24666 matches found
PT-2026-81268
Name of the Vulnerable Software and Affected Versions All-in-One WP Migration and Backup versions prior to 7.110 Description An unauthenticated second-order SQL injection exists in the archive restore functionality. This occurs because user-supplied parameters are insufficiently escaped and SQL...
PT-2026-81055
Unauthenticated PHP Object Injection in WP Project Manager = 4.0.6 versions...
CVE-2026-32478: Improper Neutralization of Special Elements used in an SQL Command
Subscriber SQL Injection in WP Project Manager Pro = 4.0.1 versions...
CVE-2026-78262: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in WP Project Manager = 4.0.6 versions...
CVE-2026-66585: Insertion of Sensitive Information Into Sent Data
Unauthenticated Sensitive Data Exposure in WP Cafe Pro 3.0.15 versions...
EUVD-2026-64225
The WP Social Media Login WordPress plugin through 1.0.6 does not verify that a social login was actually completed with the identity provider before authenticating a visitor, allowing unauthenticated attackers to log in as any existing user, including administrators, by supplying that user's ema...
CVE-2026-77000 WP Social Media Login <= 1.0.6 - Unauthenticated Account Takeover via Twitter Login Flow
The WP Social Media Login WordPress plugin through 1.0.6 does not verify that a social login was actually completed with the identity provider before authenticating a visitor, allowing unauthenticated attackers to log in as any existing user, including administrators, by supplying that user's ema...
CVE-2026-77000 WP Social Media Login <= 1.0.6 - Unauthenticated Account Takeover via Twitter Login Flow
The WP Social Media Login WordPress plugin through 1.0.6 does not verify that a social login was actually completed with the identity provider before authenticating a visitor, allowing unauthenticated attackers to log in as any existing user, including administrators, by supplying that user's ema...
CVE-2026-77000
The WP Social Media Login WordPress plugin (versions
PT-2026-79511
Name of the Vulnerable Software and Affected Versions Tutor LMS versions prior to 4.0.6 Description The plugin fails to validate a stored file path used for streaming media. This allows users with the instructor role to perform an arbitrary file read on the server, including files located outside...
CVE-2026-77000: Improper Authentication
The WP Social Media Login WordPress plugin through 1.0.6 does not verify that a social login was actually completed with the identity provider before authenticating a visitor, allowing unauthenticated attackers to log in as any existing user, including administrators, by supplying that user's ema...
WordPress WP Maps plugin < 4.9.8 - Subscriber+ Unlimited Autoloaded Option Creation vulnerability
Subscriber+ Unlimited Autoloaded Option Creation vulnerability discovered by Xanlar Agamalizade in WordPress Plugin WP Maps versions 4.9.8...
WordPress WP Directory Kit plugin < 1.5.7 - Unauthenticated User Email Disclosure via select_2_ajax_user vulnerability
Unauthenticated User Email Disclosure via select2ajaxuser vulnerability discovered by Erwan LR WPScan in WordPress Plugin WP Directory Kit versions 1.5.7...
WordPress Eventin plugin < 4.1.21 - Contributor+ Schedule Deletion and Modification via IDOR vulnerability
Contributor+ Schedule Deletion and Modification via IDOR vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin WP Event SOlution versions 4.1.21...
WordPress Eventin plugin < 4.1.21 - Contributor+ User Role and Meta Modification via Speaker Creation vulnerability
Contributor+ User Role and Meta Modification via Speaker Creation vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin WP Event SOlution versions 4.1.21...
WordPress Eventin plugin < 4.1.21 - Contributor+ Speaker Account Deletion via IDOR vulnerability
Contributor+ Speaker Account Deletion via IDOR vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin WP Event SOlution versions 4.1.21...
WordPress WP Project Manager Pro plugin <= 4.0.1 - SQL Injection vulnerability
SQL Injection vulnerability discovered by dutafi in WordPress Plugin WP Project Manager Pro versions = 4.0.1...
PT-2026-81176
Name of the Vulnerable Software and Affected Versions WP Project Manager Pro versions prior to 4.0.2 Description Insufficient escaping of user-supplied parameters and lack of proper preparation in SQL queries allow authenticated attackers with Subscriber-level access and above to perform SQL...
WordPress WP Cafe Pro plugin < 3.0.15 - Sensitive Data Exposure vulnerability
Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Cafe Pro versions 3.0.15...
