24398 matches found
PT-2026-95344
Name of the Vulnerable Software and Affected Versions WP Recipe Maker versions prior to 10.8.2 Description Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access and above to perform Stored Cross-Site Scripting. This is achieved by injectin...
PT-2026-95282
Name of the Vulnerable Software and Affected Versions Mapster WP Maps versions prior to 1.23.1 Description The plugin contains an Arbitrary User Meta Write flaw within the my profile update function. The issue occurs because the function fails to perform nonce verification, capability checks, and...
CVE-2026-81810: Improper Privilege Management
The All-in-One WP Migration and Backup WordPress plugin before 7.111 does not perform any capability check on several of its AJAX actions, gating them only on an installation-wide secret which it discloses to any user permitted to export the site, allowing such a user to import an arbitrary site...
PT-2026-95260
Name of the Vulnerable Software and Affected Versions Hide My WP Ghost versions prior to 7.0.11 Description An issue exists where the plugin fails to properly validate loopback security-check requests. When a request's verification value is missing or incorrect, the plugin disables its login and...
PT-2026-95290
Name of the Vulnerable Software and Affected Versions WP Inventory Manager versions prior to 2.5.2 Description Authenticated attackers with Contributor-level access and above can perform SQL Injection through the where shortcode attribute of the wpinventory shortcode. The issue occurs in the...
CVE-2026-86800: Protection Mechanism Failure
The Hide My WP Ghost WordPress plugin before 7.0.11 does not properly validate a loopback security-check request before disabling its login and URL hiding protection, dropping that protection precisely when the request's verification value is missing or incorrect, which any visitor can arrange,...
CVE-2026-87915: Improper Neutralization of Input During Web Page Generation
The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via valuesName Parameter in all versions up to, and including, 1.24.0 due to insufficient input sanitization and output escaping. Th...
CVE-2026-15275: Improper Neutralization of Special Elements used in an SQL Command
The WP Multi Store Locator Pro plugin for WordPress is vulnerable to generic SQL Injection via the 'storelocatoresearchradius' parameter in all versions up to, and including, 4.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...
WordPress WP Recipe Maker plugin <= 10.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Saulo Rafael miquinho miquinho in WordPress Plugin WP Recipe Maker versions = 10.8.1...
WordPress WP Easy Pay – Payment and Donation Form Builder for Square plugin <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion vulnerability
Missing Authorization to Authenticated Subscriber+ Arbitrary Post Deletion vulnerability discovered by Wordfence PRISM in WordPress Plugin WP EasyPay versions = 4.5.0...
WordPress WP Events Manager plugin < 2.2.5 - Unauthenticated Payment Bypass and Booking Status Update via IDOR vulnerability
Unauthenticated Payment Bypass and Booking Status Update via IDOR vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin WP Events Manager versions 2.2.5...
CVE-2026-90887
Unauthenticated Cross Site Scripting XSS in WP Inventory Manager = 2.5.4 versions...
CVE-2026-66628
Shop manager SQL Injection in WP-Lister Lite for eBay = 3.8.11 versions...
CVE-2026-66618
Administrator SQL Injection in WP Maps = 4.9.9 versions...
EUVD-2026-81521
Unauthenticated Cross Site Scripting XSS in WP Inventory Manager = 2.5.4 versions...
CVE-2026-90887 WordPress WP Inventory Manager plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in WP Inventory Manager = 2.5.4 versions...
CVE-2026-90887 WordPress WP Inventory Manager plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in WP Inventory Manager = 2.5.4 versions...
CVE-2026-90887
WP Inventory Manager (WordPress plugin, versions