CVE-2026-32463 WordPress Sync Post With Other Site plugin <= 1.9.3 - Arbitrary File Upload vulnerability

Contributor Arbitrary File Upload in Sync Post With Other Site = 1.9.3 versions...

CVE-2026-32463 WordPress Sync Post With Other Site plugin <= 1.9.3 - Arbitrary File Upload vulnerability

Contributor Arbitrary File Upload in Sync Post With Other Site = 1.9.3 versions...

CVE-2026-32463

Contributor Arbitrary File Upload in Sync Post With Other Site = 1.9.3 versions...

EUVD-2026-60899

Contributor Arbitrary File Upload in Sync Post With Other Site = 1.9.3 versions...

CVE-2026-32463

CVE-2026-32463 is an arbitrary file upload vulnerability in the WordPress plugin Sync Post With Other Site , affecting versions 1.9.3 and below . The flaw allows a user with Contributor privileges (low privilege) to upload arbitrary files, which can lead to full site compromise. The CVSS 3.1 scor...

EUVD-2026-60898

Contributor Remote Code Execution RCE in Cwicly = 1.4.4 versions...

CVE-2026-32444 WordPress Cwicly plugin <= 1.4.4 - Remote Code Execution (RCE) vulnerability

Contributor Remote Code Execution RCE in Cwicly = 1.4.4 versions...

CVE-2026-32444 WordPress Cwicly plugin <= 1.4.4 - Remote Code Execution (RCE) vulnerability

Contributor Remote Code Execution RCE in Cwicly = 1.4.4 versions...

CVE-2026-32444

Contributor Remote Code Execution RCE in Cwicly = 1.4.4 versions...

CVE-2026-32444

The WordPress Cwicly plugin (≤1.4.4) allows authenticated contributor-level users to trigger remote code execution via a network-accessible, low-complexity attack requiring no user interaction. CVSS 3.1 scores 9.9 (CRITICAL). Patchstack advisory: https://patchstack.com/database/wordpress/plugin/c...

CVE-2026-32333

Mayosis Core WordPress plugin versions ≤5.4.7 are affected by an unauthenticated reflected Cross Site Scripting (XSS) vulnerability exploitable via network with low attack complexity; CVSS 3.1 score is 7.1 (HIGH), requiring user interaction. No patch version or in-the-wild exploitation details ar...

CVE-2026-32333 WordPress Mayosis Core plugin <= 5.4.7 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Mayosis Core = 5.4.7 versions...

CVE-2026-32333 WordPress Mayosis Core plugin <= 5.4.7 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Mayosis Core = 5.4.7 versions...

CVE-2026-28571

The WordPress FormyChat plugin (versions ≤ 2.15.7) has an unauthenticated broken access control vulnerability exploitable over the network with no privileges, rated CVSS 7.5 (HIGH) with high confidentiality impact. No specific root cause, affected endpoint, or fix version is provided in the docum...

CVE-2026-28571

Unauthenticated Broken Access Control in FormyChat = 2.15.7 versions...

CVE-2026-28571 WordPress FormyChat plugin <= 2.15.7 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in FormyChat = 2.15.7 versions...

CVE-2026-28570 WordPress Vavo Core plugin <= 2.3.0 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Vavo Core = 2.3.0 versions...

CVE-2026-28570

The WordPress plugin Vavo Core (versions ≤ 2.3.0) is vulnerable to unauthenticated Local File Inclusion, allowing remote attackers to read or include arbitrary server files without authentication. CVSS 3.1 scores it HIGH (8.1). No patch version or remediation is provided in the documents; upgradi...

CVE-2026-28570 WordPress Vavo Core plugin <= 2.3.0 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Vavo Core = 2.3.0 versions...

CVE-2026-28569

CVE-2026-28569 is an unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability in the WordPress plugin SSL Zen , affecting versions ≤ 4.7.43 . The vulnerability was discovered by Martino Spagnuolo (r3verii) and carries a CVSS 3.1 base score of 7.1 (HIGH) with a changed scope, indicating ...