273015 matches found
EUVD-2026-60919
Subscriber Insecure Direct Object References IDOR in Modal Survey = 2.0.2.2.3 versions...
CVE-2026-66629 WordPress Kirki plugin <= 6.2.3 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Kirki = 6.2.3 versions...
EUVD-2026-60917
Unauthenticated Cross Site Scripting XSS in Kirki = 6.2.3 versions...
CVE-2026-66629
Unauthenticated reflected XSS in the WordPress Kirki plugin (versions ≤ 6.2.4) allows remote attackers to inject scripts via network access with low complexity; no user interaction beyond a victim visiting a crafted page is required. CVSS 7.1 HIGH. No in-the-wild exploitation reported; update to ...
CVE-2026-66629
Unauthenticated Cross Site Scripting XSS in Kirki = 6.2.3 versions...
EUVD-2026-60916
Contributor Arbitrary File Upload in GP Premium = 2.5.5 versions...
CVE-2026-66627
Contributor Arbitrary File Upload in GP Premium = 2.5.5 versions...
CVE-2026-66627
The WordPress GP Premium plugin (versions ≤ 2.5.5) allows contributors to upload arbitrary files, enabling potential remote code execution, data theft, or site defacement. CVSS 9.9 (Critical) reflects network-accessible, low-complexity exploitation with low privileges required. Update to the late...
CVE-2026-66627 WordPress GP Premium plugin <= 2.5.5 - Arbitrary File Upload vulnerability
Contributor Arbitrary File Upload in GP Premium = 2.5.5 versions...
CVE-2026-66627 WordPress GP Premium plugin <= 2.5.5 - Arbitrary File Upload vulnerability
Contributor Arbitrary File Upload in GP Premium = 2.5.5 versions...
CVE-2026-66622 WordPress Depicter Slider plugin <= 4.8.0 - SQL Injection vulnerability
Unauthenticated SQL Injection in Depicter Slider = 4.8.0 versions...
CVE-2026-66622
Unauthenticated SQL Injection in Depicter Slider = 4.8.0 versions...
CVE-2026-66622
The WordPress Depicter Slider plugin (versions ≤ 4.8.0) has an unauthenticated SQL injection vulnerability exploitable over the network, rated HIGH (CVSS 7.5), allowing database disclosure; no in-the-wild exploitation or patch details are provided in the documents. Patchstack's advisory is linked...
CVE-2026-66621 WordPress Ultimate Dashboard plugin <= 3.11.2 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Ultimate Dashboard = 3.11.2 versions...
CVE-2026-66621
Unauthenticated reflected XSS affects the Ultimate Dashboard WordPress plugin up to version 3.11.2, scored CVSS 7.1 (HIGH). No patch version or exploitation evidence is provided; users should update to a fixed release when available and apply WAF rules for XSS filtering.
CVE-2026-66621 WordPress Ultimate Dashboard plugin <= 3.11.2 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Ultimate Dashboard = 3.11.2 versions...
CVE-2026-66620 WordPress OptionTree plugin <= 2.7.3 - PHP Object Injection vulnerability
Editor PHP Object Injection in OptionTree = 2.7.3 versions...
CVE-2026-66620
Editor PHP Object Injection in OptionTree = 2.7.3 versions...
CVE-2026-66620
The WordPress OptionTree plugin (≤ 2.7.3) is vulnerable to PHP Object Injection via its Editor component. CVSS 7.2 (HIGH) reflects network attack vector, low complexity, and high impact across confidentiality, integrity, and availability, requiring attacker privileges. Exploitation details are no...