24813 matches found
CVE-2026-49078: Improper Validation of Specified Quantity in Input
Unauthenticated Other Vulnerability Type in WP Travel Engine = 6.7.10 versions...
CVE-2026-39511: Improper Neutralization of Special Elements used in an SQL Command
Unauthenticated SQL Injection in WP Photo Album Plus = 9.1.08.001 versions...
CVE-2026-42661: Path Traversal: '.../...//'
Custom role Path Traversal in WP Customer Area = 8.3.4 versions...
CVE-2026-49766: Improper Limitation of a Pathname to a Restricted Directory
Subscriber Arbitrary File Deletion in WP User Manager = 2.9.16 versions...
CVE-2026-42411: Authentication Bypass Using an Alternate Path or Channel
Unauthenticated Broken Authentication in CloudSecure WP Security = 1.4.7 versions...
CVE-2025-15658: Improper Neutralization of Input During Web Page Generation
Administrator Cross Site Scripting XSS in WP Emmet = 0.3.4 versions...
CVE-2026-42665: Improper Neutralization of Special Elements used in an SQL Command
Unauthenticated SQL Injection in WP Data Access = 5.5.70 versions...
PT-2026-49215
WordPress Plugin Photocart Link 1.6 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting insufficient input validation in decode.php. Attackers can supply base64-encoded file paths in the 'id' parameter to the decode.php endpoin...
CVE-2026-48882: Improper Neutralization of Special Elements used in an SQL Command
Subscriber SQL Injection in WP Time Slots Booking Form = 1.2.50 versions...
CVE-2026-8935: Undefined Security Weakness
The WP MAPS PRO WordPress plugin before 6.1.1 registers an unauthenticated AJAX action which, given a valid nonce that is publicly emitted on any frontend page enqueuing its map script, unconditionally creates an administrator account and returns a magic-login URL granting interactive admin acces...
CVE-2026-8386: Undefined Security Weakness
The WP Go Maps WordPress plugin before 10.0.10 does not perform any approval-state filtering on its public single-marker REST endpoint, allowing unauthenticated users to retrieve marker records that an administrator has not yet approved for public display, including any PII placed in the address...
CVE-2026-8385: Exposure of Sensitive Information to an Unauthorized Actor
The WP Go Maps WordPress plugin before 10.0.10 does not properly enforce the marker approval filter on the admin-ajax fallback for its datatables route, allowing unauthenticated visitors to retrieve marker records that the site owner has not approved for public display, including their title,...
CVE-2026-49770: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in WP Travel Engine = 6.7.12 versions...
CVE-2026-49043: Cross-Site Request Forgery (CSRF)
Unauthenticated Cross Site Request Forgery CSRF in WP Migrate Lite = 2.7.8 versions...
CVE-2026-49085: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms = 1.1.4 versions...
CVE-2026-39591: Unrestricted Upload of File with Dangerous Type
Subscriber Arbitrary File Upload in WP-BusinessDirectory = 4.0.0 versions...
CVE-2026-39534: Missing Authorization
Unauthenticated Broken Access Control in WP Directory Kit = 1.5.0 versions...
CVE-2026-40790: Authentication Bypass Using an Alternate Path or Channel
Subscriber Sensitive Data Exposure in WP SMS = 7.2.1 versions...
PT-2026-49485
Name of the Vulnerable Software and Affected Versions WP Job Portal versions prior to 2.5.3 Description Cross Site Scripting XSS exists in the plugin, allowing users with the Subscriber role to execute malicious scripts in the browser of other users. Recommendations Update to a version newer than...