2026

The Easy Post Submission plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabi

The TableOn – WordPress Posts Table Filterable plugin for WordPress is vulnerable to blind SQL Injection via the `filter

The Seraphinite Accelerator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'seraph_accel_p

The Translate Multilingual sites – TranslatePress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting v

The User Access Manager plugin for WordPress is vulnerable to Second-Order SQL Injection via the 'id' parameter of the w

The Page and Post Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to and

The WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars plugin for WordPress is vulnerable to

The WP TripAdvisor Review Slider plugin for WordPress is vulnerable to generic SQL Injection via 'curselrevs[]' Paramete

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based SQL

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Insecure Direct Object

In OpenStack Ironic through 38.0.0, a project reader that makes a crafted request to Ironic can return Portgroups assign

HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the Git deployer component. GitDe

HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the media upload thumbnail genera

It was not possible to govern the rate at which the broker would respond to an echo flow, enabling an authenticated atta

It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated att

An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to

An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service

A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of

It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated att

An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service

A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of

It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated att

An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to

An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service

A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of

It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated att

An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to

An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service

A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of

The built-in PostgreSQL service on the mobile device suffers from misconfiguration flaws and command injection vulnerabi

The MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings WordPress plugin before 7.0.4 does not have authorisatio

The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not protect its shipping-label storage direc

The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not perform any authorization check (no capa

The GeoDirectory WordPress plugin before 2.8.168 does not restrict a user-search handler to users allowed to list users

The WP Custom HTML Page WordPress plugin through 0.6.2 does not sanitise HTML stored through one of its custom page hand

The Custom Fields WordPress plugin before 1.5.1 does not validate a user-supplied file path before deletion, allowing un

The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in

The User Registration & Membership WordPress plugin before 5.2.6 does not enforce the site's registration-disabled sett

The GDPR Cookie Compliance WordPress plugin before 5.1.0 expires the visitor's cookies from an action that is reachable

The MultiVendorX WordPress plugin before 5.0.11 does not verify that the store targeted through its REST API belongs to

The Passster WordPress plugin before 4.3.6 outputs password-protected block content in the public page response before

The Passster WordPress plugin before 4.3.6 does not enforce its category-based content protection on the WordPress REST

The Passster WordPress plugin before 4.3.6 does not perform a post-status check before returning post content from an u

The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.8

The Bit Form WordPress plugin before 3.2.0 does not sanitize an uploaded signature image before storing it, allowing un

The Sunshine Photo Cart WordPress plugin before 3.6.12 does not perform access control checks in one of its AJAX action

The Contest Gallery WordPress plugin before 30.0.7 does not route its front-end login through the standard WordPress au

The miniOrange 2FA WordPress plugin before 6.2.7 does not bind the second factor being configured during the pre-login

The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported m

The Ajax Load More WordPress plugin before 8.0.1 does not properly sanitise and escape a parameter before using it in a