24331 matches found
CVE-2026-75823
The User Frontend WordPress plugin (versions 3.5.29 through 4.3.11 ) contains a vulnerability allowing unauthenticated privilege escalation . The root cause is a failure to prevent tampering with the role assigned by the plugin's registration form. This specifically affects installations where a ...
CVE-2026-75824 WP User Frontend 2.5.8 - 4.3.11 - Unauthenticated Account Creation with Registration Disabled
The User Frontend WordPress plugin before 4.3.12 does not check whether the site allows user registration before creating an account, allowing unauthenticated users to create accounts on sites where registration is disabled. The created account receives the site's default role...
CVE-2026-75824
The User Frontend WordPress plugin, in versions before 4.3.12 , contains a vulnerability where it fails to verify if a site allows user registration before processing account creation. This allows unauthenticated users to create accounts on sites where registration is explicitly disabled. Any acc...
CVE-2026-94681: Allocation of Resources Without Limits or Throttling
Unauthenticated Denial of Service Attack in WP Store Locator 3.0.0 versions...
CVE-2026-96343: Deserialization of Untrusted Data
Custom role PHP Object Injection in WP ERP = 1.17.9 versions...
PT-2026-103188
Custom role PHP Object Injection in WP ERP = 1.17.9 versions...
PT-2026-103141
Subscriber Cross Site Scripting XSS in WP Photo Album Plus = 9.3.02.003 versions...
CVE-2026-97291: Deserialization of Untrusted Data
Contributor PHP Object Injection in Schema & Structured Data for WP & AMP = 1.66 versions...
CVE-2026-82127: Improper Neutralization of Input During Web Page Generation
The Schema & Structured Data for WP & AMP WordPress plugin before 1.67 does not perform a capability check when saving several of its fields, nor escape them when outputting them back, allowing users with the editor role and above to inject arbitrary web scripts that execute when a higher...
PT-2026-103160
Unauthenticated Cross Site Scripting XSS in WP Statistics = 14.16.13 versions...
PT-2026-103210
Subscriber Bypass Vulnerability in All In One WP Security & Firewall = 5.4.8 versions...
PT-2026-103299
Authorization Bypass Through User-Controlled Key vulnerability in WP Hosting AS Pay with Vipps for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pay with Vipps for WooCommerce: from n/a through 6.2.4...
PT-2026-103100
Name of the Vulnerable Software and Affected Versions Real Estate Manager – Property Listing and Agent Management versions prior to 7.4 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access a...
CVE-2026-93621: Improper Neutralization of Special Elements used in an SQL Command
Unauthenticated SQL Injection in WP Data Access = 5.5.84 versions...
PT-2026-103183
Unauthenticated Denial of Service Attack in WP Store Locator 3.0.0 versions...
PT-2026-103026
The Schema & Structured Data for WP & AMP WordPress plugin before 1.67 does not perform a capability check when saving several of its fields, nor escape them when outputting them back, allowing users with the editor role and above to inject arbitrary web scripts that execute when a higher...
PT-2026-103154
Administrator SQL Injection in WP Activity Log = 5.6.6 versions...
CVE-2026-96818: Missing Authorization
Unauthenticated Broken Access Control in WP Express Checkout Accept PayPal Payments = 2.4.9 versions...