Browse CVEs

HIGH 7.8 CVE-2026-16524 A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed valid… No fix yet Fix from $1,9502026-07-30 MEDIUM 6.5 CVE-2026-15382 The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.4 does not perform a capability or nonce check before deleting a site's cu… No fix yet Fix from $1,6002026-07-30 MEDIUM 5.3 CVE-2026-15257 The RegistrationMagic WordPress plugin before 6.0.9.4 does not perform authorization, ownership or nonce checks on a front-end submission-editing ac… No fix yet Fix from $1,6002026-07-30 MEDIUM 5.3 CVE-2026-15255 The RegistrationMagic WordPress plugin before 6.0.9.4 does not properly validate that a one-time password presented in a cookie belongs to the ident… No fix yet Fix from $1,6002026-07-30 MEDIUM 5.4 CVE-2026-15252 The Search Atlas SEO WordPress plugin before 2.6.12 does not perform a capability or nonce check in one of its AJAX handlers, allowing any authentic… No fix yet Fix from $1,6002026-07-30 MEDIUM 5.3 CVE-2026-15250 The Appointment Booking Plugin WordPress plugin before 5.6.8 does not restrict which booking fields an unauthenticated visitor can set through its p… No fix yet Fix from $1,6002026-07-30 HIGH 7.5 CVE-2026-15240 The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching session to the operator who initiated it, allowi… No fix yet Fix from $1,9502026-07-30 MEDIUM 6.8 CVE-2026-15153 The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an administrative listing before using it in a … No fix yet Fix from $1,6002026-07-30 MEDIUM 6.5 CVE-2026-14923 The Sync Post With Other Site WordPress plugin before 1.9.3 does not correctly enforce the page-editing capability on a REST route that creates and u… No fix yet Fix from $1,6002026-07-30 HIGH 7.1 CVE-2026-14239 The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request parameter, and do… No fix yet Fix from $1,9502026-07-30 CRITICAL 9.0 CVE-2026-14602 The Remote API WordPress plugin through 0.2 does not authenticate a request before deserializing user-supplied input, allowing unauthenticated attack… No fix yet Fix from $2,3002026-07-30 MEDIUM 6.1 CVE-2026-14592 The WP Real IP-based Access Control WordPress plugin through 1.3.1 does not perform any capability or nonce checks before storing one of its option v… No fix yet Fix from $1,6002026-07-30 MEDIUM 6.8 CVE-2026-14318 The GiveWP WordPress plugin before 4.16.3 does not escape a donation-form template setting before outputting it in an HTML attribute, allowing users… No fix yet Fix from $1,6002026-07-30 MEDIUM 5.4 CVE-2026-14310 The Tutor LMS WordPress plugin before 4.0.0 does not properly verify that a user has access to the course a Q&A thread belongs to before returning o… No fix yet Fix from $1,6002026-07-30 MEDIUM 5.3 CVE-2026-14305 The WP Delicious WordPress plugin before 1.10.2 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users t… No fix yet Fix from $1,6002026-07-30 MEDIUM 6.1 CVE-2026-14207 The LifterLMS WordPress plugin before 10.0.10 does not strip event-handler attributes from a course pricing field before storing and rendering it, a… No fix yet Fix from $1,6002026-07-30 HIGH 8.6 CVE-2026-13395 The Online Scheduling and Appointment Booking System WordPress plugin before 27.8 does not sanitize or properly cast a user-supplied parameter from … No fix yet Fix from $1,9502026-07-30 MEDIUM 5.3 CVE-2026-13345 The Essential Addons for Elementor WordPress plugin before 6.6.10 does not perform authorization, status, or visibility checks when resolving WooCom… No fix yet Fix from $1,6002026-07-30 MEDIUM 6.1 CVE-2026-13330 The Animation Addons for Elementor WordPress plugin before 2.7.0 does not sanitise uploaded SVG/SVGZ files, which it adds to the list of allowed upl… No fix yet Fix from $1,6002026-07-30 HIGH 7.5 CVE-2026-13178 The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauth… No fix yet Fix from $1,9502026-07-30 MEDIUM 5.3 CVE-2026-13143 The WP Travel WordPress plugin before 11.8.1 does not verify PayPal Instant Payment Notifications through the PayPal post-back handshake before mark… No fix yet Fix from $1,6002026-07-30 HIGH 7.5 CVE-2026-12687 The ProfileGrid WordPress plugin before 5.9.9.8 does not restrict which group an anonymous visitor may register into through its front-end registrat… No fix yet Fix from $1,9502026-07-30 HIGH 7.5 CVE-2026-12500 The WP Travel Engine WordPress plugin before 6.8.2 does not perform a capability check on an AJAX action that updates a WP Travel Engine WordPress … No fix yet Fix from $1,9502026-07-30 MEDIUM 6.1 CVE-2026-11881 The Fluent Forms WordPress plugin before 6.2.6 does not sanitise and escape one of its form field configuration settings before outputting it inside… No fix yet Fix from $1,6002026-07-30 MEDIUM 5.4 CVE-2026-11870 The WP Ghost (Hide My WP Ghost) WordPress plugin before 7.0.05 does not verify that client IP information comes from a trusted proxy before trusting… No fix yet Fix from $1,6002026-07-30 MEDIUM 6.5 CVE-2026-11867 The Frontend Admin by DynamiApps WordPress plugin before 3.29.7 does not perform capability checks on its taxonomy term creation, modification, and d… No fix yet Fix from $1,6002026-07-30 MEDIUM 5.9 CVE-2026-11782 The Points and Rewards for WooCommerce WordPress plugin before 2.10.1 does not have authorisation checks in place on a wallet and points update actio… No fix yet Fix from $1,6002026-07-30 HIGH 8.8 CVE-2026-67248 A stack-based buffer overflow vulnerability was found in the File Explorer on the ADM. The vulnerability occurs because user-controlled input is not … Data Master 5.1.4.rjv2+ Fix from $1,9502026-07-30 MEDIUM 6.5 CVE-2026-67247 A path traversal vulnerability was found in the IHM Log handling of ADM. The vulnerability occurs because user-controlled disk serial input is not su… Data Master 5.1.4.rjv2+ Fix from $1,6002026-07-30 MEDIUM 6.5 CVE-2026-67246 A path traversal vulnerability was found in the Wallpaper component of ADM. The vulnerability occurs because user-controlled wallpaper path input is … Data Master 5.1.4.rjv2+ Fix from $1,6002026-07-30