The GD Rating System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'title...
CVE-2026-93430
The GD Rating System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'title' and 'url' Render Args
#severity:high
共收录 5417 条相关情报。
← 返回所有主题The GeoDirectory plugin for WordPress is vulnerable to SQL Injection via the stored latitude...
CVE-2026-103913
The GeoDirectory plugin for WordPress is vulnerable to SQL Injection via the stored latitude/longitude coordinates of a
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to...
CVE-2026-97644
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation v
The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once...
CVE-2026-103514
The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allo
The WP Ultimate Review WordPress plugin before 2.4.4 does not properly sanitise and escape...
CVE-2026-101159
The WP Ultimate Review WordPress plugin before 2.4.4 does not properly sanitise and escape reviews submitted through its
The Magic Tooltips For Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site...
CVE-2026-101928
The Magic Tooltips For Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author'
The WP Ultimate Review WordPress plugin before 2.4.4 does not prevent unauthenticated users from...
CVE-2026-101161
The WP Ultimate Review WordPress plugin before 2.4.4 does not prevent unauthenticated users from storing crafted review
The WP Ultimate Review WordPress plugin before 2.4.4 does not validate that a submitted review...
CVE-2026-101160
The WP Ultimate Review WordPress plugin before 2.4.4 does not validate that a submitted review rating is numeric before
The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Arbitrary Content...
CVE-2026-101923
The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Arbitrary Content Deletion in versions up to, an
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction &...
CVE-2026-93428
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugi
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction &...
CVE-2026-96270
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugi
Formwork before 2.3.13 contains a path traversal vulnerability in BackupController that allows...
CVE-2026-104478
Formwork before 2.3.13 contains a path traversal vulnerability in BackupController that allows authenticated panel users
Mooncake transfer engine before 0.3.12 contains an out-of-bounds read vulnerability in the...
CVE-2026-104433
Mooncake transfer engine before 0.3.12 contains an out-of-bounds read vulnerability in the readString function of includ
Backdrop CMS before 1.35.1 contains an information disclosure vulnerability that allows...
CVE-2026-104476
Backdrop CMS before 1.35.1 contains an information disclosure vulnerability that allows unauthenticated attackers to ret
Armatura One's database initialization routine assigns a fixed, vendor-defined password to the...
CVE-2026-94592
Armatura One's database initialization routine assigns a fixed, vendor-defined password to the database superuser accoun
Armatura One stores database and message-broker credentials in an install configuration file,...
CVE-2026-94591
Armatura One stores database and message-broker credentials in an install configuration file, encrypting them with AES-1
The WebSocket Application Programming Interface lacks restrictions on the number of...
CVE-2026-97363
The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absenc
Armatura One's backup and restore routine records the full database connection command, including...
CVE-2026-94593
Armatura One's backup and restore routine records the full database connection command, including the superuser password
PeaZip before 11.3.0, in a non-default configuration, is vulnerable to OS command injection via a...
CVE-2026-105050
PeaZip before 11.3.0, in a non-default configuration, is vulnerable to OS command injection via a filename in an archive
probe-image-size: Quadratic-time Denial of Service in the SVG Parser
CVE-2026-104861
## Overview `probe-image-size` scans the SVG header with a searching regular expression, `/]*>/`. On input that contain