24398 matches found
CVE-2026-66628 WordPress WP-Lister Lite for eBay plugin <= 3.8.11 - SQL Injection vulnerability
Shop manager SQL Injection in WP-Lister Lite for eBay = 3.8.11 versions...
CVE-2026-66628 WordPress WP-Lister Lite for eBay plugin <= 3.8.11 - SQL Injection vulnerability
Shop manager SQL Injection in WP-Lister Lite for eBay = 3.8.11 versions...
CVE-2026-66618 WordPress WP Maps plugin <= 4.9.9 - SQL Injection vulnerability
Administrator SQL Injection in WP Maps = 4.9.9 versions...
EUVD-2026-81504
Administrator SQL Injection in WP Maps = 4.9.9 versions...
CVE-2026-66618 WordPress WP Maps plugin <= 4.9.9 - SQL Injection vulnerability
Administrator SQL Injection in WP Maps = 4.9.9 versions...
CVE-2026-66618
CVE-2026-66618 is an Administrator-level SQL Injection vulnerability in the WP Maps WordPress plugin, affecting versions 4.9.9 and below . The flaw was discovered by Ananda Dhakal (Patchstack) and carries a CVSS 3.1 score of 7.6 (HIGH) , with a vector of AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L , indi...
WordPress WP Maps plugin <= 4.9.9 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Maps versions = 4.9.9...
WordPress WP-Lister Lite for eBay plugin <= 3.8.11 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP-Lister Lite for eBay versions = 3.8.11...
WordPress JWT Authentication for WP REST APIs plugin <= 4.7.0 - Unauthenticated Authentication Method Downgrade vulnerability
Unauthenticated Authentication Method Downgrade vulnerability discovered by Choriyev Qahramon in WordPress Plugin WordPress REST API Authentication versions = 4.7.0...
CVE-2026-89064
The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110. This is due to the Ai1wmMainController::init method — registered on the admininit hook, which fires unauthenticated on admin-ajax.php and...
CVE-2026-89064 All-in-One WP Migration and Backup <= 7.110 - Unauthenticated Insufficient Credential Protection via Authorization Basic Header
The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110. This is due to the Ai1wmMainController::init method — registered on the admininit hook, which fires unauthenticated on admin-ajax.php and...
EUVD-2026-81315
The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110. This is due to the Ai1wmMainController::init method — registered on the admininit hook, which fires unauthenticated on admin-ajax.php and...
CVE-2026-89064 All-in-One WP Migration and Backup <= 7.110 - Unauthenticated Insufficient Credential Protection via Authorization Basic Header
The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110. This is due to the Ai1wmMainController::init method — registered on the admininit hook, which fires unauthenticated on admin-ajax.php and...
CVE-2026-89064
All-in-One WP Migration and Backup for WordPress (≤ 7.110 ) contains an unauthenticated Insufficient Credential Protection flaw discovered by Jakub Herman. The Ai1wm_Main_Controller::init() method, registered on the admin_init hook, reads $_SERVER['PHP_AUTH_USER'] and $_SERVER['PHP_AUTH_PW'] from...
PT-2026-94157
Name of the Vulnerable Software and Affected Versions Paid Downloads versions prior to 3.16 Description The Paid Downloads plugin for WordPress allows unauthenticated arbitrary file upload through the admin request handler function. This occurs because the function lacks proper authorization and...
CVE-2026-89064: Insufficiently Protected Credentials
The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110. This is due to the Ai1wmMainController::init method — registered on the admininit hook, which fires unauthenticated on admin-ajax.php and...
CVE-2026-66628: Improper Neutralization of Special Elements used in an SQL Command
Shop manager SQL Injection in WP-Lister Lite for eBay = 3.8.11 versions...
PT-2026-94137
Name of the Vulnerable Software and Affected Versions All-in-One WP Migration and Backup versions prior to 7.111 Description The plugin contains an issue related to insufficient credential protection. The Ai1wm Main Controller::init function, which is registered on the admin init hook and execute...