378256 matches found
CVE-2026-13440
The CVE concerns StoreGrowth: Smart Sales Booster for WooCommerce (WordPress) plugin. A Stored Cross-Site Scripting vulnerability exists via the message_popup parameter in all versions up to 2.1.0, due to insufficient input sanitization and output escaping. The exploit is feasible for unauthentic...
CVE-2026-16774
The CVE-2026-16774 entry concerns the WordPress Chatbot plugin vulnerable to Missing Authorization via the wpcs_send_email() AJAX handler in versions up to and including 8.5.9. The wpcs_send_email() function is registered for both wp_ajax_wpcs_send_email and wp_ajax_nopriv_wpcs_send_email without...
CVE-2026-15025
The Uncanny Automator WordPress plugin (up to version 7.3.2) is affected by Missing Authorization via four AJAX endpoints (ajax_fetch_labels, segments_fetch, tags_fetch, render_contact_fields). The issue stems from missing capability checks and nonce verification in the handlers, allowing authent...
CVE-2026-65543
The connected document identifies a concrete vulnerability: WordPress Vimeo plugin versions <= 1.2.2 have a Sensitive Data Exposure vulnerability, discovered by 0xzenko. The CVE entry CVE-2026-65543 in the Initial document is reserved with no public technical details. Details available in the ...
CVE-2026-65542
The connected PatchStack entry identifies a vulnerability in the WordPress plugin Super Socializer (versions ≤ 7.14.5) described as Broken Authentication . This CVE-2026-65542 context, based on the patch entry, provides no further technical details beyond the vulnerability type and affected versi...
CVE-2026-58342
A vulnerability (CVE-2026-58342) affects Moodle’s quiz feature, where missing CSRF protection for adding section headings could allow an authenticated user to be tricked into performing unintended actions in a quiz, potentially causing unauthorized modifications or disruptions. The Red Hat adviso...
CVE-2026-21047
CVE-2026-21047 involves an out-of-bounds write in the ImsService, before SMR Jul-2026 Release 1. This condition could enable remote code execution. The impact is described as potentially arbitrary code execution by a remote attacker, with network access required and no user interaction. The remed...
CVE-2026-58331
CVE-2026-58331 : Red Hat documents a flaw in Moodle’s Database Activity module where the import feature allows an arbitrary file read, enabling disclosure of sensitive information from the system. Affected component: Moodle Database Activity module. Root cause: insufficient validation in the impo...
CVE-2026-58332
The connected Red Hat advisory for CVE-2026-58332 describes a Moodle flaw where an authenticated attacker can bypass another user’s email-based MFA token check. Valid credentials are required, but exploitation could lead to unauthorized access to another user’s account. The Initial Description is...
CVE-2026-58333
Summary (CVE-2026-58333) : The Red Hat advisory documents a vulnerability in Moodle’s backup restore functionality that allows an authenticated attacker to read arbitrary files on the server, causing information disclosure. Affected software: Moodle (details on version/editions not provided in th...
CVE-2026-58334
CVE-2026-58334 : Red Hat’s connected document confirms a Moodle flaw enabling remote code execution. An attacker with administrative privileges can exploit the admin presets import feature to take control of the affected system. The description does not specify affected Moodle versions or detaile...
CVE-2026-58335
CVE-2026-58335 (Red Hat entry) describes a vulnerability in Moodle where missing group access checks in certain grade web services could let a user view grade and user information for students in groups they should not access, enabling unauthorized information disclosure. Affected software: Moodl...
CVE-2026-58338
MODE C: CVE-2026-58338 affects Moodle per Red Hat advisory. A CSRF flaw in the user profile page reset action allows a remote attacker to perform actions on behalf of an authenticated user, potentially changing the user’s profile without authorization. The provided documents do not specify affect...
CVE-2026-58337
The connected Red Hat advisory confirms CVE-2026-58337 affects Moodle, specifically a flaw in the user homepage preference setting where a missing token enables CSRF. This can allow a remote attacker to induce a user to perform unwanted actions on Moodle without their knowledge, potentially chang...
