200036 matches found
CVE-2026-39753 WordPress Taskbot plugin <= 6.6 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Taskbot = 6.6 versions...
CVE-2026-39752 WordPress Jobs for WordPress plugin <= 2.8.2 - Arbitrary File Deletion vulnerability
Contributor Arbitrary File Deletion in Jobs for WordPress = 2.8.2 versions...
CVE-2026-39751 WordPress PayPlug for WooCommerce (Official) plugin <= 3.1.0 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in PayPlug for WooCommerce Official = 3.1.0 versions...
CVE-2026-39750 WordPress StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin <= 2.0.6 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart = 2.0.6 versions...
CVE-2026-39749 WordPress App for Cloudflare® plugin <= 1.10.1 - Broken Access Control vulnerability
Subscriber Broken Access Control in App for Cloudflare® = 1.10.1 versions...
CVE-2026-39748 WordPress EduMall theme <= 4.5.3 - Reflected Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in EduMall = 4.5.3 versions...
CVE-2026-39747 WordPress Woffice theme <= 5.4.35 - SQL Injection vulnerability
Subscriber SQL Injection in Woffice = 5.4.35 versions...
CVE-2026-39746 WordPress Booknetic plugin <= 4.8.5 - SQL Injection vulnerability
Unauthenticated SQL Injection in Booknetic = 4.8.5 versions...
CVE-2026-39745 WordPress Contact Form to DB by BestWebSoft plugin <= 1.7.6 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Contact Form to DB by BestWebSoft = 1.7.6 versions...
CVE-2026-39731 WordPress Database for CF7 plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Database for CF7 = 1.2.6 versions...
CVE-2026-39730 WordPress Wise Chat plugin <= 3.4.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in Marcin Wise Chat wise-chat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wise Chat: from n/a through 3.4.3...
CVE-2026-39729 WordPress Edwiser Bridge plugin <= 4.3.4 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in Edwiser Bridge = 4.3.4 versions...
CVE-2026-39728 WordPress Instapage Plugin plugin <= 3.7.2 - Server Side Request Forgery (SSRF) vulnerability
Unauthenticated Server Side Request Forgery SSRF in Instapage Plugin = 3.7.2 versions...
CVE-2026-39727 WordPress WC Fields Factory plugin <= 4.1.12 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting XSS in WC Fields Factory = 4.1.12 versions...
CVE-2026-39726 WordPress Lumise Product Designer plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Lumise Product Designer = 2.1.1 versions...
CVE-2026-39725
...
CVE-2026-39724 WordPress HTTP Requests Manager plugin <= 1.3.11 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in HTTP Requests Manager = 1.3.11 versions...
CVE-2026-39722 WordPress WPLMS theme <= 4.972 - Reflected Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in WPLMS = 4.972 versions...
CVE-2026-39720 WordPress Mapster WP Maps plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Mapster WP Maps = 2.0.4 versions...
CVE-2026-39719 WordPress PDF Smart Viewer for Elementor plugin <= 1.0.4 - Server Side Request Forgery (SSRF) vulnerability
Unauthenticated Server Side Request Forgery SSRF in PDF Smart Viewer for Elementor = 1.0.4 versions...
CVE-2026-32581 WordPress Mooberry Book Manager plugin 4.16.2 - SQL Injection vulnerability
Subscriber SQL Injection in Mooberry Book Manager 4.16.2 versions...
CVE-2026-32579 WordPress Kognetiks Chatbot for WordPress plugin <= 2.4.9 - Arbitrary File Upload vulnerability
Unauthenticated Arbitrary File Upload in Kognetiks Chatbot for WordPress = 2.4.9 versions...
CVE-2026-32580 WordPress WooCommerce Lottery plugin <= 2.2.9 - SQL Injection vulnerability
Unauthenticated SQL Injection in WooCommerce Lottery = 2.2.9 versions...
CVE-2026-32578 WordPress ECPay Ecommerce for WooCommerce plugin <= 1.1.2606090 - Broken Access Control vulnerability
Subscriber Broken Access Control in ECPay Ecommerce for WooCommerce = 1.1.2606090 versions...
CVE-2026-32577 WordPress Frontend File Manager plugin <= 23.6 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Frontend File Manager = 23.6 versions...
CVE-2026-32575 WordPress SUMO Affiliates Pro plugin <= 11.7.0 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in SUMO Affiliates Pro = 11.7.0 versions...
CVE-2026-32574 WordPress Smart Forms plugin <= 2.6.104 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in EDGARROJAS Smart Forms smart-forms allows DOM-Based XSS.This issue affects Smart Forms: from n/a through 2.6.104...
CVE-2026-32572 WordPress WP User Frontend Pro plugin <= 4.2.13 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in WP User Frontend Pro = 4.2.13 versions...
