276651 matches found
CVE-2026-66634
Subscriber Insecure Direct Object References IDOR in Modal Survey = 2.0.2.2.3 versions...
CVE-2026-66629 WordPress Kirki plugin <= 6.2.3 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Kirki = 6.2.3 versions...
EUVD-2026-60917
Unauthenticated Cross Site Scripting XSS in Kirki = 6.2.3 versions...
CVE-2026-66629
CVE-2026-66629 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress Kirki plugin , affecting versions ≤ 6.2.3 (Patchstack lists ≤ 6.2.4). The vulnerability was discovered by daroo and carries a CVSS 3.1 score of 7.1 (HIGH) , with a changed scope and low impact on confid...
CVE-2026-66629
Unauthenticated Cross Site Scripting XSS in Kirki = 6.2.3 versions...
CVE-2026-66627
Contributor Arbitrary File Upload in GP Premium = 2.5.5 versions...
EUVD-2026-60916
Contributor Arbitrary File Upload in GP Premium = 2.5.5 versions...
CVE-2026-66627 WordPress GP Premium plugin <= 2.5.5 - Arbitrary File Upload vulnerability
Contributor Arbitrary File Upload in GP Premium = 2.5.5 versions...
CVE-2026-66627
The WordPress GP Premium plugin (versions ≤ 2.5.5) allows contributors to upload arbitrary files, enabling potential remote code execution, data theft, or site defacement. CVSS 9.9 (Critical) reflects network-accessible, low-complexity exploitation with low privileges required. Update to the late...
CVE-2026-66627 WordPress GP Premium plugin <= 2.5.5 - Arbitrary File Upload vulnerability
Contributor Arbitrary File Upload in GP Premium = 2.5.5 versions...
CVE-2026-66622
Unauthenticated SQL Injection in Depicter Slider = 4.8.0 versions...
CVE-2026-66622 WordPress Depicter Slider plugin <= 4.8.0 - SQL Injection vulnerability
Unauthenticated SQL Injection in Depicter Slider = 4.8.0 versions...
CVE-2026-66622
The WordPress Depicter Slider plugin (versions ≤ 4.8.0) has an unauthenticated SQL injection vulnerability exploitable over the network, rated HIGH (CVSS 7.5), allowing database disclosure; no in-the-wild exploitation or patch details are provided in the documents. Patchstack's advisory is linked...
CVE-2026-66621 WordPress Ultimate Dashboard Pro plugin <= 3.11.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in MapSteps UG Ultimate Dashboard Pro allows DOM-Based XSS. This issue affects Ultimate Dashboard Pro: from n/a through 3.11.2...
CVE-2026-66621
Unauthenticated reflected XSS affects the Ultimate Dashboard WordPress plugin up to version 3.11.2, scored CVSS 7.1 (HIGH). No patch version or exploitation evidence is provided; users should update to a fixed release when available and apply WAF rules for XSS filtering.
CVE-2026-66621 WordPress Ultimate Dashboard Pro plugin <= 3.11.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in MapSteps UG Ultimate Dashboard Pro allows DOM-Based XSS. This issue affects Ultimate Dashboard Pro: from n/a through 3.11.2...
CVE-2026-66620 WordPress OptionTree plugin <= 2.7.3 - PHP Object Injection vulnerability
Editor PHP Object Injection in OptionTree = 2.7.3 versions...
CVE-2026-66620
Editor PHP Object Injection in OptionTree = 2.7.3 versions...
CVE-2026-66620
The WordPress OptionTree plugin (≤ 2.7.3) is vulnerable to PHP Object Injection via its Editor component. CVSS 7.2 (HIGH) reflects network attack vector, low complexity, and high impact across confidentiality, integrity, and availability, requiring attacker privileges. Exploitation details are no...