CVE Notifier

CVE-2026-7527 CWE-601 4.7

WP Ghost (Hide My WP Ghost) <= 7.0.02 - Unauthenticated Open Redirect via 'redirect_to' Parameter

The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 7.0.02. This is due to the plugin not properly validating user input. This m…

cve.org johndarrel:Hide · My · WP 9 jam lalu

CVE-2026-5400 CWE-79 6.4

Redux Framework <= 4.5.13 - Authenticated (Subscriber+) Cross-Site Scripting via User Input

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Media field filter values in versions up to, and including, 4.5.13 This is due to insufficient input sanitization of nested ar…

cve.org davidanderson:Redux · Framework 9 jam lalu

CVE-2026-75959 CWE-89 4.9

GoPay for WooCommerce <= 1.0.36 - Authenticated (Shop Manager+) SQL Injection via 'log_table_filter' Parameter

The GoPay for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'log_table_filter' parameter in all versions up to, and including, 1.0.36 due to insufficient escaping on the user supplied pa…

cve.org gopayplugins:GoPay · for · WooCommerce 9 jam lalu

CVE-2026-13200 CWE-89 6.5

Create <= 2.5.3 - Authenticated (Author+) SQL Injection via 'order' Parameter

The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'order' parameter in all versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of suffici…

cve.org mischiefmarmot:Create 9 jam lalu

CVE-2026-12402 CWE-79 4.4

OTP Login & Register Woocommerce <= 2.7.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'fb-config' Setting

The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fb-config' Setting in all versions up to, and including, 2.7.3 due to insufficient input sanitization and output…

cve.org xootix:OTP · Login · & 9 jam lalu

CVE-2026-4327 CWE-94 8.8

The Welcomizer <= 2.8.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'twiz_custom_logic' Parameter

The The Welcomizer plugin for WordPress is vulnerable to Remote Code Execution in all versions up to and including 2.8.1. This is due to missing authorization checks on the twiz_ajax_callback AJAX action's 'savesection' …

cve.org sebwordpress:The · Welcomizer 9 jam lalu

CVE-2026-2422 CWE-79 6.4

WP Composer <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pbwp_raw_shortcode' Shortcode

The WP Composer – The Easiest Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pbwp_raw_shortcode' shortcode in all versions up to, and including, 1.0.5. This is due to the shortcod…

cve.org ghozylab:WP · Composer · – 9 jam lalu

CVE-2026-1641 CWE-918 6.5

Wow Elements Addons for Elementor <= 1.11.2 - Authenticated (Contributor+) Server-Side Request Forgery via Changelog File Setting

The Wow Elements Addons for Elementor plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.11.2. This is due to the plugin passing user-controlled input from the 'Chan…

cve.org wowelements:Wow · Elements · Addons 9 jam lalu

CVE-2026-9232 CWE-862 6.5

Easy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Sensitive Customer Information Exposure via ea_get_customers_ajax AJAX Action

The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.27 via the handle_customers_ajax. This makes it possible for authenticated attackers, …

cve.org easyappointments:Easy · Appointments 9 jam lalu

CVE-2026-15463 CWE-79 6.1

SSL Zen <= 4.7.42 - Reflected Cross-Site Scripting via 'uri' and 'host' Parameters

The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'host' parameter in all versions up to, and including, 4.7.42 due to insufficient inp…

cve.org sslzen:SSL · Zen · — 9 jam lalu

CVE-2026-6295 CWE-89 4.9

WP Optimizer <= 2.5.0 - Authenticated (Administrator+) SQL Injection via 's' Parameter

The WP Optimizer plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to and including 2.5.0. This is due to an unsafe subquery-detection branch in the Query::parse_key_compare_fie…

cve.org sh1zen:WP · Optimizer · – 9 jam lalu

CVE-2026-15946 CWE-862 4.3

Search Atlas SEO <= 2.6.23 - Missing Authorization to Authenticated (Subscriber+) Whitelabel Password Modification via handle_whitelabel_password_early Function

The Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.23. This is due to t…

cve.org shahrukhlinkgraph:Search · Atlas · SEO 9 jam lalu