412297 matches found
CVE-2026-89288 Fast Courier 5.0.0 - 5.2.3 - Unauthenticated SQLi via 'wp_order_id' Parameter
The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database...
CVE-2026-87974 Asaas Gateway for WooCommerce < 2.7.8 - Unauthenticated Order Payment Bypass via Webhook
The Asaas Gateway for WooCommerce WordPress plugin before 2.7.8 does not properly authenticate its payment webhook, accepting an empty access token in its default configuration and not verifying that the confirmed payment corresponds to the order it marks paid, allowing unauthenticated attackers ...
CVE-2026-90989 Tainacan < 1.4.0 - Subscriber+ Repository Staff Email Address Disclosure via Reports REST Endpoints
The Tainacan WordPress plugin before 1.4.0 does not restrict its reports REST endpoints to users with a management capability, allowing any authenticated subscriber to read the email addresses of the repository's staff...
CVE-2026-88927 rtMedia for WordPress, BuddyPress and bbPress < 4.7.14 - Subscriber+ Arbitrary Album Media Injection via IDOR
The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.14 does not verify that a user owns or may write to the album an upload is assigned to, allowing users with a subscriber-level account or above to place media into another user's private album and have it attributed to...
CVE-2026-87968 Product Feed for Google Shopping < 5.3.2 - Unauthenticated Forced Store Registration
The Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin before 5.3.2 does not perform a nonce or capability check on the AJAX action that registers the store with its feed service and exposes it to unauthenticated users, so any visito...
CVE-2026-87843 Trust Payments Gateway for WooCommerce < 3.1.0 - Unauthenticated Order Payment Completion via Payment Return Page
The Trust Payments Gateway for WooCommerce WordPress plugin before 3.1.0 does not verify the authenticity of the payment provider's response when a customer returns from the hosted payment page, nor bind that response to the targeted order or check the amount, allowing unauthenticated attackers t...
CVE-2026-85345 FV Player 7.5.44.7212 - 7.5.54.7212 - Contributor+ SSRF via retrieve_video_data
The FV Flowplayer Video Player WordPress plugin before 7.5.55.7212 does not properly validate a user-supplied URL before performing a server-side fetch, and an existing host-based restriction fails to cover all cases, allowing users with Contributor-level access and above to perform Server-Side...
CVE-2026-86797 Pricing Table Block 1.0.7 - 2.1.4 - Contributor+ Stored XSS via Pricing Link
The Pricing Table WordPress plugin before 2.1.5 does not validate the scheme of a user-supplied link value in one of its blocks before rendering it, allowing users with contributor-level access and above to store malicious scripts that execute when another user views and interacts with the affect...
CVE-2026-86799 Forms < 3.0.2 - Unauthenticated Stored XSS via Form Submission
The Forms WordPress plugin before 3.0.2 does not sanitise submitted form values on storage, nor escape them before outputting them on the form submissions screen in the administration dashboard, allowing unauthenticated users to inject arbitrary web scripts that will execute in the browser of any...
CVE-2026-86787 Affiliate Toolkit 3.8.7 - 3.9.0 - Contributor+ RCE via BladeOne @php Directive
The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled templating engine compiles and executes as PHP, allowing users with the Contributor role or above to run arbitrary PHP code on the server...
CVE-2026-108066 WP 2FA < 4.2.0 - Admin+ Arbitrary User 2FA Removal via IDOR
The WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capability check before removing a user's two-factor authentication configuration, allowing a site administrator on WordPress Multisite to remove the 2FA configuration of users outside their own site, including accounts the...
CVE-2026-108064 WP Encryption < 7.8.8.2 - Unauthenticated Certificate Private Key and ACME Order Replacement via wple_auto_handler
The WP Encryption WordPress plugin before 7.8.8.2 does not perform a capability or nonce check on one of the handlers that drives its SSL certificate-provisioning routine, allowing unauthenticated users to make the WP Encryption WordPress plugin before 7.8.8.2 overwrite the site's certificate...
CVE-2026-108069 Sunshine Photo Cart < 3.7.4 - Unauthenticated Content Injection via sunshine_modal_add_comment()
The Sunshine Photo Cart WordPress plugin before 3.7.4 does not check whether a visitor is permitted to access a restricted gallery before accepting comment submissions for its images, while it does perform that check when displaying comments, allowing unauthenticated attackers to inject...
CVE-2026-85000 EmbedPress < 4.6.8 - Unauthenticated YouTube API Quota Consumption and Database Bloating
The EmbedPress WordPress plugin before 4.6.8 does not perform any capability or nonce check on an unauthenticated request that triggers a server-side, credential-bearing request to a third-party API and stores attacker-controlled cache entries, allowing unauthenticated attackers to consume the si...
