378298 matches found
CVE-2026-65539
The advisory concerns CVE-2026-65539: Unauthenticated CSRF in WordPress Kwayy HTML Sitemap plugin version
CVE-2026-65540
CVE-2026-65540 affects the WordPress plugin “Popup for CF7 with Sweet Alert” (versions <= 1.6.5). The vulnerability is a reported unauthenticated Cross Site Request Forgery (CSRF) weakness in this plugin. The CVSS data indicate: AV:N, AC:L, PR:N, UI:R, S:C, C:L, I:L, A:L, base score 7.1 (HIGH)...
CVE-2026-65538
CVE-2026-65538 : WordPress Machete plugin ≤ 5.2 contains a Cross Site Scripting (XSS) vulnerability in the author context. The CVSS v3.1 base score is 5.9 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L. The provided documents do not specify the exact vulnerable component, explo...
CVE-2026-65536
CVE-2026-65536 affects the WordPress WooCommerce shipping plugin (Persian: افزونه حمل و نقل ووکامرس) for fast/custom delivery and courier options,
CVE-2026-65537
CVE-2026-65537 concerns a WordPress plugin, Cyr to Lat reloaded – transliteration of links and file names , affected in versions
CVE-2026-65535
CVE-2026-65535 concerns the WordPress TinyMCE Templates plugin, specifically versions
CVE-2026-65533
The CVE-2026-65533 entry concerns the WordPress Smart SEO Tool plugin, affected version family is
CVE-2026-65534
CVE-2026-65534 concerns the WordPress plugin "Custom links in Elementor Image Carousel" (versions
CVE-2026-65531
CVE-2026-65531 affects WordPress Qubely plugin versions up to 1.8.14 with an unauthenticated broken access control vulnerability. Connected documents confirm unauthenticated access and broken access control but do not provide root cause, affected files, exploitation details, or a fix. CVSS/metric...
CVE-2026-65532
CVE-2026-65532 concerns the WordPress Persian Woocommerce SMS plugin, affected
CVE-2026-65530
Technical details for CVE-2026-65530 are not publicly available in the provided documents; the description notes a broken access control in TemplateSpare
CVE-2026-65528
The CVE-2026-65528 entry concerns the WordPress BSK PDF Manager plugin (versions up to 3.8) with a Cross Site Scripting (XSS) vulnerability. The root cause is XSS in this plugin version, affecting the product where user input is not properly sanitized. The documents do not provide details on the ...
CVE-2026-65529
Technical details are not publicly available in the provided documents; monitor for updates on the Graphina WordPress plugin
CVE-2026-65527
The CVE-2026-65527 entry covers a Cross Site Scripting (XSS) vulnerability in the WordPress LIQUID SPEECH BALLOON plugin, affected versions
CVE-2026-65525
CVE-2026-65525 affects the WordPress Civi Framework plugin up to version 2.2.0. The issue is unauthenticated broken access control, enabling access to resources or actions that should be restricted. The available documents identify the affected software and the vulnerability class but do not prov...
CVE-2026-65526
The CVE-2026-65526 entry concerns the WordPress Visualizer plugin (versions up to and including 4.0.6). The vulnerability is described as a Contributor SQL Injection in Visualizer
CVE-2026-65524
Technical details for CVE-2026-65524 are not publicly available in the provided documents. Monitor for updates.
CVE-2026-65521
Technical details are not publicly available in the provided documents. Monitor for updates on CVE-2026-65521.
CVE-2026-65522
The CVE-2026-65522 entry documents a Cross Site Scripting (XSS) vulnerability in the WordPress Manual theme (Documentation, Knowledge Base & Education WordPress Theme) up to version 7.5.4. The description specifies XSS in versions
CVE-2026-65518
The CVE concerns the WordPress plugin “Accept Donations with PayPal & Stripe” (v <= 1.5.5) and reports a Cross Site Scripting (XSS) vulnerability. Affected product is the WordPress plugin; vulnerability arises from an XSS issue in versions up to 1.5.5 as described in the CVE records. Public re...
CVE-2026-65519
The advisory concerns CVE-2026-65519: a Cross Site Scripting (XSS) vulnerability in the WordPress Photo Gallery plugin, versions up to 2.7.7.29. According to the record, an author context XSS exists in affected releases. The CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L with a ...
