379517 matches found
CVE-2026-57741
CVE-2026-57741 is a stored XSS vulnerability in the WordPress plugin “AcyMailing SMTP Newsletter” (AcyMailing) up to version 10.11.0. Affected component is the plugin’s web-facing input handling that allows improper neutralization of input during web page generation. The issue permits stored cros...
CVE-2026-59516
This CVE concerns the WordPress ICS Calendar plugin (ics-calendar) with versions up to 12.1.1. The vulnerability is a Reflected Cross-Site Scripting (XSS) flaw caused by improper neutralization of input during web page generation. Affected component: ICS Calendar plugin’s input handling on the we...
CVE-2026-57790
CVE-2026-57790 is linked to the WordPress/ThemeMove Billey billey theme with a Local File Inclusion flaw triggered by improper control of filenames in PHP include/require. Affected: Billey versions up to and including 2.1.8 (no public details on fixed versions are provided in the documents). The ...
CVE-2026-57812
Summary: CVE-2026-57812 concerns the WordPress plugin “Simply Schedule Appointments.” In affected versions (up to and including 1.6.12.4), the issue is described as a Missing Authorization vulnerability caused by misconfigured access control within the Simply Schedule Appointments plugin, enablin...
CVE-2026-61956
The CVE-2026-61956 entry describes a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin sync-basalam (ووسلام – همگام سازی ووکامرس و باسلام) up to version 1.9.1. Affected component: the plugin’s CSRF handling exposes an attack surface enabling unauthorized actions initiated by...
CVE-2026-61952
Summary: CVE-2026-61952 affects the WordPress WooCommerce plugin “WooCommerce Bulk Edit Products – WP Sheet Editor” (versions up to and including 1.8.21). The issue is a broken access control due to missing authorization, enabling exploitation through insecure access control configurations. Affec...
CVE-2026-61976
CVE-2026-61976 affects Crocoblock JetBlocks For Elementor (WordPress plugin) up to version 1.5.0. The vulnerability is described as an Exposure of Sensitive System Information to an Unauthorized Control Sphere, enabling retrieval of embedded sensitive data. CVSS 3.1 metrics indicate a Network att...
CVE-2026-57815
CVE-2026-57815 documents a path traversal vulnerability in the WordPress plugin Forminator (WPMU DEV Your All-in-One WordPress Platform Forminator) affecting version range up to and including 1.55.0.2. The issue is described as Improper Limitation of a Pathname to a Restricted Directory, enabling...
CVE-2026-57788
CVE-2026-57788 describes an improper filename control in the Edge-Themes Aalto WordPress theme (Aalto
CVE-2026-61958
CVE-2026-61958 concerns the WordPress plugin “License Manager for WooCommerce” (license-manager-for-woocommerce) versions up to 3.0.17. The issue is a Missing Authorization vulnerability that allows exploitation through incorrectly configured access control, enabling arbitrary content deletion wi...
CVE-2026-57802
The CVE CVE-2026-57802 affects the WordPress Struktur theme ( Struktur – Creative Agency WordPress Theme ) up to version 2.5.1. The issue is an improper control of filenames for Include/Require statements in a PHP program, i.e., a PHP Local File Inclusion (LFI) vulnerability. Impact is described ...
CVE-2026-59515
CVE-2026-59515 affects the WordPress AIWU plugin (ai-copilot-content-generator) and is due to an improper neutralization of special elements in SQL commands , enabling Blind SQL Injection . Affected versions are WordPress AIWU plugin ≤ 1.5.4. The CVSS‑3.1 base score is 9.3 (CRITICAL) with network...
CVE-2026-61971
The CVE covers the WordPress plugin Metronet Profile Picture (Cozmoslabs User Profile Picture) insecure direct object references affecting versions
CVE-2026-57783
Technical details are not publicly available in the provided documents. Monitor for updates from the vendor or NVD; current references only state a Stored XSS in Speaker
CVE-2026-57792
CVE-2026-57792 pertains to Mikado-Themes Dør dor (WordPress theme). It describes an Improper Control of Filename for Include/Require Statement in PHP, enabling Local File Inclusion (LFI) and labeled as a PHP Remote File Inclusion vulnerability. The issue affects Dør versions up to and including 2...
CVE-2026-57803
CVE-2026-57803 describes a PHP Local File Inclusion vulnerability in Struktur Core (struktur-core) for WordPress, arising from improper handling of filenames in Include/Require statements. The issue affects Struktur Core versions from n/a up to and including 2.5.1 and enables a potential remote a...
