278661 matches found
EUVD-2026-53702
The FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Recipient Display Name to.name in Email Logs in all versions up to, and including, 2.2.95 due to insufficient input...
CVE-2026-16636 FluentSMTP <= 2.2.95 - Unauthenticated Stored Cross-Site Scripting via Recipient Display Name (to.name) in Email Logs
The FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Recipient Display Name to.name in Email Logs in all versions up to, and including, 2.2.95 due to insufficient input...
PT-2026-68882
Name of the Vulnerable Software and Affected Versions WordPress affected versions not specified Description WordPress is subject to a pre-authentication reflected cross-site scripting XSS issue on the login screen. This allows an attacker to execute arbitrary JavaScript in the site origin without...
WP < 7.0.3 - Subscriber+ Email Change Confirmation Bypass
Description WordPress does not always validate a new email address consistently when a profile is updated, which could allow any authenticated user to change their account email address without completing the ownership confirmation step...
PT-2026-68591
Name of the Vulnerable Software and Affected Versions Thrive Architect versions prior to 10.9.3.2 Description Unauthenticated Cross Site Scripting XSS allows an attacker to execute malicious scripts in the browser of a user without requiring authentication. Recommendations Update Thrive Architect...
NPM: Nuxt: Unauthorized Component Instantiation via Server Island Props
NPM: Nuxt: Unauthorized Component Instantiation via Server Island Props vulnerability discovered by ? in WordPress Npm nuxt versions = 3.1.0, 3.21.10...
Exploit for Interpretation Conflict in Wordpress
wp2shell — WordPress Core Pre-Auth RCE CVE-2026-63030 Ba...
NPM: Electron: Sandboxed iframes can launch external protocol handlers
NPM: Electron: Sandboxed iframes can launch external protocol handlers vulnerability discovered by ? in WordPress Npm electron versions 39.8.8...
NPM: Electron: contextBridge object copy honors prototype setters
NPM: Electron: contextBridge object copy honors prototype setters vulnerability discovered by ? in WordPress Npm electron versions 39.8.9...
NPM: Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path
NPM: Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path vulnerability discovered by ? in WordPress Npm electron versions 39.8.10...
WordPress Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider plugin <= 3.111.0 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability
Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by haofanjiukunle in WordPress Plugin Responsive Slider by MetaSlider versions = 3.111.0...
NPM: Electron: window.open features string controls some window options considered privileged
NPM: Electron: window.open features string controls some window options considered privileged vulnerability discovered by ? in WordPress Npm electron versions 39.8.8...
NPM: Electron: ProtocolResponse.url reuses the default session cache instead of the registering session
NPM: Electron: ProtocolResponse.url reuses the default session cache instead of the registering session vulnerability discovered by ? in WordPress Npm electron versions = 40.0.0-alpha.1, 40.10.6...
NPM: Electron: HTTP redirect followed into local file loader
NPM: Electron: HTTP redirect followed into local file loader vulnerability discovered by ? in WordPress Npm electron versions 39.8.8...
NPM: Electron: Extension tab APIs operate across session boundaries
NPM: Electron: Extension tab APIs operate across session boundaries vulnerability discovered by ? in WordPress Npm electron versions 39.8.8...
NPM: Electron: shell.openPath path validation bypass via embedded null byte
NPM: Electron: shell.openPath path validation bypass via embedded null byte vulnerability discovered by ? in WordPress Npm electron versions 39.8.6...
NPM: Electron: Context isolation bypass via Function.prototype.bind hijack
NPM: Electron: Context isolation bypass via Function.prototype.bind hijack vulnerability discovered by ? in WordPress Npm electron versions 39.8.9...
NPM: Electron: Cross-origin iframe can position native autofill popup
NPM: Electron: Cross-origin iframe can position native autofill popup vulnerability discovered by ? in WordPress Npm electron versions 39.8.8...
NPM: Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin
NPM: Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin vulnerability discovered by ? in WordPress Npm electron versions 39.8.7...
NPM: Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size
NPM: Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size vulnerability discovered by ? in WordPress Npm electron versions 39.8.10...