324134 matches found
CVE-2026-102007
The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field mapped to notificationcontent attacker-chosen key, e.g. payloadtext' parameter in all versions up to, and including, 2.10.6...
CVE-2026-15399 Animated Number Counters <= 3.0 - Authenticated (Editor+) SQL Injection via 'counterid' Parameter
The Animated Number Counters plugin for WordPress is vulnerable to generic SQL Injection via the 'counterid' parameter in all versions up to, and including, 3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...
CVE-2026-15399 Animated Number Counters <= 3.0 - Authenticated (Editor+) SQL Injection via 'counterid' Parameter
The Animated Number Counters plugin for WordPress is vulnerable to generic SQL Injection via the 'counterid' parameter in all versions up to, and including, 3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...
CVE-2026-102562 AcyMailing <= 11.1.0 - Unauthenticated Stored Cross-Site Scripting via 'customField[]' Parameter
The AcyMailing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customField parameter of the public frontusers::subscribe endpoint in versions up to, and including, 11.1.0. This is due to insufficient input sanitization and output escaping in the acymcleanVar sanitizer,...
CVE-2026-102562
The AcyMailing plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 11.1.0 . The root cause is insufficient input sanitization and output escaping within the acym_cleanVar() sanitizer, which only strips complete HTML tags, combined with Subscribe...
EUVD-2026-98348
The Animated Number Counters plugin for WordPress is vulnerable to generic SQL Injection via the 'counterid' parameter in all versions up to, and including, 3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...
EUVD-2026-98347
The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field mapped to notificationcontent attacker-chosen key, e.g. payloadtext' parameter in all versions up to, and including, 2.10.6...
CVE-2026-102562 AcyMailing <= 11.1.0 - Unauthenticated Stored Cross-Site Scripting via 'customField[]' Parameter
The AcyMailing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customField parameter of the public frontusers::subscribe endpoint in versions up to, and including, 11.1.0. This is due to insufficient input sanitization and output escaping in the acymcleanVar sanitizer,...
CVE-2026-15399
The Animated Number Counters plugin for WordPress is vulnerable to a second-order SQL Injection in all versions up to and including 3.0 . The flaw exists because the 'counterid' parameter is insufficiently escaped and the read path fails to use proper query preparation, even though the write path...
CVE-2026-102007 Bit integrations <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via 'notification_content' Field via Public Bit Assist Webhook Callback
The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field mapped to notificationcontent attacker-chosen key, e.g. payloadtext' parameter in all versions up to, and including, 2.10.6...
EUVD-2026-98346
The AcyMailing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customField parameter of the public frontusers::subscribe endpoint in versions up to, and including, 11.1.0. This is due to insufficient input sanitization and output escaping in the acymcleanVar sanitizer,...
CVE-2026-89097
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 2.8.18 . The vulnerability exists via the ai_wp_footer_hook and specifically involves the ai-debug-processing-fe and ai-debug-meta URL parameters. Au...
CVE-2026-89097 Ad Inserter <= 2.8.18 - Authenticated (Subscriber+) Sensitive Information Disclosure in 'ai-debug-processing-fe' & 'ai-debug-meta' URL Parameters
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.18 via the aiwpfooterhook. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract sensitive dat...
CVE-2026-89097 Ad Inserter <= 2.8.18 - Authenticated (Subscriber+) Sensitive Information Disclosure in 'ai-debug-processing-fe' & 'ai-debug-meta' URL Parameters
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.18 via the aiwpfooterhook. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract sensitive dat...
WordPress WPGraphQL plugin <= 2.23.1 - Sensitive Data Exposure vulnerability
Sensitive Data Exposure vulnerability discovered by Heinrihs Skrodelis in WordPress Plugin WPGraphQL versions = 2.24.2...
WordPress FV Simpler SEO plugin <= 1.9.7 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin FV Simpler SEO versions = 1.9.7...
WordPress Chained Quiz plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Chained Quiz versions = 1.4.1...
WordPress Post Video Players plugin <= 1.165 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Post Video Players versions = 1.165...
WordPress GEO my WordPress plugin <= 4.5.5.4 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Ayukiab in WordPress Plugin GEO my WordPress versions = 4.5.5.3...
CVE-2026-89271
The WP-BusinessDirectory WordPress plugin through 4.0.2 does not restrict the type or destination of files saved by an unauthenticated upload handler, allowing unauthenticated attackers to write files with arbitrary content to arbitrary locations, though not to execute code on a default server...