323198 matches found
WordPress Kit (formerly ConvertKit) plugin <= 3.4.7 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Taegyeong Yun in WordPress Plugin Kit formerly ConvertKit versions = 3.4.7...
WordPress Profile Builder plugin <= 4.0.5 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Sangho Lee in WordPress Plugin Profile Builder versions = 4.0.5...
WordPress Strong Testimonials plugin <= 3.3.15 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by nizar yart D3dC0d in WordPress Plugin Strong Testimonials versions = 3.3.15...
CVE-2026-25450
The ThemeGrill User Registration WordPress plugin (versions
WordPress User Registration plugin <= 5.3.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by elba.code in WordPress Plugin User Registration versions = 5.3.0...
WordPress Media LIbrary Assistant plugin <= 3.42 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Deva Parekh in WordPress Plugin Media LIbrary Assistant versions = 3.42...
WordPress WPFunnels plugin <= 3.13.5 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Matthew Lapinski in WordPress Plugin WPFunnels versions = 3.13.5...
WordPress SureDash plugin <= 1.12.3 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by yzx001 in WordPress Plugin SureDash versions = 1.12.3...
WordPress SureDash plugin <= 1.12.3 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by yzx001 in WordPress Plugin SureDash versions = 1.12.3...
WordPress StreamCast plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by V1T in WordPress Plugin StreamCast versions = 2.4.6...
WordPress JetElements For Elementor plugin <= 2.9.2.6 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin JetElements For Elementor versions = 2.9.2.6...
WordPress SureForms plugin <= 2.12.9 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Luke Schneider in WordPress Plugin SureForms versions = 2.12.9...
WordPress WPFunnels plugin <= 3.13.5 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Je22y in WordPress Plugin WPFunnels versions = 3.13.5...
CVE-2026-80069 MasterStudy LMS WordPress Plugin < 3.7.50 Missing Authorization via stm_lms_send_test_email_ajax
MasterStudy LMS plugin for WordPress before 3.7.50 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to trigger the stmlmssendtestemailajax AJAX action without capability or nonce validation. Attackers can invoke this handler directly or via...
EUVD-2026-112859
MasterStudy LMS plugin for WordPress before 3.7.50 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to trigger the stmlmssendtestemailajax AJAX action without capability or nonce validation. Attackers can invoke this handler directly or via...
CVE-2026-80069
The MasterStudy LMS plugin for WordPress (versions before 3.7.50 ) is vulnerable to a missing authorization flaw. The stm_lms_send_test_email_ajax AJAX action lacks proper capability and nonce validation, allowing any authenticated user, including those with Subscriber roles, to trigger the actio...
CVE-2026-80067 MasterStudy LMS WordPress Plugin < 3.7.50 Path Traversal via stm_lms_step Parameter
MasterStudy LMS plugin for WordPress before 3.7.50 contains a path traversal vulnerability that allows authenticated Subscriber-level users to import arbitrary WXR XML files by supplying directory traversal sequences in the stmlmsstep parameter passed to the stmlmsimportsampledata AJAX action,...
CVE-2026-80067
The MasterStudy LMS plugin for WordPress versions before 3.7.50 is vulnerable to a path traversal vulnerability. The issue originates from the stm_lms_import_sample_data AJAX action, where the stm_lms_step parameter lacks sufficient capability checks and nonce verification. This allows authentica...
EUVD-2026-112926
MasterStudy LMS plugin for WordPress before 3.7.50 contains a path traversal vulnerability that allows authenticated Subscriber-level users to import arbitrary WXR XML files by supplying directory traversal sequences in the stmlmsstep parameter passed to the stmlmsimportsampledata AJAX action,...