278533 matches found
CVE-2026-28178 WordPress Powerkit plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in Powerkit = 3.1.0 versions...
CVE-2026-28177 WordPress Popup Maker plugin <= 1.23.0 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Popup Maker = 1.23.0 versions...
CVE-2026-28172
The CVE-2026-28172 entry concerns the WordPress Tracking Code Manager plugin versions up to 2.6.0, with an unauthenticated CSRF vulnerability. CVE records also describe this as CSRF that can lead to stored XSS (as noted in CVE-List entry). Affected component: Tracking Code Manager plugin; vulnera...
CVE-2026-28169
CVE-2026-28169 concerns unauthenticated sensitive data exposure in the WordPress plugin YITH WooCommerce Zoom Magnifier (versions
CVE-2026-28172 WordPress Tracking Code Manager plugin <= 2.6.0 - CSRF to Stored XSS vulnerability
Unauthenticated Cross Site Request Forgery CSRF in Tracking Code Manager = 2.6.0 versions...
CVE-2026-28146 WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.14 - Arbitrary File Download vulnerability
Contributor Arbitrary File Download in Unlimited Elements For Elementor Free Widgets, Addons, Templates = 2.0.14 versions...
CVE-2026-28146
CVE-2026-28146 is about an Arbitrary File Download vulnerability in the WordPress plugin Unlimited Elements For Elementor (Free Widgets, Addons, Templates) , affecting versions up to and including 2.0.14. The connected reports identify the affected product and vulnerability type but do not provid...
CVE-2026-28143 WordPress Forminator plugin <= 1.56.0 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Forminator = 1.56.0 versions...
CVE-2026-28143
Forminator plugin for WordPress is affected by CVE-2026-28143: unauthenticated XSS in versions up to and including 1.56.0. The vulnerability arises in the plugin code path handling input that can be crafted by an attacker without authentication. Impact, as described in the sources, is Cross Site ...
CVE-2026-28141 WordPress NextGEN Gallery plugin <= 4.2.3 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in NextGEN Gallery = 4.2.3 versions...
CVE-2026-28140 WordPress JetFormBuilder plugin <= 3.6.4.1 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in JetFormBuilder = 3.6.4.1 versions...
CVE-2026-28140
CVE-2026-28140 affects the WordPress JetFormBuilder plugin (versions ≤ 3.6.4.1). The vulnerability is an unauthenticated Broken Access Control, with an impact stated as high in the CVSS metrics (I=HIGH, C=NONE, A=NONE) while no confidentiality impact and no availability impact. The available docu...
CVE-2026-28139
CVE-2026-28139 concerns the WordPress plugin Ajax Search Lite (vulnerable: ≤ 4.14.4). The issue is an unauthenticated PHP Object Injection in the plugin’s handling of objects, as described in CVE details and corroborated by multiple feeds. Affected component: the Ajax Search Lite plugin; root cau...
CVE-2026-28111
CVE-2026-28111 affects the WordPress Forminator plugin up to version 1.56.0. The vulnerability is a contributor privilege escalation, with CVSSv3.1 metrics indicating high impact (C/H, I/H, A/H) and network attack vector with low complexity and low privileges required. Connected sources confirm t...
CVE-2026-28111 WordPress Forminator plugin <= 1.56.0 - Privilege Escalation vulnerability
Contributor Privilege Escalation in Forminator = 1.56.0 versions...
CVE-2026-28082
CVE-2026-28082 affects the WordPress JetEngine plugin up to version 3.8.13.1, describing an unauthenticated Cross Site Scripting (XSS) vulnerability. The connected sources confirm the vulnerability existence and affected product/version but do not provide concrete technical details such as the ex...
CVE-2026-28082 WordPress JetEngine plugin <= 3.8.13.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in JetEngine = 3.8.13.1 versions...
CVE-2026-28005 WordPress Kadence WooCommerce Email Designer plugin <= 1.5.19 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Kadence WooCommerce Email Designer = 1.5.19 versions...