275915 matches found
CVE-2026-73343 WordPress WP Compress plugin < 7.20.01 - Remote Code Execution (RCE) vulnerability
Unauthenticated Remote Code Execution RCE in WP Compress 7.20.01 versions...
CVE-2026-73342
Unauthenticated Cross Site Scripting XSS in WP Multilang = 2.4.31 versions...
CVE-2026-73342 WordPress WP Multilang plugin <= 2.4.31 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in WP Multilang = 2.4.31 versions...
EUVD-2026-60772
Unauthenticated Cross Site Scripting XSS in WP Multilang = 2.4.31 versions...
CVE-2026-73341 WordPress RegistrationMagic plugin <= 6.0.9.7 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in RegistrationMagic = 6.0.9.7 versions...
CVE-2026-73341
The WordPress RegistrationMagic plugin (versions
EUVD-2026-60771
Unauthenticated PHP Object Injection in RegistrationMagic = 6.0.9.7 versions...
CVE-2026-73341
Unauthenticated PHP Object Injection in RegistrationMagic = 6.0.9.7 versions...
CVE-2026-73339
Affected product: Modern Events Calendar plugin for WordPress. Root cause: SQL injection vulnerability exploitable without authentication in versions below 7.35.0. Impact: CVSS 9.3 (CRITICAL), network-exploitable with no privileges or user interaction, enabling high confidentiality impact. Remedi...
CVE-2026-73339 WordPress Modern Events Calendar plugin < 7.35.0 - SQL Injection vulnerability
Unauthenticated SQL Injection in Modern Events Calendar 7.35.0 versions...
CVE-2026-73338 WordPress Autopay plugin <= 5.0.0 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Autopay = 5.0.0 versions...
CVE-2026-73338
The WordPress Autopay plugin (versions ≤ 5.0.0) has an unauthenticated reflected/stored XSS flaw, exploitable via a network request with no authentication. CVSS 7.1 (HIGH) reflects low confidentiality/integrity/availability impact. Exploitation details are not provided; update to a patched versio...
CVE-2026-73190 WordPress WPDM – Premium Packages plugin <= 7.0.5 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in WPDM – Premium Packages = 7.0.5 versions...
CVE-2026-73187 WordPress Sticky Chat Widget plugin <= 1.4.2 - SQL Injection vulnerability
Unauthenticated SQL Injection in Sticky Chat Widget = 1.4.2 versions...
CVE-2026-73187
Unauthenticated SQL Injection in Sticky Chat Widget = 1.4.2 versions...
CVE-2026-73187
The WordPress Sticky Chat Widget plugin (versions ≤ 1.4.2) contains an unauthenticated SQL Injection vulnerability, discovered by Nguyen Ba Khanh of HPT Vietnam Corporation. CVSS 3.1 scores it 9.3 (Critical) for network-exploitable high confidentiality impact. CISA SSVC rates it automatable with ...
EUVD-2026-60938
Unauthenticated SQL Injection in Sticky Chat Widget = 1.4.2 versions...
CVE-2026-73181
Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce 7.6 versions...
CVE-2026-68568
WordPress MasterStudy LMS plugin (≤ 3.7.41) allows authenticated subscribers to escalate privileges, likely by bypassing capability checks in REST endpoints or AJAX handlers. CVSS 6.3 (medium) — network attack, low privileges required. No in-the-wild exploitation reported. Upgrade to a patched ve...