CVE Notifier

CVE-2026-84904 CWE-? N/A

King Addons for Elementor 51.1.56 - 51.1.80 - Author+ Missing Authorization via Image Optimizer

The King Addons for Elementor WordPress plugin before 51.1.81 does not perform per-object authorization checks on a group of image-optimization actions, gating them only on a coarse capability that lower-privileged user…

WPScan Unknown:King · Addons · for 2 hari lalu

CVE-2026-84903 CWE-? N/A

King Addons for Elementor < 51.1.81 - Contributor+ Private Post Content Disclosure via kng_maintenance_page Shortcode

The King Addons for Elementor WordPress plugin before 51.1.81 does not perform any capability, post-status, or password check before rendering the content of a user-supplied post, allowing users with Contributor-level a…

WPScan Unknown:King · Addons · for 2 hari lalu

CVE-2026-84902 CWE-? N/A

King Addons for Elementor < 51.1.81 - Contributor+ Stored XSS via Template Catalog Import

The King Addons for Elementor WordPress plugin before 51.1.81 does not perform an object-level authorization check when importing template content into a page, allowing users with contributor-level access and above to o…

WPScan Unknown:King · Addons · for 2 hari lalu

CVE-2026-84738 CWE-? N/A

AF Companion < 2.2.0 - Shop Manager+ Arbitrary File Upload to RCE

The AF Companion WordPress plugin before 2.2.0 does not validate the type of files uploaded through one of its import features, allowing users with a low-privileged store-management role to upload arbitrary files, inclu…

WPScan Unknown:AF · Companion 2 hari lalu

CVE-2026-81810 CWE-? N/A

All-in-One WP Migration and Backup < 7.111 - Authenticated Privilege Escalation to Admin via Import Secret Key Disclosure

The All-in-One WP Migration and Backup WordPress plugin before 7.111 does not perform any capability check on several of its AJAX actions, gating them only on an installation-wide secret which it discloses to any user pe…

WPScan Unknown:All-in-One · WP · Migration 2 hari lalu

CVE-2026-81340 CWE-? N/A

MasterStudy LMS < 3.7.50 - Instructor+ Order Status Manipulation via IDOR

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updating orders through its REST API, allowing users with the Instructor role to modify…

WPScan Unknown:MasterStudy · LMS · WordPress 2 hari lalu

CVE-2026-93485 CWE-79 7.1

WordPress core <= 7.1 - Unauth. Cross Site Scripting (XSS) vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Automattic WordPress core allows DOM-Based XSS. This issue affects WordPress versions 7.1 before 7.1.1; 7.0 through …

cve.org Automattic:WordPress · Automattic:WordPress · Automattic:WordPress 2 hari lalu

CVE-2026-18912 CWE-89 7.7

CVE-2026-18912

ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allowing an authenticated technician to execute arbitrary SQL queries through the Reports module.

cve.org Zohocorp:ManageEngine · DataSecurity · Plus 2 hari lalu

CVE-2026-18911 CWE-20 7.5

CVE-2026-18911

ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an agent authentication bypass, allowing unenrolled agents to send requests without proper authentication.

cve.org Zohocorp:ManageEngine · DataSecurity · Plus 2 hari lalu

CVE-2026-17086 CWE-502 8.8

ShortPixel Image Optimizer <= 6.5.5 - Authenticated (Author+) PHP Object Injection via Nested JSON Post Content

The ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.5.5 via deserialization of untrusted input . This m…

Wordfence shortpixel:ShortPixel · Image · Optimizer 2 hari lalu

CVE-2026-92991 CWE-79 5.4

Biggopti Library (Various Versions) - Cross-Site Scripting via display_id from Sigmative API

The Biggop Library is vulnerable to Cross-Site Scripting via the ‘display_id’ parameter from the Sigmative API in various versions due to insufficient output escaping. This makes it possible for attackers who can comprom…

Wordfence bdthemes:Live · Copy · Paste 2 hari lalu

CVE-2026-14855 CWE-79 6.4

RT Mega Menu <= 1.5.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via rtmega_update_menu_options AJAX Action

The RT Mega Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'css[left]' parameter in all versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping. Thi…

Wordfence themewant:RT · Mega · Menu 2 hari lalu