278367 matches found
WordPress Ultra Addons for Contact Form 7 plugin <= 3.5.43 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Webbernaut in WordPress Plugin Ultimate Addons for Contact Form 7 versions = 3.5.43...
CVE-2026-3430
The Creative Mail WordPress plugin from 1.6.5 to 1.6.9 does not sanitize and escape a parameter before using in an SQL statement, leading to an unauthenticated SQL injection when the abandoned cart email is managed by creative mail...
CVE-2026-66705
Unauthenticated Cross Site Scripting XSS in Facebook for WordPress = 5.2.1 versions...
CVE-2026-66447
Unauthenticated SQL Injection in WordPress File Upload = 5.1.7 versions...
CVE-2026-66663
Unauthenticated Cross Site Scripting XSS in WP Data Access = 5.5.79 versions...
CVE-2026-65569
Subscriber SQL Injection in WP Job Portal = 2.5.6 versions...
CVE-2026-65553
Unauthenticated Remote Code Execution RCE in Spider Analyser WordPress搜索引擎蜘蛛分析插件 = 2.1.3 versions...
CVE-2026-65509
Unauthenticated Cross Site Scripting XSS in wpDataTables = 7.5.1 versions...
CVE-2026-65520
Unauthenticated SQL Injection in WP OAuth Server = 6.2.0 versions...
CVE-2026-61982
Unauthenticated Cross Site Scripting XSS in SiteGuard WP Plugin = 1.8.6 versions...
CVE-2026-32469
Unauthenticated Bypass Vulnerability in CAPTCHA 4WP = 7.6.0 versions...
CVE-2026-15246
The RealHomes Memberships WordPress plugin before 3.1.0 does not verify that a membership payment actually completed, nor check a nonce or the user's capability, before granting a paid membership package, allowing any authenticated user such as a Subscriber to obtain paid membership packages...
EUVD-2026-54088
The Creative Mail WordPress plugin from 1.6.5 to 1.6.9 does not sanitize and escape a parameter before using in an SQL statement, leading to an unauthenticated SQL injection when the abandoned cart email is managed by creative mail...
CVE-2026-3430 Creative Mail 1.6.5 - 1.6.9 - Unauthenticated SQLi
The Creative Mail WordPress plugin from 1.6.5 to 1.6.9 does not sanitize and escape a parameter before using in an SQL statement, leading to an unauthenticated SQL injection when the abandoned cart email is managed by creative mail...
CVE-2026-3430
CVE-2026-3430 affects the Creative Mail WordPress plugin versions 1.6.5–1.6.9. The issue is an unauthenticated SQL injection caused by not sanitizing/escaping a parameter before use in an SQL statement when handling abandoned cart emails. CVSS 3.1 metrics (from WPScan) indicate NETWORK attack vec...
CVE-2026-66711 WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.5.6 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting XSS in WooCommerce Multilingual & Multicurrency = 5.5.6 versions...
CVE-2026-66711
CVE-2026-66711 concerns a Cross Site Scripting (XSS) vulnerability in the WordPress plugin WooCommerce Multilingual & Multicurrency, affecting versions up to and including 5.5.6. The connected documents confirm the affected product and the XSS vulnerability type but do not provide technical explo...
CVE-2026-66710 WordPress e2pdf plugin <= 1.32.40 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in e2pdf = 1.32.40 versions...