Lucene search
+L

273001 matches found

Cvelist
Cvelist
added 2026/08/19 6:00 a.m.29 views

CVE-2026-11565 Advanced File Manager < 5.4.13 - Authenticated Arbitrary File Read and Write via fma_load_fma_ui

The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access as low as Subscriber to read arbitrary files on the server — including...

0.00235EPSS
SaveExploits0References1
NVD
NVD
added 2026/08/19 5:17 a.m.8 views

CVE-2026-19942

The Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the AVCFAbilitiesMedia::register replace-media-file executecallback function in all versions ...

8.1CVSS0.00687EPSS
SaveExploits0References8
Cvelist
Cvelist
added 2026/08/19 4:27 a.m.34 views

CVE-2026-19942 Atarim <= 5.1.1 - Authenticated (Author+) Arbitrary File Deletion via '_wp_attached_file' Meta

The Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the AVCFAbilitiesMedia::register replace-media-file executecallback function in all versions ...

8.1CVSS0.00687EPSS
SaveExploits0References8
CVE
CVE
added 2026/08/19 4:27 a.m.29 views

CVE-2026-19942

The Atarim WordPress plugin (≤5.1.1) allows authenticated author-level attackers to delete arbitrary server files. The root cause is insufficient file path validation in AVCF_Abilities_Media::register's replace-media-file execute_callback. Attackers first use atarim/update-post-field to set _wp_a...

8.1CVSS6.5AI score0.00687EPSS
SaveExploits0References8
Nuclei
Nuclei
added 2026/08/19 4:15 a.m.466 views

WordPress Automatic Plugin <= 3.92.0 - SQL Injection

The Automatic plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 3.92.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append...

9.9CVSS9.4AI score0.93971EPSS
SaveExploits16References5
Nuclei
Nuclei
added 2026/08/19 4:15 a.m.138 views

WooCommerce Payments - Unauthorized Admin Access

An issue in WooCommerce Payments plugin for WordPress versions 5.6.1 and lower allows an unauthenticated attacker to send requests on behalf of an elevated user, like administrator. This allows a remote, unauthenticated attacker to gain admin access on a site that has the affected version of the...

9.8CVSS9AI score0.8651EPSS
SaveExploits9References5
NVD
NVD
added 2026/08/19 2:16 a.m.12 views

CVE-2026-15421

The Speed Optimizer – The All-In-One Performance-Boosting Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Image Tag Attributes in all versions up to, and including, 7.8.0 due to insufficient input sanitization and output escaping. This makes it possible for...

6.4CVSS0.00299EPSS
SaveExploits0References9
Cvelist
Cvelist
added 2026/08/19 1:26 a.m.45 views

CVE-2026-15421 Speed Optimizer <= 7.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Tag Attributes

The Speed Optimizer – The All-In-One Performance-Boosting Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Image Tag Attributes in all versions up to, and including, 7.8.0 due to insufficient input sanitization and output escaping. This makes it possible for...

6.4CVSS0.00299EPSS
SaveExploits0References9
CVE
CVE
added 2026/08/19 1:26 a.m.24 views

CVE-2026-15421

The Speed Optimizer – The All-In-One Performance-Boosting Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Image Tag Attributes in all versions up to, and including, 7.8.0 due to insufficient input sanitization and output escaping. This makes it possible for...

6.4CVSS5.5AI score0.00299EPSS
SaveExploits0References9
EUVD
EUVD
added 2026/08/19 1:26 a.m.13 views

EUVD-2026-62219

The Speed Optimizer – The All-In-One Performance-Boosting Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Image Tag Attributes in all versions up to, and including, 7.8.0 due to insufficient input sanitization and output escaping. This makes it possible for...

6.4CVSS5.5AI score0.00299EPSS
SaveExploits0References9
EUVD
EUVD
added 2026/08/19 12:31 a.m.9 views

EUVD-2026-62211

Missing Authorization vulnerability in Kings Plugins B2BKing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects B2BKing: from n/a through 5.2.30...

5.4CVSS5.2AI score0.00138EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/08/19 12:31 a.m.10 views

EUVD-2025-210740

The PPWP: Password Protect Pages, Posts & Full or Partial Content plugin for WordPress is vulnerable to unauthorized access of data due to a improper capability check on the canaccess function in all versions up to, and including, 1.9.15. This makes it possible for authenticated attackers, with...

4.3CVSS5.4AI score0.00209EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/08/19 12:31 a.m.12 views

EUVD-2026-62210

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in David Lingren Media LIbrary Assistant allows Stored XSS. This issue affects Media LIbrary Assistant: from n/a through 3.39...

6.5CVSS5.2AI score0.00161EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/08/19 12:31 a.m.8 views

EUVD-2026-62208

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in David Artiss Draft List simple-draft-list allows Stored XSS. This issue affects Draft List: from n/a through 2.6.4...

6.5CVSS5.2AI score0.00161EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/08/19 12:31 a.m.8 views

EUVD-2026-62209

Cross-Site Request Forgery CSRF vulnerability in DevItems HashBar – WordPress Notification Bar allows Cross Site Request Forgery. This issue affects HashBar – WordPress Notification Bar: from n/a through 2.0.0...

8.8CVSS5.2AI score0.00146EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/08/19 12:00 a.m.9 views

PT-2026-78267

The Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the AVCF Abilities Media::register replace-media-file execute callback function in all versio...

8.1CVSS6.5AI score0.00687EPSS
SaveExploits0References10
Positive Technologies
Positive Technologies
added 2026/08/19 12:00 a.m.8 views

PT-2026-78533

Name of the Vulnerable Software and Affected Versions Elementor Pro versions prior to 4.2.2 Description An unrestricted file upload flaw allows unauthenticated attackers to bypass the file-extension blocklist and upload malicious PHP files. This occurs when a published Form widget contains a File...

9CVSS6.4AI score0.00416EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/08/19 12:00 a.m.6 views

PT-2026-78335

Unauthenticated Cross Site Scripting XSS in Global Gallery = 11.1.2 versions...

7.1CVSS5.1AI score0.00146EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/08/19 12:00 a.m.9 views

PT-2026-78340

Customer PHP Object Injection in Flexible Subscriptions = 1.8.1 versions...

9.8CVSS5.4AI score0.00313EPSS
SaveExploits0References2
Tenable Nessus
Tenable Nessus
added 2026/08/19 12:00 a.m.8 views

Linux Distros Unpatched Vulnerability : CVE-2026-65640

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Prerequisites: Imagick...

8.8CVSS8.7AI score0.00814EPSS
SaveExploits0References3
Rows per page
Query Builder