CVE Notifier

CVE-2026-86824 CWE-? N/A

Newsletter < 9.3.8 - Unauthenticated Subscriber PII Disclosure and Modification via Predictable Tracking Signature Key

The Newsletter WordPress plugin before 9.3.8 does not generate its email tracking signing key with sufficient entropy and signs its tracking links with an unkeyed hash, allowing an unauthenticated attacker who recovers …

WPScan Unknown:Newsletter 5 hari lalu

CVE-2026-86788 CWE-? N/A

HT Mega 3.2.0 - 3.2.5 - Contributor+ Stored XSS via Section Headline Tag

The HT Mega Addons for Elementor WordPress plugin before 3.2.6 does not restrict the HTML tag name used to render the section headline in several of its widgets and blocks to a safe allowlist, allowing users with contri…

WPScan Unknown:HT · Mega · Addons 5 hari lalu

CVE-2026-86710 CWE-? N/A

Login with QR <= 1.0.0 - Unauthenticated Authentication Bypass via 'autologin_code' Parameter

The Login with QR WordPress plugin through 1.0.0 does not verify that the code used to log a user in is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as …

WPScan Unknown:Login · with · QR 5 hari lalu

CVE-2026-86709 CWE-? N/A

The Pressengine <= 1.0 - Unauthenticated Authentication Bypass

The Pressengine WordPress plugin through 1.0 does not stop its login handler from issuing a session when authentication fails, allowing unauthenticated attackers to log in as any user, including administrators.

WPScan Unknown:The · Pressengine 5 hari lalu

CVE-2026-86707 CWE-? N/A

Private Feed Key <= 0.1 - Unauthenticated Authentication Bypass via 'feedkey' Parameter

The Private Feed Key WordPress plugin through 0.1 does not verify that the key used to authenticate a feed request is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers…

WPScan Unknown:Private · Feed · Key 5 hari lalu

CVE-2026-86446 CWE-? N/A

LearnPress 4.4.3 - 4.4.6 - Unauthenticated Quiz Answer Disclosure via check-answer REST Endpoint

The LearnPress WordPress plugin before 4.4.7 does not restrict the correctness flags it returns when a quiz answer is checked, allowing unauthenticated attackers to obtain the correct answer to every option of a questio…

WPScan Unknown:LearnPress 5 hari lalu

CVE-2026-85130 CWE-? N/A

WPLP Cookie Consent < 4.4.4 - Unauthenticated Stored XSS via Consent Logs

The WPLP Cookie Consent WordPress plugin before 4.4.4 does not escape a value submitted through a public endpoint for the JavaScript context it is later output in on an administrative screen, allowing unauthenticated us…

WPScan Unknown:WPLP · Cookie · Consent 5 hari lalu

CVE-2026-85128 CWE-? N/A

Choose User Role at Registration for WooCommerce < 1.3.3 - Unauthenticated Privilege Escalation via Registration Role Request

The Choose User Role at Registration WordPress plugin before 1.3.3 does not validate the role requested at registration against the roles an administrator chose to offer, allowing unauthenticated users to request any rol…

WPScan Unknown:Choose · User · Role 5 hari lalu

CVE-2025-15697 CWE-? N/A

Dictionary <= 1.0 - Reflected XSS via Multiple Parameters

The Dictionary WordPress plugin through 1.0 does not escape user input before reflecting it back in the responses of several directly accessible scripts, allowing unauthenticated attackers to perform Reflected Cross-Site…

WPScan Unknown:Dictionary 5 hari lalu

CVE-2026-87796 CWE-434 9.8

Multi Uploader for Gravity Forms <= 1.1.9 - Unauthenticated Arbitrary File Upload via Chunked File Upload

The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.1.9 via the move_file function. This is due to insufficient file type validation du…

cve.org sh1zen:Multi · Uploader · for 6 hari lalu

CVE-2026-87935 CWE-434 8.1

Paid Downloads <= 3.15 - Unauthenticated Arbitrary File Upload via 'paiddownloads_update_file' Action

The Paid Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.15 via the admin_request_handler function. This is due to missing authorization and file type validat…

Wordfence ichurakov:Paid · Downloads 6 hari lalu

CVE-2026-25294 CWE-126 7.4

Buffer Over-read in WLAN Firmware

Transient DOS while parsing frame during channel usage.

cve.org Qualcomm, · Inc.:Snapdragon 6 hari lalu