378260 matches found
CVE-2026-61948
WordPress WPDM – Premium Packages plugin ≤ 6.2.0 is affected by unauthenticated SQL injection. The vulnerability is documented in CVE-2026-61948 with a CVSS v3.1 base score of 9.3 (CRITICAL) and a network attack vector, no privileges required, no user interaction. Details indicate the issue is an...
CVE-2026-61944
The CVE-2026-61944 entry concerns an unauthenticated Cross Site Scripting (XSS) vulnerability in the WordPress Bookly plugin, affecting versions up to 27.7. The issue lies in the Bookly plugin for WordPress and is exploitable over the network with user interaction required. CVSS v3.1 metrics indi...
CVE-2026-61946
WordPress Easy Appointments plugin
CVE-2026-61943
CVE-2026-61943 describes an unauthenticated Broken Access Control in the WordPress WPDM – Premium Packages plugin, affected versions
CVE-2026-59554
CVE-2026-59554 affects the WordPress Ziina plugin
CVE-2026-59555
CVE-2026-59555 affects WordPress: Participants Database plugin version
CVE-2026-59547
CVE-2026-59547 describes an unauthenticated Broken Access Control in the WordPress Payment Gateway for PayPal on WooCommerce plugin, versions
CVE-2026-59544
The CVE covers WordPress Thrive Quiz Builder plugin versions
CVE-2026-59545
The vulnerability CVE-2026-59545 affects the WordPress plugin miniOrange Discord Integration (versions
CVE-2026-59543
CVE-2026-59543 describes a Remote Code Execution (RCE) vulnerability in the WordPress Advanced Views plugin, affecting versions
CVE-2026-59541
Affected software: WordPress WP BASE Booking plugin
CVE-2026-59542
The vulnerability CVE-2026-59542 affects the WordPress Kali Forms plugin
CVE-2026-59540
The CVE concerns WordPress plugin SMS Alert Order Notifications, affected in versions
CVE-2026-59525
The CVE covers the WordPress plugin Participants Database (affected version:
CVE-2026-59526
CVE-2026-59526 : Unauthenticated SQL injection in WordPress MapSVG plugin ≤ 8.14.0. Reported as a critical vulnerability (CVSS 3.1: 9.3) with network access and no privileges required; confidentiality impact High, availability Low, no integrity impact. The connected documents confirm the issue bu...
CVE-2026-59524
The CVE concerns WordPress Easy Digital Downloads plugin ≤ 3.6.7 with Unauthenticated Broken Authentication . Affected component: the EDD plugin for WordPress; versions up to 3.6.7 are implicated. Root cause details are not specified in the provided documents. Impact is described as unauthenticat...
CVE-2026-59522
The CVE-2026-59522 entry concerns the WordPress WP ERP plugin (versions
CVE-2026-59517
CVE-2026-59517 concerns the WordPress plugin Easy Form Builder (versions <= 4.0.12). The supplied documents confirm an unauthenticated Cross-Site Scripting (XSS) vulnerability affecting this plugin, with the affected component/version explicitly stated as Easy Form Builder
CVE-2026-59513
CVE-2026-59513 concerns the WordPress Masteriyo LMS plugin (versions ≤ 2.3.0). The issue is a Cross Site Scripting (XSS) vulnerability in the Subscriber context. Per Patchstack, the CVSSv3.1 base score is 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L , indicating network attack sur...
CVE-2026-59514
The CVE-2026-59514 entry concerns the WordPress Buddyboss Platform plugin, affected versions
CVE-2026-59512
CVE-2026-59512 describes an unauthenticated XSS in WordPress plugin Product Enquiry for WooCommerce, versions
CVE-2026-57808
The CVE-2026-57808 entry concerns the WordPress WP EasyPay plugin (
CVE-2026-57809
The CVE-2026-57809 entry describes an Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability in the WordPress AffiliateWP plugin up to version 2.34.0 . Affected component is the plugin’s input handling leading to reflected XSS; the issue is exploitable without authentication. Official...
CVE-2026-57785
The CVE concerns the WordPress ApusListing theme (versions <= 1.2.63) with an unauthenticated Cross Site Request Forgery (CSRF) vulnerability. The available data specify the affected product (ApusListing), the vulnerable version range (
CVE-2026-57784
CVE-2026-57784 : Unauthenticated Cross Site Request Forgery (CSRF) in the WordPress plugin Ninja Forms File Uploads Extension
CVE-2026-57769
CVE-2026-57769 describes an unauthenticated Cross Site Scripting (XSS) flaw in the WordPress Grand Photography theme up to version 5.7.8. Multiple sources (CVE lists, NVD, CVERecord, Patchstack) indicate a reflected XSS variant affecting that theme, enabling an attacker to inject scripts that exe...
