277079 matches found
EUVD-2026-58589
The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via Insufficient Verification of Data Authenticity in versions up to and including 3.34.1. This is due to the wpmregister function validating the registration cookie only against the GET reg parameter while accepting the...
CVE-2026-12949
The CVE concerns the Wishlist Member plugin for WordPress, affected in versions up to 3.34.1. The vulnerability arises in wpm_register() where the registration cookie is only validated against the GET reg parameter while POST mergewith and POST wpm_id are accepted without verifying that the refer...
CVE-2025-10308
The Astro Booking Engine plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.0. This is due to missing nonce validation on the options deletion functionality. This makes it possible for unauthenticated attackers to delete all plugin settings...
CVE-2025-10308
The Astro Booking Engine WordPress plugin is affected by a CSRF (Cross-Site Request Forgery) vulnerability in all versions up to 1.4.0, caused by missing nonce validation on the options deletion function. This allows unauthenticated attackers to delete all plugin settings by tricking a site admin...
EUVD-2025-210726
The Astro Booking Engine plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.0. This is due to missing nonce validation on the options deletion functionality. This makes it possible for unauthenticated attackers to delete all plugin settings...
CVE-2025-10308 Astro Booking Engine <= 1.4.0 - Cross-Site Request Forgery to Settings Reset
The Astro Booking Engine plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.0. This is due to missing nonce validation on the options deletion functionality. This makes it possible for unauthenticated attackers to delete all plugin settings...
CVE-2026-18109
The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 2.10.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...
CVE-2026-18109
The CVE-2026-18109 entry concerns the W3 Total Cache WordPress plugin. A Stored Cross-Site Scripting vulnerability exists in all versions up to and including 2.10.3 due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject scripts that execute when u...
EUVD-2026-58570
The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 2.10.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...
PT-2026-71971
The WP-Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.56 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute...
VulnCheck KEV: CVE-2026-18109
The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 2.10.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...
Divi 5.0 - 5.8.1 - Contributor+ Stored XSS via Social Media Follow Skype URL
Description The theme does not properly escape some of its Social Media Follow module settings before outputting them in link attributes, allowing users with a role as low as contributor to store JavaScript which will run when a higher privileged user, such as an administrator, views the post...
6Storage Rentals < 2.29.0 - Unauthenticated Account Takeover via 'email' Parameter
Description The 6Storage Rentals plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.28.0 This is due to the sixstoragecreatewpuser AJAX handler being registered on wpajaxnoprivsixstoragecreatewpuser without any nonce, capability, credential, or ownersh...
PT-2026-71974
Name of the Vulnerable Software and Affected Versions WordPress versions prior to 7.0.4 Description An authenticated user with Author level privileges or higher can achieve remote code execution by uploading a malicious Postscript file. This issue occurs when the server utilizes Imagick and...
xss2shell-pro
XSS2Shell PRO v4.0 — WordPress XSS→RCE Automated Testing Platf...
CVE-2026-28154
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in snstheme Samex - Clean, Minimal Shop WooCommerce WordPress Theme and snstheme M.Anh - Fashion WooCoommerce WordPress Theme allows Reflected XSS. This issue affects Samex - Clean, Minimal Shop...
CVE-2026-28154
CVE-2026-28154 concerns reflected Cross-Site Scripting (XSS) in two WordPress themes: Samex - Clean, Minimal Shop WooCommerce Theme (affected up to version 2.5) and M.Anh - Fashion WooCommerce Theme (affected up to version 1.7). The issue arises from improper input neutralization during web page ...
EUVD-2026-58084
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in snstheme Samex - Clean, Minimal Shop WooCommerce WordPress Theme and snstheme M.Anh - Fashion WooCoommerce WordPress Theme allows Reflected XSS. This issue affects Samex - Clean, Minimal Shop...
CVE-2026-28154 WordPress Samex and M.Anh WordPress themes affected by Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in snstheme Samex - Clean, Minimal Shop WooCommerce WordPress Theme and snstheme M.Anh - Fashion WooCoommerce WordPress Theme allows Reflected XSS. This issue affects Samex - Clean, Minimal Shop...