WordPress

Articles tagged WordPress

• 
  News

  CISA confirms attacks on WordPress core file inclusion flaw

  CISA added a WordPress core file inclusion bug that can lead to code execution to its KEV catalog, set a three-day federal deadline and required forensic triage.

  known-exploited-vulnerabilitieswordpressremote-code-execution +2

  2026-09-25
• 
  Vulnerability

  ACPT- Custom Post Types Plugin for WordPress Privilege Escalation (CVE-2026-32566)

  CVE-2026-32566 is a CVSS 9.8 unauthenticated privilege escalation flaw in the ACPT Pro WordPress plugin, reported exploited by VulnCheck KEV.

  acptwordpressprivilege-escalation +2

  2026-09-20
• 
  Vulnerability

  AcyMailing SMTP Newsletter SQL Injection (CVE-2026-57739)

  CVE-2026-57739 is a CVSS 9.3 blind SQL injection flaw in the AcyMailing WordPress newsletter plugin, reported exploited by VulnCheck KEV.

  acymailingwordpresssql-injection +3

  2026-09-20
• 
  Vulnerability

  Affiliate Pro - Affiliate Program for WooCommerce & WordPress Privilege Escalation (CVE-2026-32558)

  CVE-2026-32558 is a CVSS 9.8 unauthenticated privilege escalation flaw in the Affiliate Pro WordPress plugin, reported exploited by VulnCheck KEV.

  redefiningthewebwordpresswoocommerce +3

  2026-09-20
• 
  Vulnerability

  Amelia Privilege Escalation (CVE-2026-9055)

  CVE-2026-9055 is a CVSS 9.8 flaw in the Amelia WordPress plugin allowing account takeover via password overwrite, reported exploited by VulnCheck.

  ameliawordpressprivilege-escalation +3

  2026-09-20
• 
  Vulnerability

  Divi Ajax Filter Vulnerability (CVE-2026-11613)

  CVE-2026-11613 is a CVSS 9.8 local file inclusion flaw in the Divi Ajax Filter WordPress plugin through 5.1.2, reported exploited by VulnCheck's KEV catalog.

  divi-ajax-filterwordpresslocal-file-inclusion +2

  2026-09-20
• 
  Vulnerability

  Drag and Drop Multiple File Upload for Contact Form 7 Code Injection (CVE-2026-18781)

  CVE-2026-18781 is a CVSS 8.1 code injection in a Contact Form 7 WordPress add-on, reported exploited by VulnCheck alone.

  contact-form-7wordpresscode-injection +3

  2026-09-20
• 
  Vulnerability

  FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel Vulnerability (CVE-2025-6068)

  CVE-2025-6068 is a CVSS 6.4 stored XSS in the FooGallery WordPress plugin, exploitable by Contributor-level accounts, per VulnCheck alone.

  foogalleryfoopluginswordpress +3

  2026-09-20
• 
  Vulnerability

  GeoDirectory SQL Injection (CVE-2026-84813)

  CVE-2026-84813 is a CVSS 9.3 unauthenticated SQL injection flaw in the GeoDirectory WordPress plugin, reported exploited by VulnCheck KEV.

  ayecodewordpressgeodirectory +3

  2026-09-20
• 
  Vulnerability

  Gravity Forms Vulnerability (CVE-2026-84434)

  CVE-2026-84434 is an unauthenticated arbitrary file upload flaw in the Gravity Forms WordPress plugin, per VulnCheck alone.

  gravity-formswordpressfile-upload +2

  2026-09-20
• 
  Vulnerability

  HUSKY – Products Filter Professional for WooCommerce Vulnerability (CVE-2026-18562)

  CVE-2026-18562 is a CVSS 6.1 reflected XSS in the HUSKY Products Filter plugin for WooCommerce, per VulnCheck alone.

  huskywoocommercewordpress +3

  2026-09-20
• 
  Vulnerability

  JetFormBuilder Privilege Escalation (CVE-2026-54196)

