2026

Due to incorrect behavior order a low privileged remote attacker could trigger account inconsistent state via crafted in

A low privileged remote attacker can gain administrator privileges due to missing authorization at the insert path of th

A low privileged remote attacker can perform privileged configuration changes reserved for the administrator level inclu

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to generic SQL Injection vi

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the 'code'

Successful exploitation of this vulnerability could allow an attacker with local network access to bypass the applicatio

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnera

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnera

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnera

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnera

The WP Fast Total Search – The Power of Indexed Search plugin for WordPress is vulnerable to generic SQL Injection via t

A Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3

In Bouncy Castle for Java from 1.73 to before 1.78, three ML-KEM (CRYSTALS-Kyber) routines divided secret-derived polyno

The Chaty Pro plugin for WordPress is vulnerable to Authenticated Time-Based Blind SQL Injection in versions up to and i

The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to time-bas

The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Insecure

The Advanced Form Integration — Connect Forms to 200+ Apps plugin for WordPress is vulnerable to authorization bypass in

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to arbi

The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Cross-Site Request Forgery

The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory C

The FluentCart A New Era of eCommerce WordPress plugin before 1.4.0 does not verify that a subscription belongs to the

The Tablesome Table WordPress plugin before 1.1.31 does not perform any authentication, capability, or nonce checks in

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and e

The Quiz and Survey Master (QSM) WordPress plugin before 11.1.5 does not perform a capability check before deleting out

The Event Tickets and Registration WordPress plugin before 5.28.4 does not properly escape event titles before outputtin

The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password throu

The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory D

The PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin for Word

Versions of the package nice-select2 before 2.4.1 are vulnerable to Cross-site Scripting (XSS) via the <select> element.

Versions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal via the caching mechanism for path va

Unauthenticated Broken Access Control in Xendit Payment <= 7.1.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Anti Spam and list cleaner &#8211; AcyChecker <= 1.8.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.6 versions.

Unauthenticated Cross Site Scripting (XSS) in Kali Forms <= 2.4.18 versions.

Unauthenticated Broken Access Control in Ad Invalid Click Protector (AICP) <= 1.3.0 versions.

Unauthenticated Cross Site Scripting (XSS) in BackWPup <= 5.7.4 versions.

Unauthenticated Server Side Request Forgery (SSRF) in FormCraft <= 3.9.15 versions.

Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.3 versions.

Unauthenticated Cross Site Scripting (XSS) in GetGenie <= 4.4.3 versions.

Unauthenticated Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <=3.5.45 versions.

Unauthenticated Cross Site Scripting (XSS) in Message Filter for Contact Form 7 <= 1.6.3.9 versions.

Unauthenticated Cross Site Scripting (XSS) in Spam protection, AntiSpam, FireWall by CleanTalk <= 6.82 versions.

Unauthenticated Cross Site Scripting (XSS) in miniorange otp verification <= 5.5.1 versions.

Unauthenticated Server Side Request Forgery (SSRF) in Simple Link Directory Pro <= 15.0.6 versions.

Cross-site scripting (XSS) vulnerability in Modules/Docs/DocsController.php in Milk admin <=0.9.8 allows remote attacker

An issue was discovered in OpenSBI 1.3 allowing attackers to cause a denial of service via crafted request to the SBI fu

The vulnerability involves an Insecure Direct Object Reference (IDOR) in the `DeleteNotificationController::delete()` me

React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauth

React Router is a router for React. Versions 6.0.0 through 7.17.0 are vulnerable to Open Redirtect through use of backsl