24430 matches found
PT-2026-90600
šØ CVE-2026-85200 The GEO my WP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.5.5.3 via the gmw posts locator ajax info window loader function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on t...
CVE-2026-85200: Improper Control of Filename for Include/Require Statement in PHP Program
The GEO my WP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.5.5.3 via the gmwpostslocatorajaxinfowindowloader function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the...
CVE-2026-84171: Unrestricted Upload of File with Dangerous Type
The WP images upload on piclect WordPress plugin through 1.0 does not validate the name or type of uploaded files before writing them to a publicly accessible directory, allowing unauthenticated attackers to upload arbitrary files and execute arbitrary code on the server...
WordPress GEO my WP plugin <= 4.5.5.3 - Unauthenticated Local File Inclusion vulnerability
Unauthenticated Local File Inclusion vulnerability discovered by yck in WordPress Plugin GEO my WordPress versions = 4.5.5.3...
WordPress WP-Members Membership Plugin plugin <= 3.5.6 - Reflected Cross-Site Scripting vulnerability
Reflected Cross-Site Scripting vulnerability discovered by Kuba in WordPress Plugin WP-Members versions = 3.5.6...
WordPress WP Express Checkout plugin < 2.4.9 - Unauthenticated Payment Bypass via wpec_process_payment vulnerability
Unauthenticated Payment Bypass via wpecprocesspayment vulnerability discovered by Amity Gilmour in WordPress Plugin WP Express Checkout Accept PayPal Payments versions 2.4.9...
WordPress WP Photo Album Plus plugin <= 9.2.08.003 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Jonah Burgess CryptoCat in WordPress Plugin WP Photo Album Plus versions = 9.2.08.003...
CVE-2026-84960
The WP-Members Membership Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL Query String in all versions up to, and including, 3.5.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitra...
CVE-2026-84960 WP-Members Membership Plugin <= 3.5.6 - Reflected Cross-Site Scripting
The WP-Members Membership Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL Query String in all versions up to, and including, 3.5.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitra...
EUVD-2026-75933
The WP-Members Membership Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL Query String in all versions up to, and including, 3.5.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitra...
CVE-2026-84960 WP-Members Membership Plugin <= 3.5.6 - Reflected Cross-Site Scripting
The WP-Members Membership Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL Query String in all versions up to, and including, 3.5.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitra...
CVE-2026-84960
The WP-Members Membership Plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) via the URL query string in all versions up to and including 3.5.6 . The root cause is insufficient input sanitization and output escaping in the plugin's forms component. An unauthenticated attac...
CVE-2026-18579
WP Photo Album Plus (WordPress plugin) versions up to and including 9.2.08.003 are vulnerable to unauthenticated Stored XSS via the HTTP_X_FORWARDED_FOR parameter. The root cause is insufficient input sanitization and output escaping: a deliberately failed nonce check on the getshortcodedrendered...
PT-2026-89754
The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.70 via the upload file remove AJAX handler. The plugin stores the value of an account 'file' form field taken directly from $ POST when no real $ FILES upload is provided process accoun...
PT-2026-89760
The WP-Members Membership Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL Query String in all versions up to, and including, 3.5.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitra...
WordPress WP-Stats 2.5.6 Cross Site Scripting
WordPress WP-Stats plugin versions 2.5.6 and below suffer from a persistent cross site scripting vulnerability. https://packetstorm.news/download/231119...
CVE-2026-11446: Missing Authorization
The Booktics ā Booking Calendar for Appointments and Service Businesses plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.0.23. This is due to the createorderpermission permission callback on the POST /wp-json/booktics/v1/orders REST...
CVE-2026-84960: Improper Neutralization of Input During Web Page Generation
The WP-Members Membership Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL Query String in all versions up to, and including, 3.5.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitra...
CVE-2026-18579: Improper Neutralization of Input During Web Page Generation
The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTPXFORWARDEDFOR' parameter in all versions up to, and including, 9.2.08.003 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...