22 matches found
CVE-2026-97657
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via Malleable Encryption and Bypassable HMAC in all versions up to, and including, 10.8.0. This is due to the use of MAC-free AES-CTR encryption for cart-recovery link tokens — where the 8-byte CTR...
EUVD-2026-100778
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via Malleable Encryption and Bypassable HMAC in all versions up to, and including, 10.8.0. This is due to the use of MAC-free AES-CTR encryption for cart-recovery link tokens — where the 8-byte CTR...
EUVD-2026-91893
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation via Contact Identity Rebinding in all versions up to, and including, 4.9 The vulnerability exists because the createcontact function in the v3 REST endpoint POST /gh/v3/contacts ...
Exploit for CVE-2026-14378
CVE-2026-14378: Unauthenticated Authentication Bypass in WordP...
CVE-2026-75957
The Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.15.0 via the checkoutform parameter of the logincustomeraftercheckout function. This is due to the publicly accessible...
CVE-2026-75957 Ultimate Multisite <= 2.15.0 - Unauthenticated Authentication Bypass via 'checkout_form' Parameter
The Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.15.0 via the checkoutform parameter of the logincustomeraftercheckout function. This is due to the publicly accessible...
CVE-2026-75957
The Ultimate Multisite WordPress plugin (versions ↜ 2.15.0 ) is vulnerable to an Authentication Bypass via the checkout_form parameter in the login_customer_after_checkout function. The publicly accessible wu_ajax_nopriv_wu_validate_form AJAX handler accepts a freely obtainable nonce. When the ch...
EUVD-2026-85703
The EthPress – Web3 Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.5. This is due to the verifylogin function in app/Login.php containing a missing return statement in the signature verification failure branch — when Signature::verify2...
CVE-2026-19125
The EthPress – Web3 Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.5. This is due to the verifylogin function in app/Login.php containing a missing return statement in the signature verification failure branch — when Signature::verify2...
CVE-2026-19125
The EthPress – Web3 Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to and including 2.3.5 . The root cause is a missing return statement in the verify_login() function within app/Login.php. When Signature::verify2() detects a signature mismatch, the function ...
CVE-2026-19125 EthPress <= 2.3.5 - Unauthenticated Authentication Bypass
The EthPress – Web3 Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.5. This is due to the verifylogin function in app/Login.php containing a missing return statement in the signature verification failure branch — when Signature::verify2...
Exploit for CVE-2026-19125
CVE-2026-19125 — EthPress login; //...
CVE-2026-19806: Improper Authentication
The Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 1.4.52 via the guestticketlogin function and its p parameter. Th...
CVE-2026-15303
The 6Storage Rentals plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.27.0. This is due to the sixstoragecreatewpuser AJAX handler being registered on wpajaxnoprivsixstoragecreatewpuser without any nonce, capability, credential, or ownership...
CVE-2026-15303
The CVE pertains to the 6Storage Rentals WordPress plugin (affected versions up to 2.27.0). The vulnerability is an authentication bypass in the six_storage_create_wp_user() AJAX handler, registered on wp_ajax_nopriv_six_storage_create_wp_user without nonce, capability, credential, or ownership v...
CVE-2026-15001 bLoyal: Loyalty & Promotions by bLoyal <= 3.1.611.78 - Authenticated (Subscriber+) Privilege Escalation via Unprotected AJAX API URL Settings
The bLoyal: Loyalty & Promotions by bLoyal plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.611.78. This is due to the AJAX actions savebloyalconfigurationdata and savebloyalaccesskeyverificationdata being registered without any capability or...
EUVD-2026-58841
The bLoyal: Loyalty & Promotions by bLoyal plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.611.78. This is due to the AJAX actions savebloyalconfigurationdata and savebloyalaccesskeyverificationdata being registered without any capability or...
EUVD-2026-58842
The User Session Synchronizer plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.4.0. The synchronizesession function, hooked on init and therefore executed on every request, performs no nonce, capability, or shared-secr...
CVE-2026-15341
CVE-2026-15341 affects the WordPress plugin User Session Synchronizer (versions up to and including 1.4.0). The vulnerability arises in synchronize_session() (hooked on init) which performs no nonce, capability, or shared-secret validation for attacker-supplied ussync-key, ussync-token, and ussyn...
CVE-2026-15001: Improper Privilege Management
The bLoyal: Loyalty & Promotions by bLoyal plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.611.78. This is due to the AJAX actions savebloyalconfigurationdata and savebloyalaccesskeyverificationdata being registered without any capability or...