  CVE-2026-54196 is a CVSS 6.8 privilege escalation in the JetFormBuilder WordPress plugin, per VulnCheck alone.

  jetformbuildercrocoblockwordpress +3

  2026-09-20
• 
  Vulnerability

  Kirki Vulnerability (CVE-2026-16747)

  CVE-2026-16747 is a CVSS 6.5 unauthenticated shortcode-injection flaw in the Kirki WordPress plugin, per VulnCheck alone.

  kirkiwordpressinjection +2

  2026-09-20
• 
  Vulnerability

  Mail Mint Vulnerability (CVE-2026-84755)

  CVE-2026-84755 is a CVSS 6.5 unauthenticated broken access control in the Mail Mint WordPress plugin, per VulnCheck alone.

  mail-mintwpfunnelswordpress +4

  2026-09-20
• 
  Vulnerability

  Mailgun for WordPress SSRF (CVE-2026-78003)

  CVE-2026-78003 is a CVSS 9.8 SSRF flaw in Mailgun for WordPress enabling admin takeover via intercepted password resets, reported exploited by VulnCheck.

  mailgunwordpressssrf +3

  2026-09-20
• 
  Vulnerability

  MiniOrange SAML SP Single Sign On Privilege Escalation (CVE-2026-61979)

  CVE-2026-61979 is a CVSS 8.1 unauthenticated privilege escalation in a WordPress SAML SSO plugin, per VulnCheck alone.

  miniorangesamlwordpress +4

  2026-09-20
• 
  Vulnerability

  SAML Single Sign On – SSO Login Authentication Bypass (CVE-2026-15981)

  CVE-2026-15981 is a CVSS 9.8 authentication bypass in the MiniOrange SAML SSO WordPress plugin allowing login as any user, reported exploited by VulnCheck.

  miniorangewordpresssaml +3

  2026-09-20
• 
  Vulnerability

  Newfold WP Plugin Web Authentication Bypass (CVE-2026-80099)

  CVE-2026-80099 is a CVSS 8.8 authentication bypass in Newfold WordPress plugins, reported exploited by VulnCheck alone.

  newfoldwordpressauthentication-bypass +3

  2026-09-20
• 
  Vulnerability

  Events Manager Privilege Escalation (CVE-2026-18366)

  CVE-2026-18366 is a CVSS 9.8 flaw in the Events Manager WordPress plugin allowing unauthenticated Administrator takeover, reported exploited by VulnCheck.

  pixelitewordpressevents-manager +3

  2026-09-20
• 
  Vulnerability

  ProfilePress Vulnerability (CVE-2026-66047)

  CVE-2026-66047 is a CVSS 8.1 unauthenticated RCE in the ProfilePress WordPress plugin, reported exploited by VulnCheck alone.

  profilepresswordpressremote-code-execution +3

  2026-09-20
• 
  Vulnerability

  The Events Calendar Code Injection (CVE-2026-78159)

  CVE-2026-78159 is a CVSS 9.8 code injection flaw enabling unauthenticated RCE in WordPress plugin The Events Calendar, reported exploited by VulnCheck KEV.

  the-events-calendarstellarwpwordpress +4

  2026-09-20
• 
  Vulnerability

  The Events Calendar Insecure Deserialization (CVE-2026-78006)

  CVE-2026-78006 is a CVSS 9.8 deserialization flaw enabling unauthenticated RCE in WordPress plugin The Events Calendar, reported exploited by VulnCheck KEV.

  the-events-calendarstellarwpwordpress +4

  2026-09-20
• 
  Vulnerability

  TranslatePress – Translate Multilingual sites with AI Translation Vulnerability (CVE-2026-75981)

  CVE-2026-75981 is a CVSS 7.2 unauthenticated stored XSS in the TranslatePress WordPress plugin, per VulnCheck alone.