CVE-2026-107320 GamiPress 7.9.5 - 8.0.5 - Unauthenticated Private Activity Log Disclosure
The GamiPress WordPress plugin before 8.0.6 does not properly authorize access to private activity log entries, allowing unauthenticated users to retrieve the private activity logs of all users. This is an incomplete fix of CVE-2026-13450...
CVE-2026-107319 GamiPress < 8.0.6 - Subscriber+ Activity Log Disclosure
The GamiPress WordPress plugin before 8.0.6 does not perform a capability check or ownership verification on one of its authenticated AJAX actions, allowing any authenticated user, such as a Subscriber, to read arbitrary entries from its activity log, including other users' points balances and...
CVE-2026-107594 File Upload to Order < 1.1.4 - Unauthenticated Arbitrary File Deletion
The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the file, and the action that performs the deletion is reachable by unauthenticated users, allowing them to delete arbitrary files on the...
CVE-2026-107160 LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated Stored HTML Injection via Checkout Error Message
The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or input sanitization before storing certain values from a request, allowing unauthenticated users to inject HTML and links that are rendered to visitors on the storefront...
CVE-2026-107178 Image Photo Gallery Final Tiles Grid < 3.6.16 - Contributor+ Stored XSS via 'lightboxOptions' Parameter
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.16 does not escape gallery lightbox configuration values before printing them into an inline script on every page that embeds the gallery, allowing users with contributor-level access and above to store JavaScript that executes ...
CVE-2026-107508 Ultimate Multisite < 2.17.2 - Unauthenticated LFI via 'attributes' Parameter
The Ultimate Multisite WordPress plugin before 2.17.2 does not validate a user-supplied value used to select a file to include, allowing unauthenticated attackers to include and read arbitrary local files, including the WordPress configuration file...
CVE-2026-107126 WP Booking System < 2.1.0.1 - Unauthenticated Stored XSS via X-Forwarded-For Header
The WP Booking System WordPress plugin before 2.1.0.1 does not sanitise and escape a client-controllable request value before storing it and later outputting it in an administration screen, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute in the sessi...
CVE-2026-106166 NEX-Forms 9.2.1 - 9.2.5 - Unauthenticated Arbitrary Form Entry Modification via 'nf_set_entry_update_id' Parameter
The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation checks before updating stored form entries, allowing unauthenticated attackers to overwrite, permanently erase, reassign or append to any previously submitted form entry by referencing...
CVE-2026-106469 Gutenverse Form < 3.0.11 - Contributor+ Stored XSS via SVG Icon
The Gutenverse Form WordPress plugin before 3.0.11 does not sanitize SVG icon markup stored in its form blocks before it is decoded and inserted into the page in the browser, allowing authenticated users with Contributor-level access and above to store malicious SVG that executes JavaScript in th...
CVE-2026-107158 LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated FreightDesk Integration Option Update via REST Route
The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or validation on one of its REST routes that writes to the database, allowing unauthenticated users to modify some of the LTL Freight Quotes WordPress plugin before 4.2.19's stored settings...
CVE-2026-106646 Classified Listing < 6.1.1 - Subscriber+ Unattached Media Deletion and Modification via Gallery AJAX Handlers
The Classified Listing WordPress plugin before 6.1.1 does not verify that the requester owns or can edit the target listing when a gallery request references an unattached media item, allowing any authenticated user with a subscriber-level account to modify, corrupt or delete media-library...
CVE-2026-106099 WP Data Access < 5.5.84 - Unauthenticated Sensitive Data Disclosure via Table Export
The WP Data Access WordPress plugin before 5.5.84 does not restrict its database table export action to authorized users, gating it only with a token that the WP Data Access WordPress plugin before 5.5.84 itself prints into the public pages on which it displays a table, allowing unauthenticated...
CVE-2026-106098 WP Data Access < 5.5.77 - Unauthenticated Incorrect Authorization via Inline App Update
The WP Data Access WordPress plugin before 5.5.77 does not correctly check authorization on one of its application REST endpoints, verifying only read permission before performing a write, which allows unauthenticated attackers to modify data in an application exposed for anonymous read access ev...
CVE-2026-105975 CamPay Shortcode Payment Gateway < 1.7 - Unauthenticated Payment Status Forgery via external_reference
The CamPay Shortcode Payment Gateway WordPress plugin before 1.7 does not verify the authenticity of Mobile Money payment confirmations and derives the payment result from client-supplied parameters, allowing unauthenticated attackers to mark payment records as paid, destroy genuine payment...
