The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape...
CVE-2026-84937
The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape user-supplied input be
#advisory
共收录 23717 条相关情报。
← 返回所有主题The Gallery : FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ...
CVE-2026-85414
The Gallery : FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'custom_settings' Shortco
The Kirki WordPress plugin before 6.3.0 does not check that a user is allowed to act on a...
CVE-2026-84225
The Kirki WordPress plugin before 6.3.0 does not check that a user is allowed to act on a collaboration comment before
The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the...
CVE-2026-84745
The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read
The Custom Contact Forms plugin for WordPress is vulnerable to authorization bypass in all...
CVE-2026-75018
The Custom Contact Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation...
CVE-2026-81543
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to,
The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of...
CVE-2026-84901
The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management RES
The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using...
CVE-2026-84221
The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allo
The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check...
CVE-2026-84927
The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check on one of its Google Rev
The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several...
CVE-2026-84022
The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several shortcode attributes before out
The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross...
CVE-2026-76573
The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'not_fo
The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization on a public...
CVE-2026-84936
The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization on a public review-loading action, allo
The Contact Form by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting...
CVE-2026-83625
The Contact Form by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via IP Address Header in
The Greenshift WordPress plugin before 13.2.0 does not properly escape a block animation...
CVE-2026-83544
The Greenshift WordPress plugin before 13.2.0 does not properly escape a block animation attribute before outputting it
The Accept Stripe Payments WordPress plugin before 2.1.4 does not validate a user-supplied URL...
CVE-2026-81423
The Accept Stripe Payments WordPress plugin before 2.1.4 does not validate a user-supplied URL before using it in a redi
The Masteriyo LMS WordPress plugin before 3.4.0 does not sanitise and escape some course...
CVE-2026-82846
The Masteriyo LMS WordPress plugin before 3.4.0 does not sanitise and escape some course settings before outputting the
The Smart Post WordPress plugin before 4.0.8 does not check the type, ownership or status of the...
CVE-2026-78150
The Smart Post WordPress plugin before 4.0.8 does not check the type, ownership or status of the post it is asked to du
CVE-2026-86145
CVE-2026-86145
PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursiv
CVE-2026-86144
CVE-2026-86144
In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This ha
CVE-2026-86143
CVE-2026-86143
In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to r