24753 matches found
CVE-2026-18230: Improper Neutralization of Special Elements used in an SQL Command
The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks an authorization check, allowing any authenticated user such as a Subscriber to perform SQL injection attacks...
CVE-2026-17013: Improper Neutralization of Input During Web Page Generation
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not sanitise and escape a parameter before reflecting it into an inline script block, which could allow unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone who is tricked into opening a crafted...
PT-2026-71021
Name of the Vulnerable Software and Affected Versions WP Photo Album Plus versions prior to 9.2.07.002 Description An issue exists where the plugin fails to perform capability or nonce checks on a public endpoint action. The software constructs an option name using a client-supplied value without...
WordPress wp-login.php Code Execution
The vulnerability of the wp-login.php file in the WordPress content management system is related to the lack of security measures taken to protect the website’s structure. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
PT-2026-71003
Name of the Vulnerable Software and Affected Versions WP Crowdfunding WordPress plugin versions prior to 2.2.1 Description Authenticated users, including those with Subscriber roles, can modify the update history of campaigns they do not own and trigger notification emails to backers because the...
PT-2026-71004
The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details, allowing any authenticated users such as Subscribers to read the personal data of any WooCommerce order and enumerate every order in the store...
PT-2026-71030
The ProSolution WP Client WordPress plugin before 2.0.9 does not validate a user-supplied URL, and does not check the capability or nonce of the requester, before performing a server-side HTTP request with it, allowing any authenticated user, such as a subscriber, to make the site issue arbitrary...
PT-2026-71023
The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks an authorization check, allowing any authenticated user such as a Subscriber to perform SQL injection attacks...
PT-2026-71031
The ProSolution WP Client WordPress plugin before 2.0.9 does not perform capability checks on two administrative AJAX actions, and the nonce they rely on is published on its public frontend, allowing any authenticated user, such as a subscriber, to trigger an administrative data synchronisation a...
CVE-2026-14857: Authorization Bypass Through User-Controlled Key
The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update history to be modified and a notification email sent to its backers, allowing any authenticated users such as Subscribers to alter other users' campaigns...
CVE-2026-18962: Authorization Bypass Through User-Controlled Key
The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they target when it processes a front-end upload, allowing any authenticated user, such as a Subscriber, to upload files into albums owned by other users or by the...
WordPress: Author → stored XSS in wp-admin: unescaped sub-size filename from attachment metadata breaks out of the `src` attribute in `get_media_item()`
A vulnerability was discovered in the WordPress media upload and finalize endpoints. An author could upload a crafted image with a malicious filename, which was then stored verbatim by the endpoint and rendered without proper escaping in the WordPress admin media library. This could allow the...
WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Taylsec in WordPress Plugin WP Directory Kit versions = 1.5.4...
WordPress WP BASE Booking plugin <= 6.3.0 - Arbitrary Code Execution vulnerability
Arbitrary Code Execution vulnerability discovered by buitu in WordPress Plugin WP BASE Booking versions = 6.3.0...
WordPress WP Statistics information leakage vulnerability
WordPress WP Statistics is a free and open-source content management system CMS and blog platform built using PHP/MySQL. WordPress WP Statistics has a vulnerability known as information leakage, which stems from the lack of a capability check in the AJAX handler for dashboard analysis. It relies...
WordPress WP Events Manager has a vulnerability related to insufficient validation of data authenticity.
WordPress WP Events Manager is a WordPress plugin used for creating, managing, and displaying events such as meetings, courses, and performances. It supports calendar views, registration, ticket sales, and integration with location maps. There is a vulnerability in WordPress WP Events Manager...
CVE-2026-13457: Unrestricted Upload of File with Dangerous Type
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6 via the top-level script function. This is due to the plugin stores its encrypted options file as options-migratekey.txt in...
CVE-2026-19091: Improper Limitation of a Pathname to a Restricted Directory
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleterevision function in all versions up to, and including, 2.8.169. This makes it possible for...
CVE-2026-73033
CVE-2026-73033 affects the Sucuri Security WordPress plugin up to version 2.7.3. A path traversal flaw exists in the pageIntegritySubmission() function (src/integrity.lib.php) that lets authenticated administrators delete arbitrary files by supplying directory traversal sequences via the sucurisc...
