272909 matches found
HTML Email Template Designer < 3.1 - Missing Authorization on Rest Route
The WP HTML Mail WordPress plugin is vulnerable to unauthorized access which allows unauthenticated attackers to retrieve and modify theme settings due to a missing capability check on the /themesettings REST-API endpoint found in the /includes/class-template-designer.php file, in versions up to...
WordPress NotificationX <2.3.9 - SQL Injection
WordPress NotificationX plugin prior to 2.3.9 contains a SQL injection vulnerability. The plugin does not sanitize and escape the nxid parameter before using it in a SQL statement, leading to an unauthenticated blind SQL injection. An attacker can possibly obtain sensitive information, modify dat...
WordPress Email Subscribers & Newsletters <4.2.3 - Arbitrary File Retrieval
WordPress Email Subscribers & Newsletters plugin before 4.2.3 is susceptible to arbitrary file retrieval via a flaw that allows unauthenticated file download and user information disclosure. An attacker can obtain sensitive information, modify data, and/or execute unauthorized administrative...
WordPress Perfect Survey <1.5.2 - SQL Injection
Perfect Survey WordPress plugin before 1.5.2 does not validate and escape the questionid GET parameter before using it in a SQL statement in the getquestion AJAX action, allowing unauthenticated users to perform SQL injection. id: CVE-2021-24762 info: name: WordPress Perfect Survey 1.5.2 - SQL...
PT-2026-78990
Subscriber Arbitrary File Upload in Smart Cleaning = 4.8.6 versions...
PT-2026-78991
Subscriber Arbitrary File Upload in Warehouse Cargo = 2.6.9 versions...
NPM: SearXNG Basic Authentication Credentials Exposed Through MCP Logs and JSON-RPC Error Responses
NPM: SearXNG Basic Authentication Credentials Exposed Through MCP Logs and JSON-RPC Error Responses vulnerability discovered by ? in WordPress Npm mcp-searxng versions 1.12.0...
NPM: SearXNG MCP Server: Additional hardened-mode SSRF bypasses
NPM: SearXNG MCP Server: Additional hardened-mode SSRF bypasses vulnerability discovered by ? in WordPress Npm mcp-searxng versions 1.2.1...
CVE-2026-18315
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key leading to Account Takeover in all versions up to, and including, 1.2.6. This is due to the adminusercreatecus AJAX handler lacking any authentication o...
CVE-2026-18315
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key leading to Account Takeover in all versions up to, and including, 1.2.6. This is due to the adminusercreatecus AJAX handler lacking any authentication o...
CVE-2026-18315 TrueBooker <= 1.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to Account Takeover to 'truebooker_wp_user_id' Parameter
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key leading to Account Takeover in all versions up to, and including, 1.2.6. This is due to the adminusercreatecus AJAX handler lacking any authentication o...
EUVD-2026-62630
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key leading to Account Takeover in all versions up to, and including, 1.2.6. This is due to the adminusercreatecus AJAX handler lacking any authentication o...
EUVD-2026-62595
Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files. This issue affects Elementor Pro: from n/a through 4.2.1...
CVE-2026-32475
Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files. This issue affects Elementor Pro: from n/a through 4.2.1...
CVE-2026-32475 WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files. This issue affects Elementor Pro: from n/a through 4.2.1...
CVE-2026-32475 WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files. This issue affects Elementor Pro: from n/a through 4.2.1...
WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability
Arbitrary File Upload vulnerability discovered by Tin Pham aka TF1T in WordPress Plugin Elementor Pro versions = 4.2.1...
CVE-2026-73389
Unauthenticated PHP Object Injection in Kalles Addons = 1.0.6 versions...