323273 matches found
PT-2026-110068
The MemberHero WordPress plugin through 6.9 does not perform any capability or nonce check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to make the site send arbitrary HTML emails to arbitrary recipients from its own mail system, which can be abused to relay...
PT-2026-110029
Name of the Vulnerable Software and Affected Versions click5 CRM add-on to Gravity Forms versions prior to 1.0.4 Description The plugin lacks authorization and Cross-Site Request Forgery CSRF checks when updating options through a REST endpoint. Additionally, it fails to verify if the option bein...
CVE-2026-85126: Improper Privilege Management
The Crowdfundly WordPress plugin through 2.2.2 does not have capability checks on some of its AJAX actions, allowing users holding one of its own low privileged roles to grant themselves the administrator role or arbitrary capabilities, leading to a full site takeover...
CVE-2026-81153: Improper Neutralization of Input During Web Page Generation
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its image settings before outputting them in a gallery page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing the...
CVE-2026-87762: Improper Neutralization of Input During Web Page Generation
The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have authorisation checks on several state-changing operations, and the secret comparison it uses instead can be bypassed on installations where the secret key has never been set, allowing unauthenticated users to store...
CVE-2026-81797
Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme = 1.0.2 versions...
CVE-2026-62035
Subscriber Broken Access Control in AWS S3 for WordPress Plugin – Upcasted = 3.1.0 versions...
CVE-2026-57742 WordPress Kids Planet theme <= 2.2.14.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThemeREX Group Kids Planet allows Reflected XSS. This issue affects Kids Planet: from n/a through 2.2.14.2...
CVE-2026-107434
The WordPress MicroPayments plugin versions
CVE-2026-107434 WordPress MicroPayments plugin <= 3.2.9 - Bypass Vulnerability vulnerability
Subscriber Bypass Vulnerability in MicroPayments = 3.2.9 versions...
CVE-2026-81797 WordPress Buzz Stone | Magazine & Viral Blog WordPress Theme theme <= 1.0.2 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme = 1.0.2 versions...
CVE-2026-81797
The Buzz Stone | Magazine & Viral Blog WordPress Theme (versions
EUVD-2026-96531
Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme = 1.0.2 versions...
CVE-2026-81797 WordPress Buzz Stone | Magazine & Viral Blog WordPress Theme theme <= 1.0.2 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme = 1.0.2 versions...
CVE-2026-78535
The Photolia WordPress theme (versions
CVE-2026-78534 WordPress Educavo theme <= 3.4.2 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Educavo = 3.4.2 versions...
CVE-2026-78534 WordPress Educavo theme <= 3.4.2 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Educavo = 3.4.2 versions...
CVE-2026-78534
The Educavo WordPress theme versions