275531 matches found
CVE-2026-66647 WordPress Homlisti theme <= 3.1.2 - Broken Access Control vulnerability
Subscriber Broken Access Control in Homlisti = 3.1.2 versions...
CVE-2026-66647
CVE-2026-66647 is a Broken Access Control vulnerability in the WordPress Homlisti theme , affecting versions 3.1.2 and below . The flaw allows a user with Subscriber privileges to perform actions beyond their intended access level, resulting in a high integrity impact (CVSS 3.1 score: 6.5 MEDIUM ...
CVE-2026-66615 WordPress Podlove Podcast Publisher plugin <= 4.5.4 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Podlove Podcast Publisher = 4.5.4 versions...
CVE-2026-66616 WordPress Form Maker by 10Web plugin <= 1.15.46 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Form Maker by 10Web = 1.15.46 versions...
CVE-2026-66615
Podlove Podcast Publisher WordPress plugin versions ≤ 4.5.4 has an unauthenticated reflected/stored XSS flaw (CVSS 7.1 HIGH, network-exploitable, no auth required). No exploitation data is provided. Update to a patched version beyond 4.5.4; see the Patchstack advisory for details.
CVE-2026-66616
CVE-2026-66616 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Form Maker by 10Web , affecting versions ≤ 1.15.46 . The flaw allows a remote, unauthenticated attacker to inject malicious scripts into the context of a victim's browser, requiring user interact...
EUVD-2026-63298
Unauthenticated Cross Site Scripting XSS in SEO Plugin by Squirrly SEO = 14.2.2 versions...
CVE-2026-66611 WordPress Paymob for WooCommerce plugin <= 4.1.10 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Paymob for WooCommerce = 4.1.10 versions...
CVE-2026-66612 WordPress Aora theme <= 1.3.19 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Aora = 1.3.19 versions...
EUVD-2026-63297
Unauthenticated Cross Site Scripting XSS in Aora = 1.3.19 versions...
CVE-2026-66609 WordPress TheGem (Elementor) theme <= 5.12.3 - SQL Injection vulnerability
Unauthenticated SQL Injection in TheGem Elementor = 5.12.3 versions...
EUVD-2026-63295
Unauthenticated SQL Injection in TheGem Elementor = 5.12.3 versions...
EUVD-2026-63294
Unauthenticated Cross Site Scripting XSS in Advance Product Search = 1.4.8 versions...
CVE-2026-66607 WordPress Advance Product Search plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Advance Product Search = 1.4.8 versions...
CVE-2026-66607
The WordPress Advance Product Search plugin (versions ≤ 1.4.8) has an unauthenticated XSS flaw with CVSS 7.1 (HIGH). Patchstack is the source; the Patchstack advisory link is provided in the references. No exploitation evidence is reported in the provided documents.
EUVD-2026-63293
Unauthenticated Cross Site Scripting XSS in SmartSMTP = 1.2.0 versions...
CVE-2026-66606 WordPress SmartSMTP plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in SmartSMTP = 1.2.0 versions...
CVE-2026-66606
An unauthenticated reflected/stored XSS vulnerability exists in the WordPress SmartSMTP plugin through version 1.2.0. An attacker can inject malicious scripts without authentication; a victim triggering the payload could have their session cookies stolen or admin actions hijacked. CVSS 3.1 scores...