CVE-2026-65523
The CVE entry relates to the WordPress plugin Formidable Forms Signature Online Contract Automation (versions <= 2.0.1). Reported vulnerability: Insecure Direct Object References (IDOR) discovered by Abdullah Kareem (cyberkareem). The connected document confirms the affected component and vuln...
CVE-2026-65520
The connected document identifies a SQL Injection vulnerability in the WordPress WP OAuth Server plugin, affecting versions
CVE-2026-58340
CVE-2026-58340 is associated with Moodle via Red Hat advisory RH:CVE-2026-58340. The issue involves flaws in the grade item ID number editing functionality that allow Cross-Site Request Forgery (CSRF) and Cross-Site Scripting (XSS). A remote attacker could misuse these weaknesses to perform unaut...
CVE-2026-58339
CVE-2026-58339 relates to Moodle's Feedback activity module: insufficient sanitization of the Feedback import error message allows a remote attacker to perform a reflected XSS, injecting scripts in a user’s browser and potentially enabling information disclosure or unauthorized actions. Affected:...
CVE-2026-58346
Technical details for CVE-2026-58346 are not publicly available in the provided documents. Monitor for updates and new information.
CVE-2026-58344
The Red Hat advisory for CVE-2026-58344 describes a CSRF flaw in Moodle where the regrade action in the quiz overview report omits a required token. This enables a remote attacker to induce an authenticated user to perform unintended regrades, without explicit consent. The provided documents do n...
CVE-2026-58345
Technical details for CVE-2026-58345 are not publicly available in the provided documents. Monitor for updates.
CVE-2026-58343
Technical details for CVE-2026-58343 are not publicly available in the provided documents. Monitor for updates.
CVE-2026-58341
Technical details for CVE-2026-58341 are not publicly available in the provided documents. No affected products, root cause, or remediation are specified. Monitor for updates as new information becomes available.
CVE-2026-65517
WordPress plugin Easy PayPal Buy Now Button (versions
CVE-2026-65515
CVE-2026-65515 currently has a placeholder Description, but the connected document identifies a concrete issue: WordPress AffiliateWP plugin versions up to 2.35.0 contain a Cross-Site Scripting (XSS) vulnerability. Practical impact is user input handling leading to script execution in the context...
CVE-2026-58348
Technical details for CVE-2026-58348 are not publicly available in the provided documents. Monitor for updates; no affected products, impact, vectors, or remediation can be determined from supplied data.
CVE-2026-65513
The CVE entry CVE-2026-65513 maps to a concrete issue in the WordPress plugin Simply Schedule Appointments (versions
CVE-2026-63303
Summary: CVE-2026-63303 describes a path traversal in Quick.CMS where the URI path component does not normalize ../ sequences, allowing an authenticated admin to read files in the webroot’s sibling directory. Affected product is Quick.CMS (component: URI handling). Underlying cause: failure to no...
CVE-2026-63302
Quick.CMS is vulnerable to Local File Inclusion (LFI) in admin.php via the p parameter. An authenticated admin can include arbitrary files within the application directory, leaking directory structure and absolute file paths. The vendor notes the exploitation likelihood as very low and states tha...
CVE-2026-63301
In Quick.CMS, the language-deletion API endpoint lacks server-side authorization, allowing an authenticated administrator to delete the primary language via a direct request and cause application DoS. When combined with CSRF (CVE-2026-1468), an unauthenticated attacker can craft a malicious link ...
CVE-2026-18028
CVE-2026-18028 describes a missing authorization check in the "+quick setup+" view presented after creating an event. The flaw allows an attacker to send well-timed requests to perform privileged actions on events the user should not access, including creating products, quotas, configuring bank t...
CVE-2026-18029
The CVE-2026-18029 entry is tied to the pretix-girosolution payment integration. Affected component: payment status validation in GiroCheckout flow. Root cause: insufficient validation of payment status responses, enabling an attacker to reuse a successful status for one payment with a different ...
