Lucene search
+L

276841 matches found

EUVD
EUVD
added 2026/08/16 4:24 a.m.25 views

EUVD-2026-59852

The Query Wrangler plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.57 via the 'options' parameter parameter. This is due to missing capability check and nonce verification on the wpajaxqwformajax handler, combined with unsanitized...

8.8CVSS5.8AI score0.00534EPSS
SaveExploits0References6
Cvelist
Cvelist
added 2026/08/16 4:24 a.m.48 views

CVE-2026-18385 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.19 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via First Name / Last Name Profile Field

The The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.16.19. This is due to the software allowing users to execute an...

5.4CVSS0.00309EPSS
SaveExploits0References10
Vulnrichment
Vulnrichment
added 2026/08/16 4:24 a.m.5 views

CVE-2026-18432 Frontend Admin by DynamiApps <= 3.29.9 - Unauthenticated Privilege Escalation via 'item_id' Parameter

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because ActionUser::conditionslogic gates the currentusercan'edituser', $userid authorization check behind an isnumeric test, causing...

9.8CVSS5.4AI score0.0051EPSS
SaveExploits0References12
EUVD
EUVD
added 2026/08/16 4:24 a.m.11 views

EUVD-2026-59849

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because ActionUser::conditionslogic gates the currentusercan'edituser', $userid authorization check behind an isnumeric test, causing...

9.8CVSS5.4AI score0.0051EPSS
SaveExploits0References12
CVE
CVE
added 2026/08/16 4:24 a.m.50 views

CVE-2026-18432

CVE-2026-18432 affects the Frontend Admin by DynamiApps plugin for WordPress (≤ 3.29.9). The flaw stems from ActionUser::conditions_logic() gating the current_user_can('edit_user', $user_id) check behind is_numeric(), so a non-numeric string (e.g., 1one) can bypass authorization when supplied via...

9.8CVSS5.4AI score0.0051EPSS
SaveExploits0References12
Cvelist
Cvelist
added 2026/08/16 4:24 a.m.38 views

CVE-2026-12905 Online Scheduling and Appointment Booking System – Bookly <= 27.7 - Authenticated (Staff+) Insecure Direct Object Reference to Sensitive Information Exposure via 'params[id]' Parameter

The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 27.7 via the appointment method of the Mobile Staff Cabinet API resource=appointment, action=booklymobilestaffcabinet in...

4.3CVSS0.0029EPSS
SaveExploits0References8
Cvelist
Cvelist
added 2026/08/16 4:24 a.m.43 views

CVE-2026-18432 Frontend Admin by DynamiApps <= 3.29.9 - Unauthenticated Privilege Escalation via 'item_id' Parameter

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because ActionUser::conditionslogic gates the currentusercan'edituser', $userid authorization check behind an isnumeric test, causing...

9.8CVSS0.0051EPSS
SaveExploits0References12
NVD
NVD
added 2026/08/16 4:16 a.m.11 views

CVE-2026-2487

The Admin Custom Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

4.4CVSS0.00203EPSS
SaveExploits0References6
EUVD
EUVD
added 2026/08/16 3:24 a.m.8 views

EUVD-2026-59847

The Admin Custom Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

4.4CVSS5.5AI score0.00203EPSS
SaveExploits0References6
Cvelist
Cvelist
added 2026/08/16 3:24 a.m.43 views

CVE-2026-2487 Admin Custom Login <= 3.6.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Message Above Login Form' Setting

The Admin Custom Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

4.4CVSS0.00203EPSS
SaveExploits0References6
ATTACKERKB
ATTACKERKB
added 2026/08/16 3:24 a.m.16 views

CVE-2026-2487

The Admin Custom Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

4.4CVSS5.5AI score0.00203EPSS
SaveExploits0References7
CVE
CVE
added 2026/08/16 3:24 a.m.45 views

CVE-2026-2487

CVE-2026-2487 concerns the WordPress plugin “Admin Custom Login.” The vulnerability is a Stored Cross-Site Scripting (XSS) flaw in admin settings, affecting all versions up to and including 3.6.4. The root cause is insufficient input sanitization and output escaping, allowing an authenticated att...

4.4CVSS5.5AI score0.00203EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
added 2026/08/16 12:00 a.m.44 views

PT-2026-73088

The Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'soundFile' parameter in all versions up to, and including, 5.4.12 due to insufficient input sanitization and output escaping. Th...

6.1CVSS5.5AI score0.0028EPSS
SaveExploits0References9
Positive Technologies
Positive Technologies
added 2026/08/16 12:00 a.m.18 views

PT-2026-73085

The Query Wrangler plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.57 via the 'options' parameter parameter. This is due to missing capability check and nonce verification on the wp ajax qw form ajax handler, combined with unsanitized...

8.8CVSS5.8AI score0.00534EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/08/16 12:00 a.m.16 views

PT-2026-73098

The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1064 via the Form Builder widget's 'webhook url' setting. The widget's render method persists the attacker-controlled URL into the wpr webhook url widget id option on...

8.8CVSS5.6AI score0.00345EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
added 2026/08/16 12:00 a.m.23 views

PT-2026-73134

The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.10.09. This is due to missing or incorrect nonce validation on the top-level template code function. This makes it possible for...

6.5CVSS5.6AI score0.00156EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
added 2026/08/16 12:00 a.m.17 views

PT-2026-73082

The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 27.7 via the appointment method of the Mobile Staff Cabinet API resource=appointment, action=bookly mobile staff cabinet in frontend/modules/mobile staff cabinet/api/handlers/Handle...

4.3CVSS5.3AI score0.0029EPSS
SaveExploits0References9
Positive Technologies
Positive Technologies
added 2026/08/16 12:00 a.m.22 views

PT-2026-73080

The Quiz and Survey Master QSM – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'question title' parameter in all versions up to, and including, 11.2.1 due to insufficient input sanitization and output escaping. This makes it possible for...

6.4CVSS5.5AI score0.00298EPSS
SaveExploits0References12
Positive Technologies
Positive Technologies
added 2026/08/16 12:00 a.m.18 views

PT-2026-73083

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.5.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This...

4.3CVSS5.5AI score0.00346EPSS
SaveExploits0References13
Positive Technologies
Positive Technologies
added 2026/08/16 12:00 a.m.17 views

PT-2026-73129

The Infility Global plugin for WordPress is vulnerable to Stored Cross-Site Scripting via /cf7 record Log Endpoint in all versions up to, and including, 2.15.21 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

7.2CVSS5.6AI score0.00254EPSS
SaveExploits0References6
Rows per page
Query Builder