cve.bz

Matching records, newest first, page 36

Filter
  1. 9.8CVE-2026-85118EPSS 0.3%

    The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capability check on some of its AJAX actions, allowing unauthenticated users to update and delete arbitrary WordPress options, which can be used …

  2. 9.8CVE-2026-84737EPSS 0.3%

    The Freeton WP WordPress plugin through 1.0.0 does not correctly validate the activation code when authenticating a user, allowing unauthenticated attackers to log in as any user whose email address they know, including administrators.

  3. 9.8CVE-2026-84734EPSS 0.3%

    The Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied in the request against the visitor's own session before authenticating them, allowing unauthenticated attackers to obtain a session as the …

  4. 9.8CVE-2026-84254EPSS 0.2%

    The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-o…

  5. 9.8CVE-2026-84253EPSS 0.2%

    The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on…

  6. 9.8CVE-2026-84252EPSS 0.2%

    The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to WP…

  7. 9.8CVE-2026-84251EPSS 0.2%

    The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on t…

  8. 9.1CVE-2026-81649EPSS 0.3%

    The Fundiin cho WooCommerce WordPress plugin through 3.4.0 does not have proper authorisation on several of its REST API routes, relying instead on a credential that is identical on every installation, allowing unauthenticated attackers to…

  9. 9.8CVE-2026-104028EPSS 0.6%

    The Anton Extensions WordPress plugin through 1.2.2 does not perform any capability check, nonce verification, or file-type validation before writing attacker-supplied content to an attacker-chosen path, allowing unauthenticated attackers …

  10. 9.3CVE-2026-108707EPSS 0.6%

    Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header. Attackers gain HR administrator access…

  11. 9.8CVE-2026-81797EPSS 0.3%

    Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions.

  12. 9.8CVE-2026-78535EPSS 0.3%

    Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions.

  13. 9.8CVE-2026-78533EPSS 0.3%

    Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions.

  14. 9.8CVE-2026-78531EPSS 0.3%

    Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions.

  15. 9.8CVE-2026-78529EPSS 0.3%

    Unauthenticated PHP Object Injection in Alliance <= 3.11 versions.

  16. 9.8CVE-2026-66569EPSS 0.3%

    Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions.

  17. 9.8CVE-2026-66568EPSS 0.3%

    Unauthenticated PHP Object Injection in Original <= 1.9.0 versions.

  18. 9.8CVE-2026-66567EPSS 0.3%

    Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions.

  19. 9.8CVE-2026-66565EPSS 0.3%

    Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions.

  20. 9.8CVE-2026-66564EPSS 0.3%

    Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions.

  21. 9.8CVE-2026-66563EPSS 0.3%

    Unauthenticated PHP Object Injection in Windsor <= 2.10 versions.

  22. 9.8CVE-2026-66483EPSS 0.3%

    Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions.

  23. 9.8CVE-2026-66482EPSS 0.3%

    Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions.

  24. 9.9CVE-2026-62129EPSS 0.3%

    Contributor Arbitrary File Upload in Creator LMS <= 1.2.21 versions.

  25. 9.8CVE-2026-62125EPSS 0.3%

    Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions.

  26. 9.8CVE-2026-62124EPSS 0.3%

    Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions.

  27. 9.8CVE-2026-62123EPSS 0.3%

    Unauthenticated PHP Object Injection in Invetex <= 2.18 versions.

  28. 9.8CVE-2026-62120EPSS 0.3%

    Unauthenticated PHP Object Injection in Law Office <= 3.20 versions.

  29. 9.8CVE-2026-62090EPSS 0.4%

    Unauthenticated PHP Object Injection in WineShop <= 3.20 versions.

  30. 9.8CVE-2026-62087EPSS 0.4%

    Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions.

  31. 9.8CVE-2026-62086EPSS 0.4%

    Unauthenticated PHP Object Injection in Juno <= 2.25 versions.

  32. 9.8CVE-2026-62077EPSS 0.4%

    Unauthenticated PHP Object Injection in Avala <= 1.1.4 versions.

  33. 9.8CVE-2026-62076EPSS 0.4%

    Unauthenticated PHP Object Injection in Kalles <= 1.1.7.1 versions.

  34. 9.8CVE-2026-62054EPSS 0.4%

    Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions.

  35. 9.8CVE-2026-62053EPSS 0.4%

    Unauthenticated PHP Object Injection in Wine House <= 3.20 versions.

  36. 9.8CVE-2026-62052EPSS 0.4%

    Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions.

  37. 9.8CVE-2026-62051EPSS 0.4%

    Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions.

  38. 9.8CVE-2026-62050EPSS 0.4%

    Unauthenticated PHP Object Injection in Splendour <= 1.23 versions.

  39. 9.8CVE-2026-62032EPSS 0.4%

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Designinvento DirectoryPress directorypress allows PHP Local File Inclusion.This issue affects DirectoryPress: from n/…

  40. 9.3CVE-2026-62031EPSS 0.3%

    Unauthenticated SQL Injection in uListing <= 2.2.0 versions.

  41. 9.0CVE-2026-62025EPSS 0.3%

    Unauthenticated Arbitrary File Upload in Tailored Tools <= 3.0.3 versions.

  42. 9.9CVE-2026-62024EPSS 0.4%

    Subscriber Arbitrary File Upload in CodeBard Help Desk <= 1.1.2 versions.

  43. 9.8CVE-2026-62022EPSS 0.3%

    Unauthenticated Privilege Escalation in Tonda Membership <= 1.0.1 versions.

  44. 9.8CVE-2026-42723EPSS 0.4%

    Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions.

  45. 9.8CVE-2026-42719EPSS 0.5%

    Subscriber PHP Object Injection in Dynamic User Directory <= 2.4 versions.

  46. 9.8CVE-2026-42718EPSS 0.4%

    Unauthenticated PHP Object Injection in Booster for WooCommerce <= 8.4.0 versions.

  47. 9.8CVE-2026-42716EPSS 0.4%

    Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway <= 4.8.2 versions.

  48. 10.0CVE-2026-42696EPSS 0.4%

    Improper Control of Generation of Code ('Code Injection') vulnerability in Royal Plugins SiteVault – Backup, Restore, Migration &amp; Cloning sitevault-backup-restore-migration allows Remote Code Inclusion.This issue affects SiteVault – Ba…

  49. 9.3CVE-2026-40800EPSS 0.4%

    Subscriber SQL Injection in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes <= 1.5.3 versions.

  50. 9.8CVE-2026-39801EPSS 0.4%

    Subscriber Privilege Escalation in AIWU <= 1.5.9 versions.