CVE-2026-32571 WordPress Ohio Extra plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting XSS in Ohio Extra = 3.6.8 versions...
CVE-2026-32570 WordPress Progressify - Progressive Web App (PWA) plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Progressify - Progressive Web App PWA = 1.6.0 versions...
CVE-2026-32569 WordPress WP Media folder plugin <= 6.2.2 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in WP Media folder = 6.2.2 versions...
CVE-2026-32568 WordPress WooCommerce Designer Pro plugin <= 1.9.33 - Remote Code Execution (RCE) vulnerability
Subscriber Remote Code Execution RCE in WooCommerce Designer Pro = 1.9.33 versions...
CVE-2026-32557 WordPress WooCommerce Appointments plugin <= 5.3.2 - SQL Injection vulnerability
Unauthenticated SQL Injection in WooCommerce Appointments = 5.3.2 versions...
CVE-2026-25433 WordPress WP2LEADS plugin <= 3.5.7 - Broken Access Control vulnerability
Subscriber Broken Access Control in WP2LEADS = 3.5.7 versions...
CVE-2026-25434 WordPress WP2LEADS plugin <= 3.5.7 - SQL Injection vulnerability
Subscriber SQL Injection in WP2LEADS = 3.5.7 versions...
CVE-2026-4889 SQL Injection (SQLi) in eLoanApp Platform by RDL Technologies
SQL injection SQLi vulnerability in the eLoanApp application, specifically in the POST parameter 'logina' of the user process endpoint '/ajax/users.php?op=verify'. The parameter is vulnerable to boolean-based and time-based SQL injection. Successfully exploiting this vulnerability would allow an...
CVE-2026-105809 SourceCodester Simple Student Information System Profile Field register.php cross site scripting
A vulnerability was identified in SourceCodester Simple Student Information System 1.0. This issue affects some unknown processing of the file /register.php of the component Profile Field Handler. The manipulation of the argument firstname/lastname leads to cross site scripting. The attack may be...
CVE-2026-105879 WordPress JetElements For Elementor plugin <= 2.9.2.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.2...
CVE-2026-105808 SourceCodester Simple Student Information System searchresults.php clean cross site scripting
A vulnerability was determined in SourceCodester Simple Student Information System 1.0. This vulnerability affects the function clean of the file searchresults.php. Executing a manipulation of the argument searchbox can lead to cross site scripting. The attack can be launched remotely. The exploi...
CVE-2026-103346 WordPress Payflex Payment Gateway plugin <= 2.7.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Tomlister Payflex Payment Gateway payflex-payment-gateway allows Reflected XSS.This issue affects Payflex Payment Gateway: from n/a through 2.7.1...
CVE-2026-105305 Keycloak-services: keycloak-services: device authorization grant bypasses per-client minimum.acr.value enforcement
A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devices with limited input capabilities to obtain security tokens. The issue occurs because the flow fails to check the minimum authentication level required by ...
CVE-2026-105807 SourceCodester Simple Student Information System searchquery.php sql injection
A vulnerability was found in SourceCodester Simple Student Information System 1.0. This affects an unknown part of the file searchquery.php. Performing a manipulation results in sql injection. The attack can be initiated remotely...
CVE-2026-85153 Information Disclosure Vulnerability in Schmooze dating mobile Application
This vulnerability exists in the Schmooze app due to the use of hardcoded credentials and cryptographic keys in the client application. An unauthenticated remote attacker could exploit this vulnerability by decompiling the distributed application package and extracting the embedded credentials an...
CVE-2026-59357 Self-UAA OIDC Configuration allows JWT injection to establish unauthorized sessions
Insufficient verification of data authenticity CWE-345 in the external OIDC login callback in Cloud Foundry UAA v4.5.0 to v79.6.0 inclusive allows an authenticated UAA user to bypass the OAuth authorization-code exchange and establish an authenticated external-OIDC browser session, via submitting...
CVE-2026-59358 UAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant type
Improper authentication CWE-287 in the OAuth token endpoint in Cloud Foundry UAA allows a remote, authenticated attacker holding a valid user access token to obtain a fully-privileged clientcredentials token for the OAuth client that issued it, by presenting the user token as an OAuth 2.0 Bearer...
CVE-2026-105701 ACPT (Premium) <= 2.0.66 - Authenticated (Subscriber+) Remote Code Execution via REST API Email Template
The ACPT Premium plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.66 via the render function. This is due to missing capability check on the REST API form creation endpoint and unsandboxed Twig environment rendering email templates. This makes ...
CVE-2026-94293 Missing authentication for critical function in the aas-edge-client REST API
An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints...
CVE-2026-57559 Use After Free in DSP_Services
Memory corruption while processing service requests...