Explore CVE records

MedPublished 08 Apr 2026, 15:30 WIB

CVE-2026-39476

WordPress User Feedback plugin <= 1.10.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Syed Balkhi User Feedback userfeedback-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Feedback: from n/a through <= 1.10.1.

Excerpt language: en.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 16:52 WIB

Official record

HighPublished 08 Apr 2026, 15:30 WIB

CVE-2026-39475

WordPress User Feedback plugin <= 1.10.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Syed Balkhi User Feedback userfeedback-lite allows Blind SQL Injection.This issue affects User Feedback: from n/a through <= 1.10.1.

Excerpt language: en.

MedPublished 08 Apr 2026, 15:30 WIB

CVE-2026-39473

WordPress Simple History plugin <= 5.24.0 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Pär Thernström Simple History simple-history allows Retrieve Embedded Sensitive Data.This issue affects Simple History: from n/a through <= 5.24.0.

Excerpt language: en.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 16:52 WIB

Official record

MedPublished 08 Apr 2026, 15:30 WIB

CVE-2026-39469

WordPress PageLayer plugin <= 2.0.8 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Softaculous PageLayer pagelayer allows Retrieve Embedded Sensitive Data.This issue affects PageLayer: from n/a through <= 2.0.8.

Excerpt language: en.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 16:52 WIB

Official record

HighPublished 08 Apr 2026, 15:30 WIB

CVE-2026-39466

WordPress Broken Link Checker plugin <= 2.4.7 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPMU DEV - Your All-in-One WordPress Platform Broken Link Checker broken-link-checker allows Blind SQL Injection.This issue affects Broken Link Checker: from n/a through <= 2.4.7.

Excerpt language: en.

CVSS7.6v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 16:52 WIB

Official record

MedPublished 08 Apr 2026, 15:30 WIB

CVE-2026-39464

WordPress Coming Soon Page, Under Construction & Maintenance Mode by SeedProd plugin <= 6.19.8 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery (SSRF) vulnerability in SeedProd Coming Soon Page, Under Construction & Maintenance Mode by SeedProd coming-soon allows Server Side Request Forgery.This issue affects Coming Soon Page, Under Construction & Maintenance Mode by SeedProd: from n/a through <= 6.19.8.

Excerpt language: en.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 16:52 WIB

Official record

MedPublished 08 Apr 2026, 15:23 WIB

CVE-2026-1396

Magic Conversation For Gravity Forms <= 3.0.97 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The Magic Conversation For Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'magic-conversation' shortcode in all versions up to, and including, 3.0.97 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated13 Apr 2026, 22:15 WIB

Official record

MedPublished 08 Apr 2026, 14:43 WIB

CVE-2026-4330

Blog2Social: Social Media Auto Post & Scheduler <= 8.8.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Schedule Modification via 'b2s_id' Parameter

The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to authorization bypass through user-controlled key in all versions up to, and including, 8.8.3. This is due to the plugin's AJAX handlers failing to validate that the user-supplied 'b2s_id' parameter belongs to the current user befo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:32 WIB

Official record

MedPublished 08 Apr 2026, 14:43 WIB

CVE-2026-4654

Awesome Support <= 6.3.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Unauthorized Ticket Reply Access via 'ticket_id' Parameter

The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 6.3.7. This is due to the wpas_get_ticket_replies_ajax() function failing to verify whether the authenticated user has permission to view the specific ticket…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 01:50 WIB

Official record

MedPublished 08 Apr 2026, 14:43 WIB

CVE-2026-4655

Element Pack Addons for Elementor <= 8.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Image Widget

The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the SVG Image Widget in versions up to and including 8.4.2. This is due to insufficient input sanitization and output escaping on SVG content fetched from remote URLs in the render_svg() function. The function fe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:34 WIB

Official record

HighPublished 08 Apr 2026, 14:25 WIB

CVE-2026-4483

An exposed IOCTL with an insufficient access control vulnerability has been identified in the utility, MxGeneralIo, for Moxa’s industrial x86 computers. The affected utility, MxGeneralIo, exposes IOCTL methods that permit direct read and write access to MSR and system memory. A local attacker with high privileges coul…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS7v4.0KEVNot listedEPSSPresentUpdated08 Apr 2026, 20:53 WIB

Official record

MedPublished 08 Apr 2026, 13:43 WIB

CVE-2025-1794

AM LottiePlayer <= 3.6.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG

The AM LottiePlayer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via uploaded SVG files in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:31 WIB

Official record

MedPublished 08 Apr 2026, 13:43 WIB

CVE-2026-3781

Attendance Manager <= 0.6.2 - Authenticated (Subscriber+) SQL Injection via 'attmgr_off' Parameter

The Attendance Manager plugin for WordPress is vulnerable to SQL Injection via the 'attmgr_off' parameter in all versions up to, and including, 0.6.2. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticate…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:31 WIB

Official record

MedPublished 08 Apr 2026, 13:43 WIB

CVE-2026-4141

Quran Translations <= 1.7 - Cross-Site Request Forgery to Playlist Settings Form

The Quran Translations plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7. This is due to missing nonce validation in the quran_playlist_options() function that handles the plugin's settings page. The function processes POST requests to update plugin options via u…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:29 WIB

Official record

MedPublished 08 Apr 2026, 13:43 WIB

CVE-2026-2838

Whole Enquiry Cart for WooCommerce <= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'woowhole_success_msg' Parameter

The Whole Enquiry Cart for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘woowhole_success_msg’ parameter in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS4.4v3.1KEVNot listedEPSSPresentUpdated13 Apr 2026, 22:15 WIB

Official record

MedPublished 08 Apr 2026, 13:43 WIB

CVE-2026-5506

Wavr <= 0.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The Wavr plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `wave` shortcode in all versions up to, and including, 0.2.6. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-l…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:26 WIB

Official record

MedPublished 08 Apr 2026, 13:43 WIB

CVE-2026-3618

Columns by BestWebSoft <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'columns' Shortcode 'id' Attribute

The Columns by BestWebSoft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' shortcode attribute of the [print_clmns] shortcode in all versions up to and including 1.0.3. This is due to insufficient input sanitization and output escaping on the 'id' attribute. The shortcode receives the 'id…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated13 Apr 2026, 22:15 WIB

Official record

MedPublished 08 Apr 2026, 13:43 WIB

CVE-2026-5167

Masteriyo LMS <= 2.1.7 - Unauthenticated Authorization Bypass to Arbitrary Order Completion via Stripe Webhook Endpoint

The Masteriyo LMS – Online Course Builder for eLearning, LMS & Education plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in versions up to and including 2.1.7. This is due to insufficient webhook signature verification in the handle_webhook() function. The webhook endpoint process…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:17 WIB

Official record

MedPublished 08 Apr 2026, 13:43 WIB

CVE-2026-3477

PZ Frontend Manager <= 1.0.6 - Missing Authorization to Arbitrary User Deletion via 'dataType' Parameter

The PZ Frontend Manager plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.0.6. The pzfm_user_request_action_callback() function, registered via the wp_ajax_pzfm_user_request_action action hook, lacks both capability checks and nonce verification. This function handles use…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:06 WIB

Official record

MedPublished 08 Apr 2026, 13:43 WIB

CVE-2026-5508

WowPress <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The WowPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `wowpress` shortcode in all versions up to, and including, 1.0.0. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:05 WIB

Official record

Find the CVE cohort

Severity

Matching records by UTC month

Signal coverage

Find the CVE cohort

Matching cohort composition

Severity

Matching records by UTC month

Signal coverage