278211 matches found
CVE-2026-3835 Prevent Direct Access – Protect WordPress Files <= 2.8.8.8 - Unauthenticated Protected File Access
The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token validation in the getadvancefilebyurl method in all versions up to, and including, 2.8.8.8 The method uses a SQL LIKE operator for token looku...
CVE-2026-3835
The CVE covers the WordPress plugin Prevent Direct Access – Protect WordPress Files. All versions up to 2.8.8.8 are affected due to insufficient token validation in get_advance_file_by_url(), which uses a SQL LIKE without escaping wildcards via $wpdb->esc_like(). This allows unauthenticated us...
PT-2026-71519
Subscriber Privilege Escalation in Service Finder Booking = 6.2 versions...
PT-2026-71508
Unauthenticated Cross Site Scripting XSS in Maspik – Spam blacklist = 2.9.1 versions...
PT-2026-71577
Unauthenticated SQL Injection in Everest Backup = 2.3.12 versions...
PT-2026-71525
Unauthenticated PHP Object Injection in Booking Activities = 1.18.4 versions...
PT-2026-71576
Subscriber Cross Site Scripting XSS in Accordion = 3.0.6 versions...
PT-2026-71528
Subscriber SQL Injection in Form Maker by 10Web = 1.15.44 versions...
PT-2026-71583
Unauthenticated Local File Inclusion in Biagiotti Core = 2.1.1 versions...
PT-2026-71534
Unauthenticated Cross Site Scripting XSS in WP Full Stripe Free = 8.5.0 versions...
PT-2026-71563
Subscriber Cross Site Scripting XSS in Profile Extra Fields by BestWebSoft = 1.3.4 versions...
PT-2026-71522
Customer Arbitrary Content Deletion in WP Event SOlution = 4.1.19 versions...
PT-2026-71544
Unauthenticated Broken Access Control in WPMobile.App = 11.77 versions...
PT-2026-71557
Subscriber SQL Injection in If-So Dynamic Content Personalization = 1.10 versions...
PT-2026-71539
Unauthenticated SQL Injection in Listdom = 5.6.0 versions...
PT-2026-71599
Contributor Cross Site Scripting XSS in Featured Image from URL = 5.3.3 versions...
PT-2026-71502
Unauthenticated Cross Site Scripting XSS in Welcart e-Commerce = 2.11.31 versions...
PT-2026-71523
Customer Sensitive Data Exposure in WP Event SOlution = 4.1.18 versions...