CVE-2026-57744
The CVE-2026-57744 entry describes a PHP Object Injection vulnerability in the WordPress plugin RT-Theme 18 Extensions, affected versions up to and including 2.5. The root cause is Deserialization of Untrusted Data, enabling object injection. Impact is rated high (CVSS 3.1: 9.8, Confidentiality/I...
CVE-2026-57778
CVE-2026-57778 affects the WordPress plugin Booking calendar, Appointment Booking System, specifically versions up to and including 3.2.36. The issue is described as Missing Authorization / Broken Access Control, arising from incorrectly configured access control security levels in the booking-ca...
CVE-2026-57799
CVE-2026-57799 : The NVD entry documents an improper control of a filename for an Include/Require statement in a PHP-based WordPress theme/plugin named “Nuss” (uxper Nuss). This yields a local file inclusion vulnerability in Nuss versions up to 1.3.6. The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:H/PR:...
CVE-2026-57801
Technical details are not publicly available in the provided documents for CVE-2026-57801. Monitor for updates.
CVE-2026-61955
CVE-2026-61955 concerns a SQL Injection in the WordPress plugin persian-gravity-forms (Gرویتی فرم فارسی) by Hannan, with vulnerability up to version
CVE-2026-57771
CVE-2026-57771 concerns the WordPress plugin for Milan Petrovic’s GD Rating System. Connected sources confirm the vulnerability as a SQL Injection flaw in the GD Rating System plugin, affecting versions up to 3.7 (<=3.7). The root cause is improper neutralization of inputs used in SQL commands...
CVE-2026-57772
CVE-2026-57772 concerns WP Inventory Manager (WordPress plugin) with an SQL Injection issue in the wp-inventory-manager component. The vulnerability is described as Blind SQL Injection and affects WP Inventory Manager versions up to and including 2.4.0 (and from an unspecified starting version). ...
CVE-2026-57804
CVE-2026-57804 describes an PHP Local File Inclusion in CodexThemes TheGem Theme Elements (for Elementor), specifically TheGem Theme Elements for Elementor up to version 5.11.1. The issue arises from improper control of the filename used in include/require statements, enabling an attacker with au...
CVE-2026-61977
The CVE-2026-61977 entry concerns the WordPress JetSearch plugin (JetSearch) vulnerable to Exposure of Sensitive System Information to an Unauthorized Control Sphere, allowing retrieval of embedded sensitive data. Affected: WordPress JetSearch plugin versions up to 3.6.1.2. Root cause details are...
CVE-2026-57745
CVE-2026-57745 concerns a Reflected Cross-Site Scripting vulnerability in the WordPress RT-Theme 18 Extensions (rt18-extensions) plugin, affecting version <= 2.5. The issue is described as improper neutralization of input during web page generation, enabling reflected XSS. Affected product/com...
CVE-2026-57796
CVE-2026-57796 reports an "Improper Control of Filename for Include/Require Statement" in the VLThemes Leedo WordPress theme. The issue allows PHP Local File Inclusion due to improper filename handling in include/require statements, and affects Leedo versions from unknown start up through v3.0.0...
CVE-2026-57787
CVE-2026-57787 affects CreativeWS CWS SVGicons (WordPress plugin)
CVE-2026-57793
CVE-2026-57793 affects the Flow WordPress theme by Elated-Themes. The issue is an improper filename control in Include/Require statements, resulting in a PHP Local File Inclusion (LFI). Affected versions are Flow:
CVE-2026-57816
The CVE-2026-57816 entry concerns FunnelKit Funnel Builder (WordPress plugin) with a Reflected XSS in the funnel-builder component. Affected versions are listed as from n/a through
CVE-2026-57743
CVE-2026-57743 describes animproper control of the filename for include/require in the PHP program, enabling a PHP Local File Inclusion vulnerability in the WordPress plugin set RT-Theme 18 | Extensions (rt18-extensions). Affected: RT-Theme 18 Extensions versions up to and including 2.5. The issu...
CVE-2026-61975
CVE-2026-61975 affects the WordPress JetReviews plugin (Crocoblock) up to version 3.0.1. The issue is Exposure of Sensitive System Information to an Unauthorized Control Sphere, allowing retrieval of embedded sensitive data from JetReviews. The NVD entries describe the vulnerability but do not pr...
