276766 matches found
PT-2026-77065
Name of the Vulnerable Software and Affected Versions Featured Video Plus versions prior to 2.3.4 Description Cross Site Scripting XSS allows an attacker with contributor privileges to execute malicious scripts in the browser of other users. Recommendations Update to a version newer than 2.3.3...
PT-2026-77041
Contributor Arbitrary File Upload in Sync Post With Other Site = 1.9.3 versions...
VulnCheck KEV: CVE-2026-73400
Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress = 2.4.11 versions...
PT-2026-77132
Name of the Vulnerable Software and Affected Versions TaxoPress versions prior to 3.51.1 Description TaxoPress is subject to an object injection issue caused by the deserialization of untrusted data. This occurs when the application processes specially crafted serialized data, allowing an attacke...
NPM: 9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint
NPM: 9Router: Authenticated Server-Side Request Forgery SSRF via OIDC Provider Test Endpoint vulnerability discovered by ? in WordPress Npm 9router versions = 0.5.4...
DEBIAN-CVE-2026-65640
WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Prerequisites: Imagick and Ghostscript in use on the server A malicious user with the uploadfiles capability This issue affects all versions of WordPress. Versi...
CVE-2026-65640
WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Prerequisites: Imagick and Ghostscript in use on the server A malicious user with the uploadfiles capability This issue affects all versions of WordPress. Versi...
CVE-2026-65640
Affected: WordPress core
CVE-2026-65640
WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Prerequisites: Imagick and Ghostscript in use on the server A malicious user with the uploadfiles capability This issue affects all versions of WordPress. Versi...
CVE-2026-65640
WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Prerequisites: Imagick and Ghostscript in use on the server A malicious user with the uploadfiles capability This issue affects all versions of WordPress. Versi...
MINI-JQCV-48Q8-PWCR
Bulletin has no description...
WordPress Forminator Forms plugin <= 1.56.1 - Unauth. Arbitrary File Upload
Unauth. Arbitrary File Upload vulnerability discovered by daroo in WordPress Plugin Forminator versions = 1.56.1...
WordPress Gravity Booster – Styles & Layouts for Gravity Forms plugin <= 6.1 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Gravity Booster Styles & Layouts for Gravity Forms versions = 6.1...
WordPress RomethemeForm For Elementor plugin <= 1.2.6 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin RomethemeForm For Elementor versions = 1.2.6...
WordPress WP Table Builder plugin <= 2.2.1 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Table Builder versions = 2.2.1...
WordPress 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery plugin <= 1.16.20 - Sensitive Data Exposure vulnerability
Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery versions = 1.16.20...
WordPress Shortcodes and extra features for Phlox theme plugin <= 2.17.22 - Sensitive Data Exposure vulnerability
Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Shortcodes and extra features for Phlox theme versions = 2.17.22...
WordPress Razorpay for WooCommerce plugin <= 4.8.7 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Razorpay for WooCommerce versions = 4.8.7...
600,000 WordPress Sites Affected by Arbitrary File Upload Vulnerability in Forminator Forms WordPress Plugin
On July 14th, 2026, we received a submission for an Unauthenticated Arbitrary File Upload vulnerability in Forminator Forms, a WordPress plugin with more than 600,000 active installations. This vulnerability makes it possible for unauthenticated attackers to upload arbitrary files, including...
WordPress TrueBooker plugin <= 1.2.6 - Unauthenticated Account Takeover via Insecure Direct Object Reference in 'truebooker_wp_user_id' Parameter vulnerability
Unauthenticated Account Takeover via Insecure Direct Object Reference in 'truebookerwpuserid' Parameter vulnerability discovered by Nabil Irawan - Heroes Cyber Security in WordPress Plugin TrueBooker versions = 1.2.6...