CVE-2026-105969 CodeAtoz B2B Suite for WooCommerce < 1.6.1 - Unauthenticated Guest Quote Disclosure
The CodeAtoZ B2B Suite for WooCommerce WordPress plugin before 1.6.1 does not properly restrict access to guest-submitted quotes, allowing unauthenticated users to retrieve another guest's quote, including the buyer's name, email address and requested line items, by supplying an enumerable...
CVE-2026-105261 PublishPress Future 4.10.1 - 4.10.5 - Contributor+ Stored XSS via 'wrapper' and 'dateformat' Shortcode Attributes
The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories WordPress plugin before 4.10.6 does not enforce a safe HTML-element allowlist on a shortcode attribute and does not neutralise attacker-controlled text placed inside the resulting elemen...
CVE-2026-104751 Rank Math SEO < 1.0.280 - Unauthenticated SEO Analyzer Results Deletion
The Rank Math SEO WordPress plugin before 1.0.280 does not perform a capability or nonce check before clearing its stored SEO analysis data, allowing unauthenticated users to delete it...
CVE-2026-103307 Walletdoc Payment Gateway for WooCommerce < 1.8.5 - Unauthenticated SQLi and Order Payment Forgery via Webhook
The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does not properly sanitize and escape user input before using it in a SQL statement, and verifies its payment webhook with a signing secret that is empty by default, allowing unauthenticated attackers to perform SQL...
CVE-2026-104644 Image Photo Gallery Final Tiles Grid < 3.6.15 - Contributor+ Stored XSS via Gallery Configuration Update
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.15 does not sanitize or escape gallery configuration values before echoing them into an inline script on every page that embeds the gallery, allowing users with contributor-level access and above to store JavaScript that execute...
CVE-2026-94370 Memory corruption (double free / use-after-free) vulnerability in core string handling impacts Qt for MCUs
A defect in the Qt for MCUs core string handling causes heap memory corruption. When an application passes text into Qt Quick Ultralite using the public Qul::String interface type, and that text is held in a std::string, the conversion to the internal string type copies the pointer without taking...
CVE-2026-110459
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to obtain information, make unauthorized changes, and execute a Denial of Service DoS attack on the device...
CVE-2026-110458
A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key to create or truncate files on the device...
CVE-2026-107153
Multiple smartphones provided by Rakuten Mobile, Inc. utilize AOSP test keys for their Android Verified Boot AVB functionality. With physical access to the affected device, a crafted system image may be installed...
CVE-2026-110457
A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key to obtain information about files on the device...
CVE-2026-110456
A malicious actor with access to the network and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to access internal resources through the device...
CVE-2026-110455
A malicious actor with access to the network and under certain conditions could exploit an Improper Input Validation vulnerability found in UniFi Protect AI Key to execute a Command Injection on the device...
CVE-2026-110454
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to access internal resources through the device...
CVE-2026-106931
SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product...
CVE-2026-105429 NetBird client SSH config Match line injection via peer FQDN or hostname allows local command execution
Improper neutralization of special elements in the NetBird client SSH configuration manager client/ssh/config/manager.go in NetBird versions 0.60.0 through 0.74.6 allows a malicious or compromised peer to execute arbitrary commands on other NetBird client hosts. The client writes a system-wide...
CVE-2026-101926 Hyyan WooCommerce Polylang Integration <= 1.5.0 - Authenticated (Subscriber+) SQL Injection via 'variation_ids' Parameter
The Hyyan WooCommerce Polylang Integration plugin for WordPress is vulnerable to SQL Injection via the 'variationids' parameter of the 'woocommerceremovevariations' AJAX action in versions up to, and including, 1.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficie...
CVE-2026-103369 Social Share Buttons & Analytics Plugin <= 4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'response' Parameter via gs_update_with_values AJAX
The Social Share Buttons & Analytics Plugin – GetSocial.io plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'response' parameter in all versions up to, and including, 4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
CVE-2026-101924 NewStatPress <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via 'urlrequested' Attribute via Query String
The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4.5 via the 'Last referrers' meta box on the plugin's Overview admin page. This is due to insufficient output escaping of the visitor-supplied query string that the plugin record...
CVE-2026-110453
Nix before 2.35.3, when unsandboxed on macOS or FreeBSD, incorrectly allows connections made by build users from daemon clients...
CVE-2026-110452
The multi-user installer in Nix before 2.35.3 sets the ownership of store contents to the user who invoked the installer even though it should be root ownership...