24755 matches found
CVE-2026-16265
The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not restrict the operation it dispatches, allowing users with a Subscriber account to trigger uncontrolled recursion that exhausts server resources, resulting in a Denial of Service...
CVE-2026-16263 WP Maps < 4.9.7 - Subscriber+ Local File Inclusion
The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not properly validate a user-controlled path before using it in a file inclusion, allowing users with a Subscriber account to include and execute arbitrary existing local PHP files on...
CVE-2026-16265 WP Maps < 4.9.7 - Subscriber+ Denial of Service
The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not restrict the operation it dispatches, allowing users with a Subscriber account to trigger uncontrolled recursion that exhausts server resources, resulting in a Denial of Service...
CVE-2026-16263 WP Maps < 4.9.7 - Subscriber+ Local File Inclusion
The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not properly validate a user-controlled path before using it in a file inclusion, allowing users with a Subscriber account to include and execute arbitrary existing local PHP files on...
CVE-2026-15032 wpDiscuz < 7.6.60 - Unauthenticated Stored XSS via Image URL Conversion
The Comments WordPress plugin before 7.6.60 does not properly escape a user-supplied URL before outputting it inside an HTML attribute, allowing unauthenticated users to store a Cross-Site Scripting payload that executes in the browser of any user, including administrators, who views the affected...
CVE-2026-14205
The WP Events Manager WordPress plugin (versions before 2.2.5 ) is vulnerable to a payment bypass due to improper validation of the requested quantity when registering for paid events. An authenticated user can manipulate the attacker-controlled quantity parameter to cause the system to compute a...
CVE-2026-14205 WP Events Manager < 2.2.5 - Subscriber+ Payment Bypass via 'qty' Parameter
The WP Events Manager WordPress plugin before 2.2.5 does not validate the requested quantity when registering for a paid event and computes the price from the attacker-controlled quantity, allowing any authenticated user to create a completed booking for a paid event without making a payment...
WordPress WP-Stats plugin <= 2.56 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by testoun in WordPress Plugin WP-Stats versions = 2.56...
PT-2026-68875
Name of the Vulnerable Software and Affected Versions WP Events Manager versions prior to 2.2.5 Description The plugin fails to verify if incoming payment notifications originate from the configured merchant account and does not check if the paid amount matches the booking total. This allows...
CVE-2026-14205: Improper Authentication
The WP Events Manager WordPress plugin before 2.2.5 does not validate the requested quantity when registering for a paid event and computes the price from the attacker-controlled quantity, allowing any authenticated user to create a completed booking for a paid event without making a payment...
CVE-2026-16265: Uncontrolled Resource Consumption
The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not restrict the operation it dispatches, allowing users with a Subscriber account to trigger uncontrolled recursion that exhausts server resources, resulting in a Denial of Service...
PT-2026-68873
Name of the Vulnerable Software and Affected Versions WP Maps versions prior to 4.9.7 Description An issue exists where the plugin fails to perform a capability check in an AJAX action and does not restrict the dispatched operation. This allows users with a Subscriber account to trigger...
PT-2026-68856
Name of the Vulnerable Software and Affected Versions WP Events Manager versions prior to 2.2.5 Description An issue exists where the plugin fails to validate the requested quantity during registration for paid events. Because the price is computed based on a quantity controlled by the user, any...
CVE-2026-16263: Improper Limitation of a Pathname to a Restricted Directory
The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not properly validate a user-controlled path before using it in a file inclusion, allowing users with a Subscriber account to include and execute arbitrary existing local PHP files on...
CVE-2026-15148: Insufficient Verification of Data Authenticity
The WP Events Manager WordPress plugin before 2.2.5 does not verify that an incoming payment notification originates from the site's configured merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to mark any booking as paid without a legitimate...
PT-2026-68872
Name of the Vulnerable Software and Affected Versions WP Maps versions prior to 4.9.7 Description An issue exists where the plugin fails to perform a capability check in an AJAX action and does not properly validate a user-controlled path used in a file inclusion. This allows users with a...
CVE-2026-15149 WP Hotel Booking < 2.3.3 - Unauthenticated Payment Bypass via Price Manipulation
The WP Hotel Booking WordPress plugin before 2.3.3 does not ensure that room quantities and the resulting order total are non-negative when placing a booking, and relies on client-controlled cart data, allowing unauthenticated users to create confirmed reservations for free or at an arbitrarily...
CVE-2026-66451
Unauthenticated Broken Authentication in WP Event SOlution = 4.1.9 versions...