CVE-2026-57770
The CVE-2026-57770 entry concerns Deserialization of Untrusted Data in the WordPress Theme Grand Photography plugin/theme. Affected: Grand Photography versions up to 5.7.8. Root cause: PHP object injection arising from untrusted data deserialization. Impact: high confidentiality, integrity, and a...
CVE-2026-61968
CVE-2026-61968 affects the WordPress myCred plugin up to version 3.1.2. The root cause is a Missing Authorization/Broken Access Control due to incorrectly configured access control security levels, allowing unintended access. The CVE indicates a MEDIUM-severity issue (CVSS 3.1: 5.4) with network ...
CVE-2026-57814
The CVE-2026-57814 entry concerns the WordPress Forminator plugin (forms forminator) with a DOM-based XSS vulnerability due to improper input neutralization during web page generation. Affected versions are Forminator
CVE-2026-57811
CVE-2026-57811 concerns WordPress Realtyna Organic IDX plugin (real-estate-listing-realtyna-wpl) with versions up to and including 5.2.0. The issue is labeled as an improper generation of code (Code Injection) vulnerability that enables Remote Code Inclusion. It affects the plugin’s handling of c...
CVE-2026-57732
CVE-2026-57732 : A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the WordPress plugin tagDiv Opt-In Builder (td-subscription), affecting versions
CVE-2026-57407
The vulnerability concerns the WordPress plugin PDF Generator for WordPress (plugin name shown as pdf-generator-for-wp) and is described as a Server-Side Request Forgery (SSRF) . Affected versions are listed as “from n/a through
CVE-2026-57727
CVE-2026-57727 concerns the WordPress Kirki plugin (Kirki) with versions 6.0.13 and earlier, reported as a Missing Authorization / Broken Access Control vulnerability. The connected sources (NVD, CVE records, CVElist, PatchStack) describe an incorrectly configured access control that could allow ...
CVE-2026-57708
Affected product/versions: WordPress WordPress plugin “Contact Form Entries” (contact-form-entries)
CVE-2026-57705
CVE-2026-57705 affects the WordPress plugin Event Tickets (versions
CVE-2026-57411
The CVE-2026-57411 entry concerns the WordPress plugin cf7-views (Aman CF7 Views – Complete Entry Management for Contact Form 7) with a DOM-based XSS vulnerability due to improper neutralization during web page generation. Affected versions are up to 3.2.2. CVSS v3.1 base score is 7.1 (HIGH); att...
CVE-2026-57416
The CVE-2026-57416 entry concerns the WordPress SiteGround Email Marketing plugin (versions
CVE-2026-57405
CVE-2026-57405 affects WordPress Open Shop theme (versions up to and including 1.7.1). The root cause is Missing Authorization due to incorrectly configured access control levels, classified as a Broken Access Control vulnerability. CVSS3.1 metrics indicate a HIGH base score of 7.1 (AV:N/AC:L/PR:...
CVE-2026-57420
CVE-2026-57420 concerns a Stored XSS in the WordPress plugin Author Box WP Lens (component: author-box-for-divi). The vulnerability arises from improper neutralization of input during web page generation, enabling stored cross-site scripting. Affected range is WordPress users running versions
CVE-2026-57409
The CVE describes a DOM-based Cross-Site Scripting (XSS) vulnerability in the WordPress plugin “Profit Products Tables for WooCommerce” (Active Products Tables for WooCommerce) by RealMag777, affecting versions up to and including 1.1.0. The issue arises from improper neutralization of input duri...
CVE-2026-57697
The CVE-2026-57697 entry concerns the WordPress ProfileGrid plugin (Metagauss) ≤ 5.9.9.6, where an Authentication Bypass via an Alternate Path or Channel allows Password Recovery Exploitation. The NVD entries describe a vulnerable component (ProfileGrid) with a base score of 7.5 (HIGH) per CVSS 3...
CVE-2026-57424
CVE-2026-57424 affects the WordPress plugin Razorpay Payment Links for WooCommerce (rzp-woocommerce). Multiple sources describe a Missing Authorization / Broken Access Control vulnerability in versions up to and including 2.1.4, allowing exploitation of improperly configured access control. Conne...
CVE-2026-57734
The CVE concerns WordPress tagDiv Composer (td-composer). Affected: tagDiv Composer
CVE-2026-57392
The CVE-2026-57392 entry concerns the WordPress Tourfic plugin (versions up to 2.22.5) with a Missing Authorization / Broken Access Control vulnerability. The root cause is misconfigured access control, enabling unauthorized access to protected resources or actions. Impact is described as broken ...