2026

The YITH WooCommerce Waitlist Premium plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and

Improper Privilege Management vulnerability in ESET AV Remover (standalone) allows Privilege Escalation via especially c

An Insertion of Sensitive Information into Log File vulnerability in SUSE neuvector manager exposes sensitive informatio

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains

The PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus plugin for WordPres

The WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping plugin for WordPress is vulnera

A flaw was found in the key provider component of the keycloak-services library, which is the core engine for the Red Ha

The Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred plugin for WordPress

The Enterprise Cloud Database developed by Ragic has an Arbitrary File Read vulnerability. Privileged remote attackers c

The Contact Form 7 Captcha WordPress plugin before 0.1.9 runs the shortcode parser over the whole rendered Contact Form

The WP Express Checkout WordPress plugin before 2.5.0 does not verify server-side that a payment was actually completed

The Hustle WordPress plugin before 7.8.14.2 does not prevent shortcodes in submitted form values from being executed whe

The CleanTalk WordPress plugin before 6.87 does not prevent unauthenticated, user-supplied comment content from being pa

The Checkout Custom Fields Builder for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all ver

A stored cross-site scripting (XSS) vulnerability has been identified in the H5P module `h5p-nodejs-library` by Lumi Edu

The Reviso Exporter for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a mis

The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.9

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on several of its set

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on one of its cookie

The Sunshine Photo Cart WordPress plugin before 3.7 does not validate that a client-supplied price identifier belongs t

The WPFunnels plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.12.13. Thi

The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering

The Quentn WP WordPress plugin before 1.2.15 does not properly sanitise and escape a parameter before using it in an SQL

The Quentn WP WordPress plugin before 1.2.15 does not adequately escape a request parameter before using it in an unprep

The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Stored Cross

The Sina Extension for Elementor WordPress plugin before 3.10.4 does not properly escape a Table widget setting before o

The Masteriyo LMS WordPress plugin before 3.4.0 does not perform any authorization check before returning a course enro

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have capability or nonce checks on some of its A/B testi

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have any authorisation or CSRF checks when storing visit

The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.7.2 does not restrict the redirect

The SupportCandy WordPress plugin before 3.5.3 does not validate a submitted per-ticket authorization code before discl

The SupportCandy WordPress plugin before 3.5.3 does not perform an authorization check on one of its support-ticket att

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not verify that a stored payment method b

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not validate the order key before adding

The Payment Plugins for Stripe WooCommerce WordPress plugin before 4.0.12 does not validate the order key before adding

The Next-Cart Store to WooCommerce Migration plugin for WordPress is vulnerable to Authentication Bypass in all versions

The WP Recipe Maker plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.

The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not verify that the user redeeming a gift ca

The Awesome Support plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.3.9.

The WP Travel WordPress plugin before 12.0.2 does not verify that the requester is authorized to act on the booking tar

The Loops & Logic WordPress plugin before 4.3.0 does not restrict its public template-data action to the data a visitor

The ELEX WooCommerce Request a Quote WordPress plugin before 2.4.1 does not properly sanitise and escape a parameter bef

The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester owns the booking targeted by i

The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the ta

The Content Mask WordPress plugin before 1.8.5.6 does not properly sanitise and escape content submitted with a post bef

An issue was discovered in the mirage-crypto-ec package before 2.4.0 for OCaml. There is a timing side channel for NIST