  translatepresswordpresscross-site-scripting +3

  2026-09-20
• 
  Vulnerability

  TranslatePress – Translate Multilingual sites with AI Translation Vulnerability (CVE-2026-19632)

  CVE-2026-19632 is a CVSS 9.8 flaw in the TranslatePress WordPress plugin exposing admin password-reset URLs, reported exploited by VulnCheck.

  cozmoslabswordpresstranslatepress +3

  2026-09-20
• 
  Vulnerability

  Tutor LMS – eLearning and online course solution Code Execution (CVE-2026-16759)

  CVE-2026-16759 is a CVSS 6.5 unauthenticated remote code execution flaw in the Tutor LMS WordPress plugin, per VulnCheck alone.

  tutor-lmsthemeumwordpress +4

  2026-09-20
• 
  Vulnerability

  Custom User Registration Fields for WooCommerce Privilege Escalation (CVE-2026-15369)

  CVE-2026-15369 is a CVSS 9.8 flaw in a WooCommerce checkout plugin allowing unauthenticated Administrator account creation, reported exploited by VulnCheck.

  addifywordpresswoocommerce +3

  2026-09-20
• 
  Vulnerability

  WooCommerce Lottery SQL Injection (CVE-2026-18884)

  CVE-2026-18884 is a CVSS 7.5 unauthenticated SQL injection in the WooCommerce Lottery WordPress plugin, per VulnCheck alone.

  woocommercewordpresssql-injection +3

  2026-09-20
• 
  Vulnerability

  Gift Cards For WooCommerce Pro Vulnerability (CVE-2026-15039)

  CVE-2026-15039 is a CVSS 9.8 unrestricted file upload flaw in a WooCommerce gift-card plugin allowing unauthenticated RCE, reported exploited by VulnCheck.

  wp-swingswordpresswoocommerce +4

  2026-09-20
• 
  Vulnerability

  WPMU DEV Dashboard Authentication Bypass (CVE-2026-76581)

  CVE-2026-76581 is a CVSS 9.8 authentication bypass in the WPMU DEV Dashboard plugin allowing administrator session forgery, reported exploited by VulnCheck.

  wpmudevwordpressauthentication-bypass +2

  2026-09-20
• 
  Vulnerability

  YITH WooCommerce Waitlist Premium Privilege Escalation (CVE-2026-14359)

  CVE-2026-14359 is a CVSS 8.8 privilege escalation in YITH WooCommerce Waitlist Premium, reported exploited by VulnCheck alone.

  yithwoocommercewordpress +4

  2026-09-20
• 
  Vulnerability

  GiveWP Insecure Deserialization (CVE-2026-82222)

  CVE-2026-82222 is a CVSS 10.0 deserialization flaw in the GiveWP WordPress donation plugin through 4.16.7.1, reported as exploited by VulnCheck's KEV catalog.

  givewpwordpressdeserialization +3

  2026-09-17
• 
  Vulnerability

  WP Compress Code Injection (CVE-2026-73343)

  CVE-2026-73343 is a CVSS 10.0 code injection flaw enabling unauthenticated RCE in WP Compress before 7.20.01, reported as exploited by VulnCheck's KEV catalog.

  wp-compresswordpresscode-injection +3

  2026-09-17
• 
  Vulnerability

  WP Cookie Notice Vulnerability (CVE-2026-82970)

  CVE-2026-82970 is a CVSS 10.0 unrestricted file upload flaw in the WP Cookie Notice WordPress plugin through 4.4.1, reported as exploited by VulnCheck KEV.

  wp-legal-pageswordpressfile-upload +3

  2026-09-17
• 
  Vulnerability

  Powerkit Cross-Site Scripting (CVE-2026-2390)

  CVE-2026-2390 is a stored cross-site scripting vulnerability in the Powerkit WordPress plugin, exploitable by Contributor-level users via a flawed regex-based HTML parser in the Lazy Load module.

  wordpresspowerkitxss +1

  2026-08-25