276488 matches found
CVE-2026-73350
SupportCandy is a WordPress plugin affected by an unauthenticated Broken Authentication vulnerability in versions ≤ 3.5.1 . The flaw allows a remote, unauthenticated attacker to bypass authentication over the network with low complexity and no user interaction, resulting in high confidentiality i...
CVE-2026-73350
Unauthenticated Broken Authentication in SupportCandy = 3.5.1 versions...
CVE-2026-73350 WordPress SupportCandy plugin <= 3.5.1 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in SupportCandy = 3.5.1 versions...
CVE-2026-73343
Unauthenticated Remote Code Execution RCE in WP Compress 7.20.01 versions...
EUVD-2026-60774
Unauthenticated Remote Code Execution RCE in WP Compress 7.20.01 versions...
CVE-2026-73343 WordPress WP Compress plugin < 7.20.01 - Remote Code Execution (RCE) vulnerability
Unauthenticated Remote Code Execution RCE in WP Compress 7.20.01 versions...
CVE-2026-73342
Unauthenticated Cross Site Scripting XSS in WP Multilang = 2.4.31 versions...
CVE-2026-73342 WordPress WP Multilang plugin <= 2.4.31 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in WP Multilang = 2.4.31 versions...
EUVD-2026-60772
Unauthenticated Cross Site Scripting XSS in WP Multilang = 2.4.31 versions...
CVE-2026-73341 WordPress RegistrationMagic plugin <= 6.0.9.7 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in RegistrationMagic = 6.0.9.7 versions...
CVE-2026-73341
The WordPress RegistrationMagic plugin (versions
EUVD-2026-60771
Unauthenticated PHP Object Injection in RegistrationMagic = 6.0.9.7 versions...
CVE-2026-73341
Unauthenticated PHP Object Injection in RegistrationMagic = 6.0.9.7 versions...
CVE-2026-73339
Affected product: Modern Events Calendar plugin for WordPress. Root cause: SQL injection vulnerability exploitable without authentication in versions below 7.35.0. Impact: CVSS 9.3 (CRITICAL), network-exploitable with no privileges or user interaction, enabling high confidentiality impact. Remedi...
CVE-2026-73339 WordPress Modern Events Calendar plugin < 7.35.0 - SQL Injection vulnerability
Unauthenticated SQL Injection in Modern Events Calendar 7.35.0 versions...
CVE-2026-73338 WordPress Autopay plugin <= 5.0.0 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Autopay = 5.0.0 versions...
CVE-2026-73338
The WordPress Autopay plugin (versions ≤ 5.0.0) has an unauthenticated reflected/stored XSS flaw, exploitable via a network request with no authentication. CVSS 7.1 (HIGH) reflects low confidentiality/integrity/availability impact. Exploitation details are not provided; update to a patched versio...