in the connected documents, but ...
WordPress GamiPress plugin <= 7.9.7 - SQL Injection vulnerability
SQL Injection vulnerability discovered by qdtad in WordPress Plugin GamiPress versions = 7.9.7...
WordPress Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce plugin <= 2.10.22 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce versions = 2.10.22...
WordPress CoCart – Headless ecommerce plugin <= 4.8.4 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by VanTastic in WordPress Plugin CoCart – Headless ecommerce versions = 4.8.4...
WordPress Thrive Product Manager plugin <= 10.9.2 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Austin Ginder in WordPress Plugin Thrive Product Manager versions = 10.9.2...
CVE-2026-65550
Technical details for CVE-2026-65550 are not publicly provided in the supplied documents; monitor for updates on affected versions, impact, and remediation.
CVE-2026-65539
The advisory concerns CVE-2026-65539: Unauthenticated CSRF in WordPress Kwayy HTML Sitemap plugin version
CVE-2026-65540
CVE-2026-65540 affects the WordPress plugin “Popup for CF7 with Sweet Alert” (versions <= 1.6.5). The vulnerability is a reported unauthenticated Cross Site Request Forgery (CSRF) weakness in this plugin. The CVSS data indicate: AV:N, AC:L, PR:N, UI:R, S:C, C:L, I:L, A:L, base score 7.1 (HIGH)...
CVE-2026-65538
CVE-2026-65538 : WordPress Machete plugin ≤ 5.2 contains a Cross Site Scripting (XSS) vulnerability in the author context. The CVSS v3.1 base score is 5.9 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L. The provided documents do not specify the exact vulnerable component, explo...