2026

Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authoriz

MCP Kotlin SDK through 0.15.0 contains an uncontrolled memory allocation vulnerability that allows remote clients to exh

A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.6. This impacts the function kqjcmdModel::returnchuli

The Piotnet Forms WordPress plugin through 1.0.30 does not authenticate or validate a form-submission file-upload reques

The Subscribe to Comments WordPress plugin before 2.3.3 does not properly validate a parameter before reflecting it into

The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in

The WP Verify API WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a

The Loja Automática WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in

The ASPL Product Quotation WordPress plugin through 1.1.0 does not sanitize and escape a parameter before using it in SQ

The Datalist it WordPress plugin through 0.0.3 does not sanitize and escape several request parameters before using them

The WP Posts Password Batch Manager WordPress plugin through 1.1 does not perform any capability or nonce check on a bul

The WP-Partner WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL query, a

The Recordbrowser WordPress plugin through 1.1.7 does not sanitise and escape a parameter before using it in a SQL query

The WpCues Basic Quiz WordPress plugin through 1.6.5 does not properly sanitise and escape values before using them in a

The Llavero.io WordPress plugin through 0.1.4 does not properly sanitise and escape a parameter before using it in a SQL

The Site Setup Wizard WordPress plugin through 1.5.8 does not properly sanitise and escape a parameter before using it i

The Social Web Suite WordPress plugin through 4.1.12 does not require its shared secret to be set before accepting requ

The KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check when saving its settin

The Topcontent WordPress plugin through 1.2.1 does not properly authorise one of its request handlers and disables HTML

The Disable Users WordPress plugin through 1.0.5 does not enforce its account-disabling control on all authentication pa

The SmugMug Embed WordPress plugin through 3.13 does not have authorisation or CSRF checks on an AJAX action that stores

The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the sender of a chat message belongs to the

The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have authorisation checks on several state-cha

The Adwised Web Push Notification WordPress plugin through 2.5.7 does not perform any capability or nonce check before a

The Web Vitals Tracking WordPress plugin through 5.4.2 does not validate or escape performance measurements submitted by

The HootBoard WordPress plugin through 3.1.4 does not perform any authorisation check on some of its REST endpoints, an

The Crowdfundly WordPress plugin through 2.2.2 does not have capability checks on some of its AJAX actions, allowing use

The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not sanitise and escape content submitted th

The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not sanitise and escape content submitted thr

The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through a

The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not sanitise and escape content submitted throu

The Tcard WP WordPress plugin through 1.8.0 does not sanitise and escape a parameter before using it in a SQL statement

The WooCommerce Bookings WordPress plugin before 3.11.0 does not limit a user-supplied value before using it to allocate

The WeddingCity Lite WordPress plugin through 1.0.4 does not perform any authorisation or validity checks before deleti

The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user holds the capability WordPress reserves f

The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL stat

The Mobile builder WordPress plugin through 1.4.2 does not properly restrict which user meta keys a logged-in user can u

The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and CSRF checks when saving its settings, an

A vulnerability was found in Studio-Saelix Sencho up to 0.94.1. This affects an unknown part of the file /api/auth/login

Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every ca

MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accoun

ImageMagick on Windows through 7.1.2-33 and 6.9.13-58 contains an uncontrolled search path vulnerability in NTGhostscrip

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController passApply handler that

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDeptRolePermission endpoint of SysDepa

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController deleteBatch handler that

Unauthenticated Cross Site Scripting (XSS) in Educavo <= 3.4.2 versions.

Unauthenticated Cross Site Scripting (XSS) in LMS <= 8.3 versions.

Subscriber Arbitrary File Deletion in FoodBakery <= 4.6 versions.

Unauthenticated Local File Inclusion in Ambient <= 1.7 versions.

Unauthenticated Arbitrary Content Deletion in Forminator <= 1.57.3 versions.