Lucene search
+L

272982 matches found

Cvelist
Cvelist
added 2026/08/19 6:00 a.m.31 views

CVE-2026-12983 Dinatur <= 1.18 - Unauthenticated SQL Injection via Column Name Injection

The Dinatur WordPress plugin through 1.18 does not sanitize and escape user input before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks. The same handler also performs a database table truncation without any authorization check, allowing any unauthenticat...

0.00324EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/19 6:00 a.m.11 views

EUVD-2026-62258

The Eventin WordPress plugin before 4.1.21 does not properly verify ownership of events before allowing them to be modified, deleted, or reassigned to a different author, allowing users with contributor-level access and above to alter, delete, or take over events created by other users including...

8.1CVSS5.3AI score0.00248EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/19 6:00 a.m.11 views

CVE-2026-13175

The Eventin WordPress plugin before 4.1.21 suffers from an IDOR flaw: schedule records are modified or deleted without ownership checks, allowing contributor-level users to alter or remove other users' entries. CVSS 6.5 (MEDIUM) rates this as network-exploitable with high privileges required. No ...

6.5CVSS5.3AI score0.00287EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/19 6:00 a.m.32 views

CVE-2026-13174 Eventin < 4.1.21 - Contributor+ Speaker Account Deletion via IDOR

The Eventin WordPress plugin before 4.1.21 does not verify ownership or capability before deleting user accounts, allowing users with contributor-level access and above to permanently delete other users' accounts...

0.00316EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/19 6:00 a.m.18 views

CVE-2026-12983

The Dinatur WordPress plugin (≤1.18) has an unauthenticated SQL injection via unsanitized column-name input in a SQL query, enabling data exfiltration (CVSS 8.6 HIGH). The same handler also truncates database tables without authorization, allowing any visitor to wipe plugin data. No patch version...

8.6CVSS5.8AI score0.00324EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/08/19 6:00 a.m.7 views

CVE-2026-12983 Dinatur <= 1.18 - Unauthenticated SQL Injection via Column Name Injection

The Dinatur WordPress plugin through 1.18 does not sanitize and escape user input before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks. The same handler also performs a database table truncation without any authorization check, allowing any unauthenticat...

5.7AI score0.00324EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/19 6:00 a.m.13 views

CVE-2026-13169

The Eventin WordPress plugin before 4.1.21 suffers from an IDOR flaw: contributor-level users can modify, delete, or reassign events created by others, including administrators, due to missing ownership verification. This grants unauthorized integrity and confidentiality control over event data. ...

8.1CVSS5.3AI score0.00248EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/19 6:00 a.m.12 views

EUVD-2026-62261

The Eventin WordPress plugin before 4.1.21 does not verify ownership before allowing schedule records to be modified or deleted, allowing users with contributor-level access and above to alter or delete schedule entries created by other users...

6.5CVSS5.3AI score0.00287EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/19 6:00 a.m.29 views

CVE-2026-13169 Eventin < 4.1.21 - Contributor+ Arbitrary Event Modification, Deletion and Ownership Takeover via IDOR

The Eventin WordPress plugin before 4.1.21 does not properly verify ownership of events before allowing them to be modified, deleted, or reassigned to a different author, allowing users with contributor-level access and above to alter, delete, or take over events created by other users including...

0.00248EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/08/19 6:00 a.m.7 views

CVE-2026-13169 Eventin < 4.1.21 - Contributor+ Arbitrary Event Modification, Deletion and Ownership Takeover via IDOR

The Eventin WordPress plugin before 4.1.21 does not properly verify ownership of events before allowing them to be modified, deleted, or reassigned to a different author, allowing users with contributor-level access and above to alter, delete, or take over events created by other users including...

5.3AI score0.00248EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/19 6:00 a.m.8 views

EUVD-2026-62257

The Dinatur WordPress plugin through 1.18 does not sanitize and escape user input before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks. The same handler also performs a database table truncation without any authorization check, allowing any unauthenticat...

8.6CVSS5.8AI score0.00324EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/19 6:00 a.m.9 views

EUVD-2026-62259

The Eventin WordPress plugin before 4.1.21 does not verify the current user's permission to edit other users before assigning roles and updating user metadata during speaker creation, allowing users with contributor-level access and above to modify other users' roles and metadata...

2.7CVSS5.3AI score0.00205EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/19 6:00 a.m.7 views

EUVD-2026-62260

The Eventin WordPress plugin before 4.1.21 does not verify ownership or capability before deleting user accounts, allowing users with contributor-level access and above to permanently delete other users' accounts...

7.2CVSS5.3AI score0.00316EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/19 6:00 a.m.11 views

CVE-2026-13174

The Eventin WordPress plugin before 4.1.21 has an IDOR flaw: contributor-level users can permanently delete other users' accounts. Update to 4.1.21 or later. No active exploitation reported. Patch via the Eventin plugin update page. Details: https://wpscan.com/vulnerability/849478d1-640f-49e0-8fa...

7.2CVSS5.3AI score0.00316EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/19 6:00 a.m.11 views

EUVD-2026-62256

The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access as low as Subscriber to read arbitrary files on the server — including...

8.5CVSS5.6AI score0.00235EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/19 6:00 a.m.15 views

CVE-2026-11565

The Advanced File Manager WordPress plugin before 5.4.13 lacks capability checks in several file management AJAX actions, specifically via the fma_load_fma_ui handler. Any user with file-manager access (as low as Subscriber ) can read arbitrary files on the server—including sensitive configuratio...

8.5CVSS5.6AI score0.00235EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/19 6:00 a.m.29 views

CVE-2026-11565 Advanced File Manager < 5.4.13 - Authenticated Arbitrary File Read and Write via fma_load_fma_ui

The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access as low as Subscriber to read arbitrary files on the server — including...

0.00235EPSS
SaveExploits0References1
NVD
NVD
added 2026/08/19 5:17 a.m.8 views

CVE-2026-19942

The Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the AVCFAbilitiesMedia::register replace-media-file executecallback function in all versions ...

8.1CVSS0.00687EPSS
SaveExploits0References8
Cvelist
Cvelist
added 2026/08/19 4:27 a.m.34 views

CVE-2026-19942 Atarim <= 5.1.1 - Authenticated (Author+) Arbitrary File Deletion via '_wp_attached_file' Meta

The Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the AVCFAbilitiesMedia::register replace-media-file executecallback function in all versions ...

8.1CVSS0.00687EPSS
SaveExploits0References8
CVE
CVE
added 2026/08/19 4:27 a.m.29 views

CVE-2026-19942

The Atarim WordPress plugin (≤5.1.1) allows authenticated author-level attackers to delete arbitrary server files. The root cause is insufficient file path validation in AVCF_Abilities_Media::register's replace-media-file execute_callback. Attackers first use atarim/update-post-field to set _wp_a...

8.1CVSS6.5AI score0.00687EPSS
SaveExploits0References8
Rows per page
Query Builder