322383 matches found
Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE
A maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack. The critical vulnerability in question is CVE-2026-85097 CVSS score: 10.0, which allows unauthenticated attackers to upload and execute arbitrar...
WordPress JetMenu plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin JetMenu versions = 3.0.5...
WordPress Flexible Subscriptions plugin <= 1.8.4 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ivan in WordPress Plugin Flexible Subscriptions versions = 1.8.4...
WordPress WP User Manager plugin <= 2.9.22 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Atia Avela in WordPress Plugin WP User Manager versions = 2.9.22...
WordPress Edge Decor theme <= 2.9 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by johska in WordPress Theme Edge Decor versions = 2.9...
WordPress EmojiNation theme <= 1.0.12 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by johska in WordPress Theme EmojiNation versions = 1.0.12...
WordPress Gamezone theme <= 1.1.11 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by johska in WordPress Theme Gamezone versions = 1.1.11...
CVE-2026-108168 WordPress Custom Query Blocks plugin <= 5.6.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in DLX Plugins Custom Query Blocks post-type-archive-mapping allows Stored XSS.This issue affects Custom Query Blocks: from n/a through 5.6.0...
WordPress Avventure theme <= 1.1.12 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by johska in WordPress Theme Avventure versions = 1.1.12...
WordPress Bonbon theme <= 1.11 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by johska in WordPress Theme Bonbon versions = 1.11...
WordPress Custom Query Blocks plugin <= 5.6.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by V1T in WordPress Plugin Custom Query Blocks versions = 5.6.0...
WordPress Coinpress theme <= 1.0.15 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by johska in WordPress Theme Coinpress versions = 1.0.15...
CVE-2023-25996 WordPress Booster Elite for WooCommerce plugin < 8.4.0 - Authenticated Arbitrary WordPress Option Disclosure vulnerability
Insertion of Sensitive Information Into Sent Data vulnerability in Pluggabl LLC. Booster Elite for WooCommerce booster-elite-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Booster Elite for WooCommerce: from n/a before 8.4.0...
CVE-2023-25996
The Booster Elite for WooCommerce plugin by Pluggabl LLC is vulnerable to an Authenticated Arbitrary WordPress Option Disclosure vulnerability in versions prior to 8.4.0 . This issue allows an authenticated user to retrieve embedded sensitive data from the WordPress options table. The root cause ...
CVE-2023-25996 WordPress Booster Elite for WooCommerce plugin < 8.4.0 - Authenticated Arbitrary WordPress Option Disclosure vulnerability
Insertion of Sensitive Information Into Sent Data vulnerability in Pluggabl LLC. Booster Elite for WooCommerce booster-elite-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Booster Elite for WooCommerce: from n/a before 8.4.0...
WordPress Booster Elite for WooCommerce plugin < 8.4.0 - Authenticated Arbitrary WordPress Option Disclosure vulnerability
Authenticated Arbitrary WordPress Option Disclosure vulnerability discovered by Dave Jong Patchstack in WordPress Plugin Booster Elite for WooCommerce versions 8.4.0...
CVE-2026-107432
The WordPress Event post plugin (versions
CVE-2026-107432 WordPress Event post plugin <= 6.1.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in NOUS Ouvert Utile et Simple Event post event-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event post: from n/a through 6.1.1...
CVE-2026-107432 WordPress Event post plugin <= 6.1.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in NOUS Ouvert Utile et Simple Event post event-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event post: from n/a through 6.1.1...