24455 matches found
WordPress WP-Stats 2.5.6 Cross Site Scripting
WordPress WP-Stats plugin versions 2.5.6 and below suffer from a persistent cross site scripting vulnerability. https://packetstorm.news/download/231119...
CVE-2026-84960: Improper Neutralization of Input During Web Page Generation
The WP-Members Membership Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL Query String in all versions up to, and including, 3.5.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitra...
CVE-2026-18579: Improper Neutralization of Input During Web Page Generation
The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTPXFORWARDEDFOR' parameter in all versions up to, and including, 9.2.08.003 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...
CVE-2026-11446: Missing Authorization
The Booktics – Booking Calendar for Appointments and Service Businesses plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.0.23. This is due to the createorderpermission permission callback on the POST /wp-json/booktics/v1/orders REST...
CVE-2026-84821
Unauthenticated Broken Access Control in WP Fast Total Search = 1.82.284 versions...
CVE-2026-81796
Authentication Bypass Using an Alternate Path or Channel vulnerability in WEN Solutions WP Travel wp-travel allows Password Recovery Exploitation.This issue affects WP Travel: from n/a through 12.0.3...
CVE-2026-81801
Subscriber Settings Change in WP-Stateless = 4.4.1 versions...
CVE-2026-81782
Subscriber Cross Site Scripting XSS in WP Docs = 2.3.1 versions...
CVE-2026-84821 WordPress WP Fast Total Search plugin <= 1.82.284 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in WP Fast Total Search = 1.82.284 versions...
CVE-2026-81801 WordPress WP-Stateless plugin <= 4.4.1 - Settings Change vulnerability
Subscriber Settings Change in WP-Stateless = 4.4.1 versions...
CVE-2026-81801 WordPress WP-Stateless plugin <= 4.4.1 - Settings Change vulnerability
Subscriber Settings Change in WP-Stateless = 4.4.1 versions...
EUVD-2026-75530
Subscriber Settings Change in WP-Stateless = 4.4.1 versions...
CVE-2026-81801
The WP-Stateless WordPress plugin (versions ≤ 4.4.1) is affected by a Settings Change vulnerability discovered by Johan Buenavida via Patchstack. The flaw allows a low-privileged user (e.g., subscriber) to modify settings they should not have access to, over a network with low complexity and no u...
EUVD-2026-75527
Unauthenticated Broken Authentication in WP Travel = 12.0.3 versions...
CVE-2026-81796 WordPress WP Travel plugin <= 12.0.3 - Broken Authentication vulnerability
Authentication Bypass Using an Alternate Path or Channel vulnerability in WEN Solutions WP Travel wp-travel allows Password Recovery Exploitation.This issue affects WP Travel: from n/a through 12.0.3...
CVE-2026-81796 WordPress WP Travel plugin <= 12.0.3 - Broken Authentication vulnerability
Authentication Bypass Using an Alternate Path or Channel vulnerability in WEN Solutions WP Travel wp-travel allows Password Recovery Exploitation.This issue affects WP Travel: from n/a through 12.0.3...
CVE-2026-81796
CVE-2026-81796 is an unauthenticated Broken Authentication vulnerability in the WordPress WP Travel plugin , affecting versions
CVE-2026-81782
WordPress WP Docs plugin versions up to 2.3.1 contain a Cross-Site Scripting (XSS) vulnerability accessible to Subscriber-level users. The CVSS v3.1 score is 6.5 (Medium) , with a network attack vector, low complexity, required user interaction, and a changed scope resulting in low impact on conf...