2026

The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user las

The Tutor LMS WordPress plugin before 4.0.8 does not check that a user has access to a course before returning its less

The Tutor LMS WordPress plugin before 4.0.8 does not correctly determine whether an incoming request is addressed to it

The GiveWP WordPress plugin before 4.16.8.1 does not consistently normalise a donor's e-mail address between the value

The FluentBoards WordPress plugin before 2.0.15 does not properly verify authorization when returning the list of board

The WPLP Cookie Consent WordPress plugin before 4.4.4 does not perform CSRF or capability checks when processing bulk a

The Eventin WordPress plugin before 4.1.24 does not properly authorise order finalisation when its offline (local) paym

The Eventin WordPress plugin before 4.1.24 does not verify a user's capability to create accounts when adding a speaker

The Optimole WordPress plugin before 4.2.12 does not properly escape a user supplied value before using it to build an

The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.9 does not validate or sanitize a widget link s

The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check that a user is allowed to edit the

The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not correctly verify the ownership or the mo

The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check whether a post is password protect

The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not have any authentication or authorisation checks

The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not sanitise and escape a parameter before using it

The Eventin WordPress plugin before 4.1.24 does not prevent the token issued to a guest at checkout from being used to

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly validate URLs before requesting them during t

The WP Import Export Lite WordPress plugin before 3.9.33 does not escape custom field names retrieved from the database

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some import configuration

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some export filter values

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a user-supplied file path before reading it a

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a path taken from stored, user-supplied data

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate the type, extension or content of files it re

The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which PHP function may be applied to exported

The WP Import Export Lite WordPress plugin before 3.9.34 does not validate a user-supplied output path when writing expo

The MultiVendorX WordPress plugin before 5.0.16 does not verify that a user owns the store they are acting on in one of

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Obje

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shortcode_content' para

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Refl

The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Unaut

The WP-Lister Lite for eBay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via AJAX Cron Handler Requ

The WP Directory Kit plugin for WordPress is vulnerable to blind SQL Injection via the 'order_by' parameter in all versi

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versi

The Advanced Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'Notification Button Link' Fie

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up

A security vulnerability has been detected in synaptikcms synaptik-cms up to 1.3.4.4. This affects the function rename o

A vulnerability was determined in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Affecte

A vulnerability was found in vllm-project vLLM 0.26.0/0.27.0. Affected is the function MoRIIOConnectorScheduler.request_

The VeloCloud Edge software update workflow may accept update bundles without properly validating their signatures becau

Insufficient validation of inputs supplied through affected VeloCloud Edge management and configuration workflows may al

On affected platforms running Arista EOS with MLAG Dual Primary Detection configured, an unauthenticated attacker with a

@jitsi/electron-sdk before 10.0.5 exposes getDesktopSources() via contextBridge without requiring an active getDisplayMe

EspoCRM through 10.0.8 uses PHP's rand() function to generate tokens for lead-capture opt-in, event invitation, and camp

A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This affects the function processMessages of the file

A vulnerability was found in a2ui-project a2ui up to 0.10.7. Affected by this issue is the function openUrl of the file

A vulnerability has been found in a2ui-project a2ui up to 0.10.7. Affected by this vulnerability is the function httpx.g

A flaw has been found in a2ui-project a2ui up to 0.10.7. Affected is an unknown function of the file samples/community/c

A vulnerability was detected in a2ui-project a2ui up to 0.10.6. This impacts the function z.any of the file renderers/we

A security flaw has been discovered in ag-ui-protocol ag-ui 0.3.0. Affected is the function urllib.request.urlopen of th