278213 matches found
PT-2026-71506
Unauthenticated SQL Injection in WP Directory Kit = 1.5.4 versions...
PT-2026-71531
Unauthenticated Cross Site Scripting XSS in Knowledge Base for Documentation, FAQs with AI Assistance = 17.211.0 versions...
CVE-2026-49466
Draft List is a WordPress plugin to manage and promote unpublished content. Versions 2.6.3 and below are vulnerable to stored Cross-Site Scripting XSS in the drafts shortcode and Draft List widget when the documented custom template option places the draft placeholder inside an HTML attribute. Th...
CVE-2026-49466 Draft List - Contributor Stored Cross-Site Scripting via Draft Title in Custom Drafts Template Attributes
Draft List is a WordPress plugin to manage and promote unpublished content. Versions 2.6.3 and below are vulnerable to stored Cross-Site Scripting XSS in the drafts shortcode and Draft List widget when the documented custom template option places the draft placeholder inside an HTML attribute. Th...
EUVD-2026-57514
Draft List is a WordPress plugin to manage and promote unpublished content. Versions 2.6.3 and below are vulnerable to stored Cross-Site Scripting XSS in the drafts shortcode and Draft List widget when the documented custom template option places the draft placeholder inside an HTML attribute. Th...
CVE-2026-49466
Draft List (WordPress plugin) versions
CVE-2026-49466
Draft List is a WordPress plugin to manage and promote unpublished content. Versions 2.6.3 and below are vulnerable to stored Cross-Site Scripting XSS in the drafts shortcode and Draft List widget when the documented custom template option places the draft placeholder inside an HTML attribute. Th...
CVE-2026-49466 Draft List - Contributor Stored Cross-Site Scripting via Draft Title in Custom Drafts Template Attributes
Draft List is a WordPress plugin to manage and promote unpublished content. Versions 2.6.3 and below are vulnerable to stored Cross-Site Scripting XSS in the drafts shortcode and Draft List widget when the documented custom template option places the draft placeholder inside an HTML attribute. Th...
WordPress Core <= 7.0.3 - Authenticated (Author+) File Type Confusion to Remote Code Execution vulnerability
Authenticated Author+ File Type Confusion to Remote Code Execution vulnerability discovered by pwn.ai in WordPress core versions = 7.0.3...
WordPress M.Anh theme <= 1.7 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme M.Anh versions = 1.7...
WordPress GiveWP plugin < 4.16.6 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Asim Alshaya in WordPress Plugin GiveWP versions 4.16.6...
WordPress Revolut Gateway for WooCommerce plugin < 4.22.10 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Lee chul woong in WordPress Plugin Revolut Gateway for WooCommerce versions 4.22.10...
CVE-2026-17008
The Quick Paypal Payments WordPress plugin through 5.7.50 does not verify the paid amount, receiver, or payment status in its PayPal IPN handler and marks an order paid on an order-token match alone, so a buyer who pays an arbitrary small amount can have a full-price order marked paid...
CVE-2026-16747
The Kirki WordPress plugin before 6.2.1 does not properly authorise its front-end form submission REST routes and passes attacker-controlled input through shortcode execution, allowing unauthenticated users to run any shortcode registered on the site, which on a default install leads to disclosur...
CVE-2026-16990
The Payment Button for PayPal WordPress plugin through 1.2.3.44 does not enforce the merchant-configured price server-side and trusts a client-supplied payment amount, allowing unauthenticated attackers to create a real PayPal order against the merchant for an arbitrary lower amount...
CVE-2026-18044
The Estatik Real Estate Plugin WordPress plugin before 4.3.4 does not validate the same recipient list that it later uses to address the message sent by its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To on...
CVE-2026-15213
The Welcart e-Commerce WordPress plugin before 2.11.33 does not verify the authenticity of its convenience-store / bank-transfer settlement callback: an unauthenticated request can flip an order from unpaid to settled purely from an order number and a status flag, with no signature, amount, or...
WordPress Web Directory Free plugin <= 1.7.13 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Taylsec in WordPress Plugin Web Directory Free versions = 1.7.13...
WordPress Car Rental Manager plugin <= 1.3.9 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Phat RiO in WordPress Plugin Car Rental Manager versions = 1.3.9...