24328 matches found
CVE-2026-90972: Improper Access Control
The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers, allowing any authenticated subscriber to read other users' email addresses and to trigger a cross-user CRM re-sync...
PT-2026-103715
Name of the Vulnerable Software and Affected Versions ByteCoreStack – MCP Connector for AI Tools versions prior to 1.2.4 Description Authenticated users with Subscriber-level access or higher can elevate their privileges to Administrator. The issue exists in the execute tool function within the w...
PT-2026-103770
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'postdata-1post-custom' Parameter in all versions up to, and including, 1.57.2 due to insufficient input sanitization and output escaping. This makes it...
PT-2026-103666
Name of the Vulnerable Software and Affected Versions Simply Schedule Appointments versions prior to 1.6.12.33 Description An issue exists that allows unauthenticated attackers to extract customer personally identifiable information PII, such as names, email addresses, phone numbers, and custom...
PT-2026-103893
Subscriber Broken Access Control in WP Project Manager = 4.0.7 versions...
CVE-2026-103336: Insertion of Sensitive Information Into Sent Data
Insertion of Sensitive Information Into Sent Data vulnerability in Smackcoders Inc. WP Ultimate CSV Importer wp-ultimate-csv-importer allows Retrieve Embedded Sensitive Data.This issue affects WP Ultimate CSV Importer: from n/a through 9.1...
CVE-2026-97291
Contributor PHP Object Injection in Schema & Structured Data for WP & AMP = 1.66 versions...
CVE-2026-97291 WordPress Schema & Structured Data for WP & AMP plugin <= 1.66 - PHP Object Injection vulnerability
Contributor PHP Object Injection in Schema & Structured Data for WP & AMP = 1.66 versions...
CVE-2026-97291
The Schema & Structured Data for WP & AMP plugin for WordPress, versions
CVE-2026-97291 WordPress Schema & Structured Data for WP & AMP plugin <= 1.66 - PHP Object Injection vulnerability
Contributor PHP Object Injection in Schema & Structured Data for WP & AMP = 1.66 versions...
EUVD-2026-90218
Contributor PHP Object Injection in Schema & Structured Data for WP & AMP = 1.66 versions...
WordPress User Frontend plugin 2.5.8-4.3.11 - Unauthenticated Account Creation with Registration Disabled vulnerability
Unauthenticated Account Creation with Registration Disabled vulnerability discovered by Murad Akhmedov in WordPress Plugin WP User Frontend versions 2.5.8-4.3.11...
CVE-2026-96825
Subscriber Bypass Vulnerability in All In One WP Security & Firewall = 5.4.8 versions...
CVE-2026-96818
Unauthenticated Broken Access Control in WP Express Checkout Accept PayPal Payments = 2.4.9 versions...
CVE-2026-96343
Custom role PHP Object Injection in WP ERP = 1.17.9 versions...
CVE-2026-96346
Author SQL Injection in WP ERP = 1.17.9 versions...
CVE-2026-94681
Unauthenticated Denial of Service Attack in WP Store Locator 3.0.0 versions...
CVE-2026-93621
Unauthenticated SQL Injection in WP Data Access = 5.5.84 versions...