324146 matches found
CVE-2026-118192
The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL Injection via the 'teamid' parameter in all versions up to, and including, 5.7.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...
CVE-2026-107627
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 13.2.1 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-107743
The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.0.5. This is due to the /wp-json/mapster-wp-maps/save-mapmaker REST route being registered with a permissioncallback that unconditionally returns true no capability check, no...
CVE-2026-109215
The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bbpreplycontent' parameter in all versions up to, and including, 7.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-lev...
CVE-2026-104727
The Sequential Order Numbers for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'condition' Post Meta Array Keys in all versions up to, and including, 3.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
CVE-2026-107629
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 13.2.1 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-110707
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:group/media:description XML element in the imported feed' parameter in all versions up to, and including, 5.2.12 due to...
CVE-2026-103875
The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search-string' parameter in all versions up to, and including, 3.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
CVE-2026-103485
The Extensions for Leaflet Map plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'feature.properties' parameter in all versions up to, and including, 5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...
WordPress Community Events plugin < 1.6.0 - Unauthenticated Stored XSS vulnerability
Unauthenticated Stored XSS vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Community Events versions 1.6.0...
WordPress Chat AI with Dispatcher plugin < 2.4 - Unauthenticated Arbitrary File Upload vulnerability
Unauthenticated Arbitrary File Upload vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin Chat AI with Dispatcher versions 2.4...
WordPress LogixFast Auth plugin < 1.0.4 - Unauthenticated Account Takeover vulnerability
Unauthenticated Account Takeover vulnerability discovered by Naoki Kawahigashi in WordPress Plugin LogixFast Auth versions 1.0.4...
WordPress ProfileGrid plugin < 6.0.0.5 - Unauthenticated PHP Object Injection vulnerability
Unauthenticated PHP Object Injection vulnerability discovered by sungbyeongchan in WordPress Plugin ProfileGrid versions 6.0.0.5...
WordPress Frontend Dashboard plugin < 3.0.5 - Unauthenticated PHP Object Injection vulnerability
Unauthenticated PHP Object Injection vulnerability discovered by sungbyeongchan in WordPress Plugin Frontend Dashboard versions 3.0.5...
WordPress Two Factor Authentication plugin < 1.17.0 - Subscriber+ 2FA Bypass vulnerability
Subscriber+ 2FA Bypass vulnerability discovered by Karol Czubernat in WordPress Plugin Two Factor Authentication versions 1.17.0...
WordPress Hide Price Until Login plugin < 1.1.2 - Unauthenticated Account Creation vulnerability
Unauthenticated Account Creation vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Hide Price Until Login versions 1.1.2...
CVE-2026-111318
The HT Mega Addons for Elementor WordPress plugin (versions <= 3.2.7 ) is vulnerable to Stored DOM-Based Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping in the href attribute of tags within the .htmega-tab-nav parameter of the Tabs widget . U...
CVE-2026-111318 HT Mega Addons for Elementor <= 3.2.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Tabs Widget href DOM Sink
The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href attribute of inside .htmega-tab-nav' parameter in all versions up to, and including, 3.2.7 due to insufficient input sanitization and...
EUVD-2026-112693
The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href attribute of inside .htmega-tab-nav' parameter in all versions up to, and including, 3.2.7 due to insufficient input sanitization and...
CVE-2026-111318 HT Mega Addons for Elementor <= 3.2.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Tabs Widget href DOM Sink
The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href attribute of inside .htmega-tab-nav' parameter in all versions up to, and including, 3.2.7 due to insufficient input sanitization and...