276366 matches found
CVE-2026-73395 WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Insecure Direct Object References (IDOR) vulnerability
Unauthenticated Insecure Direct Object References IDOR in Booking calendar, Appointment Booking System = 3.2.36 versions...
CVE-2026-73395
The WordPress plugin Booking calendar, Appointment Booking System (versions ≤ 3.2.36) has an unauthenticated IDOR flaw, discovered by Jakub Herman, allowing remote attackers to access or modify objects without authentication. CVSS 3.1 scores 6.5 (Medium) with no in-the-wild exploitation reported....
CVE-2026-73393
The WordPress Subscribe2 plugin (versions ≤ 10.46) contains an unauthenticated reflected XSS flaw, exploitable via network without privileges; CVSS 7.1 (High). Patchstack is the CNA. No exploitation evidence or fix version is provided in the documents. Monitor for updates. Patchstack advisory: ht...
CVE-2026-73393 WordPress Subscribe2 plugin <= 10.46 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Subscribe2 = 10.46 versions...
CVE-2026-73393
Unauthenticated Cross Site Scripting XSS in Subscribe2 = 10.46 versions...
EUVD-2026-60800
Unauthenticated Cross Site Scripting XSS in Subscribe2 = 10.46 versions...
CVE-2026-73392 WordPress Super Store Finder plugin <= 7.8 - SQL Injection vulnerability
Unauthenticated SQL Injection in Super Store Finder = 7.8 versions...
CVE-2026-73392 WordPress Super Store Finder plugin <= 7.8 - SQL Injection vulnerability
Unauthenticated SQL Injection in Super Store Finder = 7.8 versions...
CVE-2026-73392
The WordPress Super Store Finder plugin (versions ≤7.8) has an unauthenticated SQL injection flaw, allowing remote attackers to execute arbitrary SQL queries without credentials. Patchstack rates it CRITICAL (CVSS 9.3). No patch or exploit details are provided in the documents.
EUVD-2026-60798
Shop manager Arbitrary File Download in CTX Feed = 6.6.47 versions...
CVE-2026-73383 WordPress CTX Feed plugin <= 6.6.47 - Arbitrary File Download vulnerability
Shop manager Arbitrary File Download in CTX Feed = 6.6.47 versions...
CVE-2026-73383
The WordPress CTX Feed plugin (versions ≤ 6.6.47) allows a Shop Manager to download arbitrary files from the server. CVSS 3.1 scores it MEDIUM (4.9), requiring network access and HIGH privileges. Patchstack discovered the flaw; update to a patched version beyond 6.6.47 to remediate. No exploitati...
CVE-2026-73382
Unauthenticated Cross Site Scripting XSS in Site Reviews = 8.2.0 versions...
CVE-2026-73382 WordPress Site Reviews plugin <= 8.2.0 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Site Reviews = 8.2.0 versions...
CVE-2026-73382
The WordPress Site Reviews plugin (versions ≤ 8.2.0) has an unauthenticated Cross-Site Scripting (XSS) vulnerability, exploitable over the network with no privileges required, rated CVSS 7.1 HIGH. No in-the-wild exploitation has been reported. No patch version is provided in the available documen...
EUVD-2026-60796
Unauthenticated Broken Authentication in Popup by Supsystic = 1.13.0 versions...
CVE-2026-73381 WordPress Popup by Supsystic plugin <= 1.13.0 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in Popup by Supsystic = 1.13.0 versions...
CVE-2026-73380
CVE-2026-73380 is an unauthenticated PHP Object Injection vulnerability in the WordPress plugin Popup by Supsystic , affecting versions ≤ 1.13.0 . The vulnerability was discovered by Asim Alshaya and rated CVSS 9.8 (Critical) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating full c...