24553 matches found
CVE-2026-83533 WP Express Checkout < 2.4.9 - Unauthenticated Payment Bypass via wpec_process_payment
The WP Express Checkout WordPress plugin before 2.4.9 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying...
CVE-2026-17563 WP User Frontend < 4.3.11 - Unauthenticated Post Creation via Subscription-Gated Form
The User Frontend WordPress plugin before 4.3.11 does not enforce its subscription-purchase requirement when processing frontend post submissions, only when rendering the form, allowing unauthenticated users to create and, depending on the form's configuration, immediately publish posts through...
CVE-2026-17563
User Frontend WordPress plugin (versions before 4.3.11 ) enforces its subscription-purchase requirement only when rendering a frontend form, not when processing the actual post submission. This allows unauthenticated users to create—and, depending on form configuration, immediately publish —posts...
CVE-2026-17563 WP User Frontend < 4.3.11 - Unauthenticated Post Creation via Subscription-Gated Form
The User Frontend WordPress plugin before 4.3.11 does not enforce its subscription-purchase requirement when processing frontend post submissions, only when rendering the form, allowing unauthenticated users to create and, depending on the form's configuration, immediately publish posts through...
WordPress WP EasyPay plugin <= 4.5.3 - Bypass Vulnerability vulnerability
Bypass Vulnerability vulnerability discovered by Asim Alshaya in WordPress Plugin WP EasyPay versions = 4.5.3...
WordPress WP QuickLaTeX plugin <= 3.8.8 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by theviper17 in WordPress Plugin WP QuickLaTeX versions = 3.8.8...
CVE-2026-84780
Unauthenticated Denial of Service Attack in WP Go Maps = 10.1.08 versions...
CVE-2026-84770
Unauthenticated Cross Site Request Forgery CSRF in Mang Board WP = 2.3.8 versions...
CVE-2026-82223
Unauthenticated Broken Access Control in WP Event SOlution = 4.1.22 versions...
CVE-2026-81283
Subscriber PHP Object Injection in WP User Frontend = 4.3.10 versions...
WordPress WP Compress plugin <= 7.21.28 - Settings Change vulnerability
Settings Change vulnerability discovered by Thaer.Assfour in WordPress Plugin WP Compress versions = 7.21.28...
CVE-2026-84780 WordPress WP Go Maps plugin <= 10.1.08 - Denial of Service Attack vulnerability
Unauthenticated Denial of Service Attack in WP Go Maps = 10.1.08 versions...
CVE-2026-84780 WordPress WP Go Maps plugin <= 10.1.08 - Denial of Service Attack vulnerability
Unauthenticated Denial of Service Attack in WP Go Maps = 10.1.08 versions...
EUVD-2026-69942
Unauthenticated Denial of Service Attack in WP Go Maps = 10.1.08 versions...
CVE-2026-84780
WP Go Maps is a WordPress plugin affected by an unauthenticated Denial of Service vulnerability in versions ≤ 10.1.08 , as reported by researcher Asim Alshaya via Patchstack. The CVSS 3.1 score is 5.3 (Medium) with a network attack vector, low complexity, and no privileges required, resulting in ...
CVE-2026-84770 WordPress Mang Board WP plugin <= 2.3.8 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery CSRF in Mang Board WP = 2.3.8 versions...
CVE-2026-84770 WordPress Mang Board WP plugin <= 2.3.8 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery CSRF in Mang Board WP = 2.3.8 versions...
CVE-2026-84770
CVE-2026-84770 is an unauthenticated Cross-Site Request Forgery (CSRF) vulnerability in the Mang Board WP WordPress plugin, affecting versions ≤ 2.3.8 . The vulnerability was discovered by John Ryan Albon and is rated CVSS 8.8 (HIGH) with the vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning a ...