CVE-2026-57767
WP Google Maps Pro plugin <= 10.1.02 has an unauthenticated Cross Site Scripting (XSS) vulnerability. Affects versions
CVE-2026-57735
CVE-2026-57735 concerns the WordPress Breakdance plugin, affected in versions ≤ 2.7.1, with unauthenticated Cross Site Scripting (XSS). The description and connected records confirm an XSS vulnerability exploitable without authentication, impacting Breakdance functionality through the specified v...
CVE-2026-57717
CVE-2026-57717 corresponds to an unauthenticated broken access control vulnerability in the WordPress Knit Pay plugin, affecting versions
CVE-2026-57716
CVE-2026-57716 affects the WordPress plugin WordPress Broadcast Live Video (VideoWhisper Live Streaming Integration)
CVE-2026-57704
CVE-2026-57704 : Unauthenticated Cross Site Scripting (XSS) in the WordPress Smart Manager plugin for WP e‑commerce, versions ≤ 8.90.0. Root cause and specific exploit path are not detailed in the provided documents. CVSSv3.1 base score 7.1 (HIGH) with network attack vector and user interaction r...
CVE-2026-57703
CVE-2026-57703 affects WordPress Sunshine Photo Cart plugin versions
CVE-2026-57699
The CVE-2026-57699 entry concerns the WordPress Slider Pro plugin (versions ≤ 4.8.13) with a Cross Site Scripting (XSS) vulnerability affecting subscribers. The Patchstack-backed details identify the affected component and vulnerability type, with a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L/...
CVE-2026-57701
The CVE affects WordPress plugin Real Estate Manager Pro, versions
CVE-2026-57696
The CVE concerns the WordPress Picture Gallery plugin (WordPress plugin) with versions
CVE-2026-57427
CVE-2026-57427 documents an unauthenticated Cross-Site Scripting (XSS) vulnerability affecting the WordPress Download Monitor — WPForms Lock plugin, version
CVE-2026-57428
CVE-2026-57428 affects WordPress Sprout Clients plugin versions ≤ 3.2.3. The issue is an unauthenticated Cross Site Scripting (XSS) vulnerability in Sprout Clients, with a CVSSv3.1 base score of 7.1 (HIGH). Exploitation is network-based but requires user interaction (UI: Required) and privileges ...
CVE-2026-57425
CVE-2026-57425 affects the WordPress plugin Autopay dla WooCommerce (versions
CVE-2026-57384
CVE-2026-57384 describes a Cross Site Scripting (XSS) vulnerability in the WordPress WishList Member X plugin, affecting versions
CVE-2026-57397
Summary: CVE-2026-57397 describes an unauthenticated Cross Site Scripting (XSS) vulnerability in the WordPress Coaching theme, affected versions <= 3.9.2. Affected product/component: WordPress Coaching theme (WordPress plugin/theme). Root cause / vulnerability type: Cross Site Scripting (XSS);...
CVE-2026-57374
CVE-2026-57374 is an unauthenticated Cross Site Scripting (XSS) vulnerability affecting the WordPress Funnel Kit Funnel Builder PRO plugin, versioned <= 3.15.0.7. The CVSS v3.1 base score is 7.1 (HIGH) with NETWORK attack vector, LOW impacts to confidentiality/integrity/availability, and user ...
CVE-2026-57370
Summary (CVE-2026-57370): Unauthenticated reflected Cross Site Scripting (XSS) in WordPress plugin Visitor Traffic Real Time Statistics Pro versions
CVE-2026-57373
CVE-2026-57373 affects WordPress Funnel Kit Funnel Builder PRO plugin, versions
CVE-2026-27423
Technical details (affected versions, root cause, impact, patches) are not publicly provided in the supplied documents. Monitor for updates.
CVE-2026-57367
CVE-2026-57367 affects the WordPress plugin WP Booking System, specifically versions prior to 5.12.8.1. The vulnerability is a Broken Access Control issue impacting the plugin’s ability to enforce access permissions, with exposed integrity risk (High) and limited availability impact as per Patchs...
CVE-2026-27422
The CVE-2026-27422 entry concerns the WordPress YT Player plugin (versions
CVE-2026-27418
The CVE-2026-27418 entry concerns the WordPress plugin WP Fast Total Search
CVE-2026-27403
CVE-2026-27403 concerns the WordPress Hubbub Lite plugin, versions
CVE-2026-27399
CVE-2026-27399 concerns the WordPress MarketKing plugin, versions ≤ 2.1.40. The connected documents describe an Unauthenticated Broken Access Control vulnerability in MarketKing, meaning an unauthenticated attacker can bypass access controls. The exact impact details (which data or actions are ex...