CVE-2026-65509
The PatchStack entry identifies a Cross Site Scripting (XSS) vulnerability in the WordPress plugin wpDataTables, versions
CVE-2026-65880
Summary: CVE-2026-65880 affects Balbooa Forms (Joomla extension) up to version 2.4.2, with unauthenticated remote code execution due to an insecure form processing logic when a signature field is included. Root cause: insecure form processing logic that allows code execution without authenticatio...
CVE-2026-17072
CVE-2026-17072 affects GStreamer’s gst-plugins-good . A heap‑based out‑of‑bounds read of 4 bytes can occur when parsing FLAC headers embedded in Matroska/WebM containers, triggered by a boundary check that ignores the total data size copied. This can allow a small read past the end of the allocat...
CVE-2026-65508
WordPress plugin Simply Schedule Appointments (versions
CVE-2026-65507
CVE-2026-65507 is associated with a Privilege Escalation vulnerability in WordPress AIWU plugin, version
CVE-2026-65504
Affected software: WordPress BOX NOW Delivery Croatia plugin (versions
CVE-2026-65624
The CVE affects the Cowboy HTTP/1.1 handler. The root cause is a per-request header handling flaw: when a request uses repeated header names, values are concatenated into a single binary under one map key, so the max_headers limit never increases and the total header block can grow without bound....
CVE-2026-65502
The CVE-2026-65502 entry is reserved, but a connected vulnerability exists: WordPress Element Pack Elementor Addons plugin
CVE-2026-25403
According to the Patchstack entry, CVE-2026-25403 is associated with the WordPress plugin Ultimate Store Kit Elementor Addons , affected versions
CVE-2026-61959
Connected document confirms a Cross Site Scripting (XSS) vulnerability in WordPress Plugin Business Directory (versions
CVE-2026-59248
CVE-2026-59248 affects cowlib (2.0.0–2.19.0). The HPACK/QPACK dec_big_int/3 decoder has no limit on continuation octets or resulting bit width, causing unbounded memory allocation during decoding and potential memory exhaustion DoS when handling untrusted HTTP/2/3 peers. A single maximal HPACK in...
CVE-2026-58246
SAP NetWeaver Application Server for ABAP and ABAP Platform is affected by CVE-2026-58246, where sensitive session identifiers are written into diagnostic traces when tracing is enabled by a privileged user. An attacker with access to the resulting trace data could use these identifiers to impers...
CVE-2026-65551
This CVE entry relates to a Broken Access Control vulnerability in the WordPress Breakdance plugin, affecting versions up to 2.6.1 . The issue was identified in the Breakdance plugin (discovered by johska) and involves improper access controls. The connected document does not provide exploit deta...
CVE-2026-65545
The connected document describes a Cross Site Scripting (XSS) vulnerability in the WordPress AI Engine plugin for versions ≤ 3.6.5, discovered by daroo. The CVE-2026-65545 entry in the initial document is a reserved placeholder with no public technical details. Based on the connected document, af...
CVE-2026-14785
CVE-2026-14785 affects the WordPress plugin Web Directory Free (all versions up to and including 1.7.13). The root cause is insufficient escaping of the user-supplied parameter in the SQL query, and lack of proper query preparation, enabling a generic SQL injection via the levels parameter. This ...
CVE-2026-11598
CVE-2026-11598 is a Stored Cross-Site Scripting vulnerability in the Shortcodify WordPress plugin, affecting all versions up to 1.4.3. The issue arises from insufficient input sanitization and output escaping for the name shortcode attribute, enabling authenticated attackers with contributor-leve...
CVE-2026-14328
The CVE-2026-14328 entry describes a Privilege Escalation in the Eazy Plugin Manager for WordPress (up to version 4.4.1). The root cause is insufficient authorization on the wp_ajax_pos_get_option AJAX handler, which returns arbitrary WordPress options via get_option() after only a localized nonc...