24764 matches found
CVE-2026-15464
The WP Hotel Booking WordPress plugin (≤ 2.3.2) is subject to a Stored XSS via the widget_search shortcode attribute due to insufficient input sanitization and output escaping. Vulnerable approach allows authenticated users with contributor-level access and above to inject scripts into pages that...
CVE-2026-15464 WP Hotel Booking <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'widget_search' Shortcode Attribute
The WP Hotel Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'widgetsearch' Shortcode Attribute in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2026-12736: Improper Privilege Management
The Wpify Woo plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 5.4.16. This is due to the SettingsApi::saveoption REST route POST /wp-json/wpify-woo/v1/option passing the request-supplied 'option' and 'data' parameters directly to updateoption without a...
CVE-2026-15464: Improper Neutralization of Input During Web Page Generation
The WP Hotel Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'widgetsearch' Shortcode Attribute in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2026-65521
Unauthenticated Sensitive Data Exposure in WP Social Ninja = 4.3.0 versions...
CVE-2026-24537
Unauthenticated Cross Site Request Forgery CSRF in WP Accessibility Helper WAH = 0.6.6 versions...
CVE-2026-65512
Cross-Site request forgery CSRF vulnerability in Melapress WP Activity Log and Melapress WP Activity Log Premium allows Cross Site Request Forgery. This issue affects WP Activity Log: through 5.6.4; WP Activity Log Premium: through 5.6.4...
EUVD-2026-48118
Unauthenticated Cross Site Request Forgery CSRF in WP Activity Log = 5.6.4 versions...
CVE-2026-65512 WordPress WP Activity Log and WP Activity Log Premium plugins <= 5.6.4 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site request forgery CSRF vulnerability in Melapress WP Activity Log and Melapress WP Activity Log Premium allows Cross Site Request Forgery. This issue affects WP Activity Log: through 5.6.4; WP Activity Log Premium: through 5.6.4...
EUVD-2026-48076
Unauthenticated Cross Site Request Forgery CSRF in GiveWP = 4.16.3 versions...
CVE-2026-59541 WordPress WP BASE Booking plugin <= 6.3.1 - Privilege Escalation vulnerability
Subscriber Privilege Escalation in WP BASE Booking = 6.3.1 versions...
CVE-2026-57367 WordPress WP Booking System plugin < 5.12.8.1 - Broken Access Control vulnerability
Subscriber Broken Access Control in WP Booking System 5.12.8.1 versions...
CVE-2026-25466
CVE-2026-25466 affects the WordPress WP Go Maps plugin (vulnerable:
CVE-2025-68081
CVE-2025-68081 : A cross-site scripting (XSS) vulnerability affects the WordPress plugin WP-Polls in versions
WordPress Hide My WP Ghost plugin <= 7.0.06 - 2FA Bypass vulnerability
2FA Bypass vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Hide My WP Ghost versions = 7.0.06...
WordPress WP Activity Log plugin <= 5.6.4 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by Levon Balyan in WordPress Plugin WP Activity Log versions = 5.6.4...
CVE-2026-9635
The WP Shortcode by MyThemeShop plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter of the tab shortcode in versions up to, and including, 1.4.17. This is due to insufficient input sanitization and output escaping in the mtstabs function, which outputs the...
PT-2026-63837
Unauthenticated Cross Site Scripting XSS in WP Google Maps Pro = 10.1.02 versions...