276490 matches found
CVE-2026-73187
Unauthenticated SQL Injection in Sticky Chat Widget = 1.4.2 versions...
CVE-2026-73187 WordPress Sticky Chat Widget plugin <= 1.4.2 - SQL Injection vulnerability
Unauthenticated SQL Injection in Sticky Chat Widget = 1.4.2 versions...
EUVD-2026-60938
Unauthenticated SQL Injection in Sticky Chat Widget = 1.4.2 versions...
CVE-2026-73187
The WordPress Sticky Chat Widget plugin (versions ≤ 1.4.2) contains an unauthenticated SQL Injection vulnerability, discovered by Nguyen Ba Khanh of HPT Vietnam Corporation. CVSS 3.1 scores it 9.3 (Critical) for network-exploitable high confidentiality impact. CISA SSVC rates it automatable with ...
CVE-2026-73181
Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce 7.6 versions...
CVE-2026-68568
WordPress MasterStudy LMS plugin (≤ 3.7.41) allows authenticated subscribers to escalate privileges, likely by bypassing capability checks in REST endpoints or AJAX handlers. CVSS 6.3 (medium) — network attack, low privileges required. No in-the-wild exploitation reported. Upgrade to a patched ve...
CVE-2026-68568 WordPress MasterStudy LMS plugin <= 3.7.41 - Privilege Escalation vulnerability
Subscriber Privilege Escalation in MasterStudy LMS = 3.7.41 versions...
CVE-2026-68567
The WordPress Convert Pro plugin (versions ≤ 1.0.1) contains an unauthenticated reflected/stored XSS flaw exploitable via network access with low complexity; CVSS 7.1 (High). Patchstack reports it. Upgrade to a patched version if available; no exploitation evidence provided. See https://patchstac...
CVE-2026-68567 WordPress Convert Pro plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Convert Pro = 1.0.1 versions...
CVE-2026-68565
Contributor-level XSS in the WordPress GeoDirectory plugin affects versions up to 2.8.172 (CVE description) or 2.8.174 (Patchstack report), exploitable by authenticated users with contributor privileges to inject scripts affecting other users. No patch version or in-the-wild exploitation details ...
EUVD-2026-60934
Contributor Cross Site Scripting XSS in GeoDirectory = 2.8.172 versions...
CVE-2026-68565 WordPress GeoDirectory plugin <= 2.8.172 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in GeoDirectory = 2.8.172 versions...
CVE-2026-68565
Contributor Cross Site Scripting XSS in GeoDirectory = 2.8.172 versions...
CVE-2026-66679 WordPress Appointment Hour Booking plugin <= 1.5.91 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Appointment Hour Booking = 1.5.91 versions...
EUVD-2026-60933
Unauthenticated Broken Access Control in Appointment Hour Booking = 1.5.91 versions...
CVE-2026-66679
WordPress plugin Appointment Hour Booking (≤1.5.91) has an unauthenticated broken access control flaw, allowing network-based attackers to alter data or cause partial disruption. No in-the-wild exploitation is reported; updating to version 1.5.92+ is recommended.
CVE-2026-66667 WordPress Templately plugin <= 3.7.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Templately = 3.7.1 versions...
EUVD-2026-60932
Unauthenticated Cross Site Scripting XSS in Templately = 3.7.1 versions...
CVE-2026-66667
The WordPress Templately plugin (versions ≤ 3.7.1) contains an unauthenticated reflected/stored XSS vulnerability discovered by researcher daroo, rated CVSS 7.1 (HIGH). Attackers can inject malicious scripts via network requests requiring no authentication, potentially compromising user sessions ...