323272 matches found
EUVD-2026-112631
The Video Player for YouTube WordPress plugin before 2.1.4 does not perform a capability check on its player-preset AJAX handler, allowing users with the Contributor role and above to read the site-wide player-preset configuration, and in versions before 2.1.1 to modify and delete it as well...
CVE-2026-85007 YT Player < 2.1.4 - Contributor+ Missing Authorization via ytp_ajax
The Video Player for YouTube WordPress plugin before 2.1.4 does not perform a capability check on its player-preset AJAX handler, allowing users with the Contributor role and above to read the site-wide player-preset configuration, and in versions before 2.1.1 to modify and delete it as well...
CVE-2026-115259 Photo Engine < 6.6.0 - Author+ Arbitrary Content Modification via IDOR
The Photo Engine Media Organizer & Lightroom WordPress plugin before 6.6.0 does not have proper authorization checks when updating post data through one of its REST API routes in all versions up to, and including, 6.5.8. This makes it possible for authenticated attackers, with Author-level access...
CVE-2026-115245
The Chat AI with Dispatcher WordPress plugin (versions before 2.4 ) contains an unauthenticated arbitrary file upload vulnerability. The root cause is insufficient validation of uploaded files, as the plugin relies on a spoofable client-supplied content type. This allows an attacker to upload arb...
WordPress Video Player for YouTube plugin < 2.1.4 - Contributor+ Missing Authorization vulnerability
Contributor+ Missing Authorization vulnerability discovered by achmad sonif in WordPress Plugin YT Player versions 2.1.4...
WordPress Photo Engine (Media Organizer & Lightroom) plugin < 6.6.0 - Author+ Arbitrary Content Modification vulnerability
Author+ Arbitrary Content Modification vulnerability discovered by Mahammad Mammadov in WordPress Plugin Photo Engine versions 6.6.0...
CVE-2026-114270
The GeoDirectory WordPress plugin in versions prior to 2.8.197 contains a vulnerability where it fails to honor post password protection when rendering a listing. This flaw allows unauthenticated users to access and disclose the content and custom fields of published listings that are intended to...
EUVD-2026-112628
The GeoDirectory WordPress plugin before 2.8.197 does not honour post password protection when rendering a listing, allowing unauthenticated users to disclose the content and custom fields of published listings that are protected by a post password...
CVE-2026-110983
The WP Photo Album Plus WordPress plugin (versions before 9.3.04.004 ) is vulnerable to a Cross-Site Request Forgery (CSRF) flaw. The software fails to verify the origin or a security token for specific comment-management requests. An attacker can exploit this by tricking a logged-in user with co...
EUVD-2026-112626
The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset one-time code to the resolved account's own email address, mailing it to the address supplied in the request instead, allowing unauthenticated attackers to reset any user's password, including an administrator's,...
CVE-2026-113617
The Automated Import Products to Cart WordPress plugin (versions prior to 1.0.4 ) is vulnerable to arbitrary file read and deletion due to a path traversal flaw (CWE-22). The application fails to sanitize user-supplied file paths before using them in file system operations. This allows users with...
CVE-2026-111739 Two Factor Authentication < 1.17.0 and All-In-One Security (AIOS) < 5.5.0 - Subscriber+ 2FA Bypass via 'creds_user_id' Parameter
The Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Security AIOS WordPress plugin before 5.5.0 do not bind the account whose two-factor code is verified to the account being authenticated, allowing an attacker who knows a victim's password and holds their own...
CVE-2026-113616 LogixFast Auth < 1.0.4 - Unauthenticated Account Takeover via Password Reset
The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset one-time code to the resolved account's own email address, mailing it to the address supplied in the request instead, allowing unauthenticated attackers to reset any user's password, including an administrator's,...
EUVD-2026-112625
The Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Security AIOS WordPress plugin before 5.5.0 do not bind the account whose two-factor code is verified to the account being authenticated, allowing an attacker who knows a victim's password and holds their own...
CVE-2026-111739
The Two Factor Authentication WordPress plugin (versions < 1.17.0) and the All-In-One Security (AIOS) WordPress plugin (versions
EUVD-2026-112627
The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize a user-supplied file path before using it to read and delete files, allowing users with minimal permissions, such as subscribers, to read arbitrary files including ones containing the database credentials and...
CVE-2026-114270 GeoDirectory < 2.8.197 - Unauthenticated Password-Protected Listing Content Disclosure
The GeoDirectory WordPress plugin before 2.8.197 does not honour post password protection when rendering a listing, allowing unauthenticated users to disclose the content and custom fields of published listings that are protected by a post password...
CVE-2026-113617 Automated Import Products to Cart < 1.0.4 - Subscriber+ Arbitrary File Read and Deletion via Path Traversal
The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize a user-supplied file path before using it to read and delete files, allowing users with minimal permissions, such as subscribers, to read arbitrary files including ones containing the database credentials and...
WordPress WP Photo Album Plus plugin < 9.3.04.004 - Photo Comment Deletion vulnerability
Photo Comment Deletion vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin WP Photo Album Plus versions 9.3.04.004...
CVE-2026-110030
The Hide Price Until Login WordPress plugin (versions before 1.1.2 ) is vulnerable to unauthenticated account creation . The root cause is that the plugin fails to restrict a guest-registration handler and ignores the site's standard user-registration settings. This allows any user to create a Wo...