CVE-2026-65516
CVE-2026-65516 - Unauthenticated Server-Side Request Forgery in the WordPress plugin PeproDev Ultimate Invoice
CVE-2026-65512
CVE-2026-65512 affects the WordPress WP Activity Log plugin (WordPress)
CVE-2026-65514
CVE-2026-65514 affects the WordPress plugin Appointment Hour Booking up to version 1.5.86, with a reported Cross Site Scripting (XSS) vulnerability. The CVSS 3.1 base score is 6.5 (Medium); attack vector is network, attack complexity low, privileges required low, and user interaction is required,...
CVE-2026-65511
CVE-2026-65511 affects the WordPress Manual - Documentation, Knowledge Base & Education WordPress Theme (versions
CVE-2026-65510
CVE-2026-65510 is a real issue affecting the WordPress plugin PeproDev Ultimate Invoice
CVE-2026-65506
CVE-2026-65506 affects the WordPress plugin MP3 Audio Player for Music, Radio & Podcast by Sonaar, versions
CVE-2026-65505
CVE-2026-65505 concerns WordPress sites using the Ultimate Store Kit Elementor Addons plugin, affected versions
CVE-2026-65501
CVE-2026-65501 affects the WordPress plugin Shiptastic for WooCommerce (versions
CVE-2026-65503
The CVE concerns WordPress plugin Ultimate Store Kit Elementor Addons versions
CVE-2026-65500
CVE-2026-65500 concerns the WordPress Manual - Documentation, Knowledge Base & Education Theme, affected through version
CVE-2026-65499
CVE-2026-65499 affects the WordPress plugin PeproDev Ultimate Invoice, version
CVE-2026-65498
Technical details about CVE-2026-65498 are not publicly available in the provided documents; no affected components, root cause, or remediation are disclosed. Monitor for updates.
CVE-2026-65497
CVE-2026-65497 concerns the WordPress Complianz plugin, affected in versions ≤ 7.5.0, with a PHP Object Injection vulnerability identifiable under the described Administrator context. The root cause is a PHP object injection flaw within Complianz that could be exploited via a network attack vecto...
CVE-2026-65496
CVE-2026-65496 affects the WordPress Complianz plugin (versions ≤ 7.5.0). The description indicates an Author SSRF in Complianz ≤ 7.5.0. CVSSv3.1 base score 4.4 (Network attack, High complexity, Privileges Required: High, No user interaction; Confidentiality and Integrity Low, Availability None; ...
CVE-2026-65495
The CVE-2026-65495 entry describes an unauthenticated Broken Access Control vulnerability in the WordPress Dokan Pro plugin versions
CVE-2026-65494
CVE-2026-65494 affects WordPress via the Dokan Pro plugin ≤ 5.0.2, with a Subscriber SQL Injection vulnerability. The connected data confirms the affected component and the vulnerability class (SQL injection) but does not provide exploit details, affected tables/parameters, or a patch/version to ...
CVE-2026-65492
CVE-2026-65492 : Unauthenticated Cross Site Scripting (XSS) in the WordPress Dokan Pro plugin, version
CVE-2026-65493
The CVE-2026-65493 entry concerns the WordPress Dokan Pro plugin (
CVE-2026-65491
Technical details for CVE-2026-65491 are not publicly available in the provided documents; monitor for updates.
CVE-2026-65490
The CVE-2026-65490 entry concerns the WordPress plugin Create by Mediavine (versions <= 2.5.3), with unauthenticated sensitive data exposure identified. The connected records confirm the affected software (Create by Mediavine plugin) and the version bound (
CVE-2026-65489
CVE-2026-65489 affects the WordPress plugin “LA-Studio Element Kit for Elementor” up to version 1.6.2. The issue is described as Unauthenticated Broken Access Control, allowing access to restricted functionality without credentials. The referenced CVSS 3.1 base score is 5.3 (MEDIUM) with network ...
CVE-2026-65488
The CVE concerns the WordPress plugin LA-Studio Element Kit for Elementor, version <= 1.6.2. It describes an unauthenticated Cross-Site Request Forgery (CSRF) that can lead to Stored XSS. The issue originates from the plugin’s handling of CSRF, enabling an attacker to trigger stored XSS withou...
CVE-2026-65487
CVE-2026-65487 affects the WordPress Photography theme (versions
CVE-2026-65486
CVE-2026-65486 affects the WordPress plugin Event post (
CVE-2026-65485
CVE-2026-65485 affects the WordPress plugin Content Control
CVE-2026-65484
Technical details for CVE-2026-65484 are not publicly available in the provided documents; monitor for updates.
CVE-2026-65483
CVE-2026-65483 describes a Cross Site Scripting (XSS) vulnerability in the WordPress plugin HashThemes Demo Importer, version