380472 matches found
CVE-2026-73396
Subscriber Broken Authentication in MWB HubSpot for WooCommerce = 1.6.7 versions...
CVE-2026-73393
Unauthenticated Cross Site Scripting XSS in Subscribe2 = 10.46 versions...
CVE-2026-73380
Unauthenticated PHP Object Injection in Popup by Supsystic = 1.13.0 versions...
CVE-2026-73395
Unauthenticated Insecure Direct Object References IDOR in Booking calendar, Appointment Booking System = 3.2.36 versions...
CVE-2026-73382
Unauthenticated Cross Site Scripting XSS in Site Reviews = 8.2.0 versions...
CVE-2026-73381
Unauthenticated Broken Authentication in Popup by Supsystic = 1.13.0 versions...
CVE-2026-73375
Unauthenticated Cross Site Scripting XSS in Ultimate Maps by Supsystic 1.5.0 versions...
CVE-2026-73379
Unauthenticated Bypass Vulnerability in Contact Form by Supsystic 1.10.0 versions...
CVE-2026-73367
Unauthenticated Remote File Inclusion in Easy Google Maps 1.14.2 versions...
CVE-2026-73376
Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic 1.5.0 versions...
CVE-2026-73378
Unauthenticated Cross Site Scripting XSS in Contact Form by Supsystic 1.10.0 versions...
CVE-2026-73377
Unauthenticated Broken Access Control in Ultimate Maps by Supsystic 1.5.0 versions...
CVE-2026-73358
Unauthenticated Cross Site Scripting XSS in Affiliates Manager = 2.9.53 versions...
CVE-2026-73360
Unauthenticated Cross Site Scripting XSS in Chaty Pro = 3.5.8 versions...
CVE-2026-73365
Unauthenticated SQL Injection in JetAppointment = 2.5.2 versions...
CVE-2026-73359
Subscriber Cross Site Scripting XSS in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent = 4.3.9 versions...
CVE-2026-73366
Unauthenticated PHP Object Injection in Easy Google Maps = 1.13.0 versions...
CVE-2026-73362
Unauthenticated Cross Site Scripting XSS in URL Shortify = 2.5.0 versions...
CVE-2026-73361
Unauthenticated Cross Site Scripting XSS in Recipe Card Blocks for Gutenberg & Elementor = 3.4.18 versions...
CVE-2026-73355
Unauthenticated SQL Injection in Affiliates Manager = 2.9.53 versions...
CVE-2026-73345
Customer SQL Injection in License Manager for WooCommerce = 3.0.18 versions...
CVE-2026-73351
Unauthenticated Cross Site Scripting XSS in WordPress Social Login and Register = 7.8.1 versions...
CVE-2026-73348
Unauthenticated Broken Access Control in GiveWP 4.16.6 versions...
CVE-2026-73350
Unauthenticated Broken Authentication in SupportCandy = 3.5.1 versions...
CVE-2026-73352
Unauthenticated Broken Access Control in GiveWP = 4.16.5.1 versions...
CVE-2026-73356
Unauthenticated Arbitrary Content Deletion in Breeze = 2.5.12 versions...
CVE-2026-73189
Subscriber Insecure Direct Object References IDOR in WP Crowdfunding 2.2.1 versions...
CVE-2026-73338
Unauthenticated Cross Site Scripting XSS in Autopay = 5.0.0 versions...
CVE-2026-73343
Unauthenticated Remote Code Execution RCE in WP Compress 7.20.01 versions...
CVE-2026-73339
Unauthenticated SQL Injection in Modern Events Calendar 7.35.0 versions...
CVE-2026-73190
Unauthenticated Cross Site Scripting XSS in WPDM – Premium Packages = 7.0.5 versions...
CVE-2026-73342
Unauthenticated Cross Site Scripting XSS in WP Multilang = 2.4.31 versions...
CVE-2026-73341
Unauthenticated PHP Object Injection in RegistrationMagic = 6.0.9.7 versions...
CVE-2026-73187
Unauthenticated SQL Injection in Sticky Chat Widget = 1.4.2 versions...
CVE-2026-71539
n8n is an open source workflow automation platform. Prior to 1.123.64, 2.29.8, and 2.30.1, the Git node clone operation allows an authenticated workflow user to swap a validated directory for a symlink before cloning, planting a crafted repository in the community node directory that loads as a...
CVE-2026-73181
Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce 7.6 versions...
CVE-2026-70657
Copyparty is a portable file server. Prior to 1.20.17, copyparty volumes with the dk or dks directory-key flag combined with the fk or fka file-key flag can convert a valid file key into a directory key, granting read access to the containing folder. This vulnerability was only reachable if both...
CVE-2026-68567
Unauthenticated Cross Site Scripting XSS in Convert Pro = 1.0.1 versions...
CVE-2026-68568
Subscriber Privilege Escalation in MasterStudy LMS = 3.7.41 versions...
CVE-2026-68939
Pyenv provides simple Python version management. Prior to 2.8.0, isversionsafe in libexec/pyenv-version-file-read accepts shell glob metacharacters in .python-version values, and unquoted PYENVVERSION expansion in libexec/pyenv-version-name, libexec/pyenv-which, libexec/pyenv-prefix,...
CVE-2026-69189
Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member's private User data, while...
CVE-2026-66793
A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes. A user with permissions to annotate the namespaced ManagedClusterAddOn resource can override the governance-policy container image. This allows an attacker to run a controll...
CVE-2026-68565
Contributor Cross Site Scripting XSS in GeoDirectory = 2.8.172 versions...
CVE-2026-66651
Unauthenticated Broken Access Control in MultiVendorX = 5.0.14 versions...
CVE-2026-66645
Contributor Cross Site Scripting XSS in Table Of Contents Block = 1.5.0 versions...
CVE-2026-66679
Unauthenticated Broken Access Control in Appointment Hour Booking = 1.5.91 versions...
CVE-2026-66643
Contributor Cross Site Scripting XSS in Wufoo Shortcode = 1.55 versions...
CVE-2026-66646
Contributor Cross Site Scripting XSS in WP Tab Widget = 1.2.11 versions...