323292 matches found
CVE-2026-85126: Improper Privilege Management
The Crowdfundly WordPress plugin through 2.2.2 does not have capability checks on some of its AJAX actions, allowing users holding one of its own low privileged roles to grant themselves the administrator role or arbitrary capabilities, leading to a full site takeover...
CVE-2026-89283: Missing Authorization
The WP Posts Password Batch Manager WordPress plugin through 1.1 does not perform any capability or nonce check on a bulk post-password action that runs on an always-loaded admin handler, allowing unauthenticated attackers to reset or overwrite the password of every published post, disclosing...
PT-2026-110022
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape image alt text before outputting it in one of its gallery layouts, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected...
CVE-2026-81154: Improper Neutralization of Input During Web Page Generation
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape image alt text before outputting it in one of its gallery layouts, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected...
CVE-2026-81797
Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme = 1.0.2 versions...
CVE-2026-62035
Subscriber Broken Access Control in AWS S3 for WordPress Plugin – Upcasted = 3.1.0 versions...
CVE-2026-57742 WordPress Kids Planet theme <= 2.2.14.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThemeREX Group Kids Planet allows Reflected XSS. This issue affects Kids Planet: from n/a through 2.2.14.2...
CVE-2026-107434
The WordPress MicroPayments plugin versions
CVE-2026-107434 WordPress MicroPayments plugin <= 3.2.9 - Bypass Vulnerability vulnerability
Subscriber Bypass Vulnerability in MicroPayments = 3.2.9 versions...
CVE-2026-81797 WordPress Buzz Stone | Magazine & Viral Blog WordPress Theme theme <= 1.0.2 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme = 1.0.2 versions...
CVE-2026-81797
The Buzz Stone | Magazine & Viral Blog WordPress Theme (versions
EUVD-2026-96531
Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme = 1.0.2 versions...
CVE-2026-81797 WordPress Buzz Stone | Magazine & Viral Blog WordPress Theme theme <= 1.0.2 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme = 1.0.2 versions...
CVE-2026-78535
The Photolia WordPress theme (versions
CVE-2026-78534 WordPress Educavo theme <= 3.4.2 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Educavo = 3.4.2 versions...
CVE-2026-78534 WordPress Educavo theme <= 3.4.2 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Educavo = 3.4.2 versions...
CVE-2026-78534
The Educavo WordPress theme versions
CVE-2026-78532 WordPress LMS theme <= 8.3 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in LMS = 8.3 versions...