The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a...
CVE-2026-118638
The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that writ
#advisory
共收录 22911 条相关情报。
← 返回所有主题The Security Optimizer WordPress plugin before 1.6.9 does not limit the number of two-factor...
CVE-2026-118185
The Security Optimizer WordPress plugin before 1.6.9 does not limit the number of two-factor authentication codes that
The All-in-One Video Gallery WordPress plugin before 5.0.0 does not check a video's publication...
CVE-2026-118629
The All-in-One Video Gallery WordPress plugin before 5.0.0 does not check a video's publication status before rendering
The Payable Payment Gateway for WooCommerce WordPress plugin before 1.3.1 does not verify the authenticity of an incoming payment notification before marking a WooCommerce order...
CVE-2026-94361
The Payable Payment Gateway for WooCommerce WordPress plugin before 1.3.1 does not verify the authenticity of an incomin
The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to limited file deletion due to insufficient file path validation in the '...
CVE-2026-92294
The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to limited file d
The Quick Event Manager WordPress plugin before 9.19 does not verify the status or type of the requested post before returning its details through a calendar export, allowing un...
CVE-2026-82214
The Quick Event Manager WordPress plugin before 9.19 does not verify the status or type of the requested post before ret
WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgra...
CVE-2026-119977
WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-acc
The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that writes post data, allowing unauthenticated attackers to overw...
CVE-2026-118638
The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that writ
The All-in-One Video Gallery WordPress plugin before 5.0.0 does not check a video's publication status before rendering it on its player page, allowing unauthenticated users to...
CVE-2026-118629
The All-in-One Video Gallery WordPress plugin before 5.0.0 does not check a video's publication status before rendering
The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before processing them in the browser, which could allow users with contrib...
CVE-2026-118438
The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before processing
The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before deleting guest-uploaded attachments, allowing unauthenticated attackers to permanently de...
CVE-2026-118437
The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before deleting guest-uploaded attachme
The Security Optimizer WordPress plugin before 1.6.9 does not limit the number of two-factor authentication codes that can be submitted for a pending login, allowing an attacke...
CVE-2026-118185
The Security Optimizer WordPress plugin before 1.6.9 does not limit the number of two-factor authentication codes that
The Premium Packages WordPress plugin before 7.2.2 does not prevent unauthenticated visitors from overwriting the stored price of items in their shopping cart, allowing them to...
CVE-2026-118184
The Premium Packages WordPress plugin before 7.2.2 does not prevent unauthenticated visitors from overwriting the store
The Bulk Media Register WordPress plugin before 2.01 does not properly validate a user-supplied path before moving a file on the server, allowing users with the Author role to m...
CVE-2026-118043
The Bulk Media Register WordPress plugin before 2.01 does not properly validate a user-supplied path before moving a fil
The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment' parameter in all ...
CVE-2026-116563
The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Stored DOM-Based
The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment / shortcode attribute desc_below_form (and placeholder as th...
CVE-2026-116520
The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment / s
The Essential Addons for Elementor WordPress plugin before 6.8.8 does not correctly restrict who may set the role assigned to accounts created through its registration form, al...
CVE-2026-110808
The Essential Addons for Elementor WordPress plugin before 6.8.8 does not correctly restrict who may set the role assig
The Payment Forms for Paystack WordPress plugin before 4.0.6 does not properly restrict access to a page that displays its stored configuration, allowing users with the Contribu...
CVE-2026-110042
The Payment Forms for Paystack WordPress plugin before 4.0.6 does not properly restrict access to a page that displays i
The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formDat...
CVE-2026-109997
The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is v
The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (bbPress reply body)' parameter in all versions up to, and including, 5...
CVE-2026-109234
The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (bbPress reply