Skip to main content
Skip to footer
Opens in a new tab
Home
CVE Analysis
How it Works
Resources
Pricing
Log in
Create Account
Home
CVE Analysis
How it Works
Resources
Pricing
Log in
Create Account
Severity:
medium
CVE-2026-1249: MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar 5.3 5.10 Authenticated (Author+) Server-Side Request Forgery PoC, Patch Analysis & Rule
March 18, 2026
CVE-2026-1249 affects the Mp3 Music Player by Sonaar plugin (versions 5.3 to 5.10) with a medium severity CVSS score of…
CVE-2026-2312: Media Library Folders <= 8.3.6 Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Attachment Deletion and Rename PoC, Patch Analysis & Rule
March 18, 2026
CVE-2026-2312 affects the Media Library Plus plugin (up to v8.3.6) with a CVSS score of 4.3. Authenticated users can delete…
CVE-2026-25331: Activity Log <= 5.5.4 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
March 18, 2026
CVE-2026-25331 affects the Wp Security Audit Log plugin (up to 5.5.4) with a medium severity (CVSS 6.4) stored XSS vulnerability.…
CVE-2026-1512: Essential Addons for Elementor <= 6.5.9 Authenticated (Contributor+) Stored Cross-Site Scripting via Info Box Widget PoC, Patch Analysis & Rule
March 18, 2026
CVE-2026-1512 affects the Essential Addons for Elementor Lite plugin (up to v6.5.9) with a medium severity CVSS score of 6.4.…
CVE-2026-25348: Download Alt Text AI <= 1.10.15 Missing Authorization PoC, Patch Analysis & Rule
March 18, 2026
CVE-2026-25348 affects the Alttext Ai plugin for WordPress (up to version 1.10.15) with a medium severity CVSS score of 5.3.…
CVE-2026-25364: Client Invoicing by Sprout Invoices <= 20.8.8 Missing Authorization PoC, Patch Analysis & Rule
March 18, 2026
CVE-2026-25364 affects the Sprout Invoices plugin (up to version 20.8.8) with a medium severity score of 5.3. Unauthenticated attackers can…
CVE-2026-25362: FooGallery <= 3.1.11 Authenticated (Author+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
March 18, 2026
CVE-2026-25362 affects the FooGallery plugin for WordPress (up to version 3.1.11) with a medium severity CVSS score of 6.4. Users…
CVE-2026-1793: Element Pack Addons for Elementor <= 8.3.17 Authenticated (Contributor+) Arbitrary File Read PoC, Patch Analysis & Rule
March 18, 2026
CVE-2026-1793 affects Bdthemes Element Pack Lite plugin (up to v8.3.17) with a CVSS of 6.5. Authenticated users can exploit a…
CVE-2026-0550: myCred <= 2.9.7.3 Authenticated (Contributor+) Stored Cross-Site Scripting via 'mycred_load_coupon' Shortcode PoC, Patch Analysis & Rule
March 18, 2026
CVE-2026-0550 affects the myCred WordPress plugin (up to version 2.9.7.3) with a medium severity XSS vulnerability. Users should upgrade to…
CVE-2025-15483: Link Hopper <= 2.5 Authenticated (Administrator+) Stored Cross-Site Scripting via 'hop_name' Parameter PoC, Patch Analysis & Rule
March 18, 2026
CVE-2025-15483 affects the Link Hopper plugin (up to v2.5) with a medium severity CVSS score of 4.4. Authenticated attackers can…
CVE-2026-1254: Modula Image Gallery – Photo Grid & Video Gallery <= 2.13.6 Missing Authorization to Authenticated (Contributor+) Arbitrary Post/Page Editing PoC, Patch Analysis & Rule
March 18, 2026
CVE-2026-1254 affects the Modula Best Grid Gallery plugin (up to 2.13.6) with a medium severity CVSS of 4.3. Authenticated users…
CVE-2026-1303: MailChimp Campaigns <= 3.2.4 Missing Authorization to Authenticated (Subscriber+) MailChimp App Disconnection PoC, Patch Analysis & Rule
March 18, 2026
CVE-2026-1303 affects the Olalaweb Mailchimp Campaign Manager plugin (up to v3.2.4) with a medium severity (CVSS 5.3) flaw allowing authenticated…
CVE-2025-14852: MDirector Newsletter <= 4.5.8 Cross-Site Request Forgery to Plugin Settings Update PoC, Patch Analysis & Rule
March 18, 2026
CVE-2025-14852 affects the MDirector Newsletter plugin for WordPress (up to 4.5.8) with a medium severity CVSS score of 4.3. Patch…
CVE-2026-0735: User Language Switch <= 1.6.10 Authenticated (Administrator+) Stored Cross-Site Scripting via 'tab_color_picker_language_switch' Parameter PoC, Patch Analysis & Rule
March 18, 2026
CVE-2026-0735 affects the User Language Switch plugin for WordPress (up to 1.6.10) with a medium severity CVSS of 4.4. Authenticated…
CVE-2026-1394: WP Quick Contact Us <= 1.0 Cross-Site Request Forgery to Settings Update PoC, Patch Analysis & Rule
March 18, 2026
CVE-2026-1394 affects the WP Quick Contact Us plugin (v1.0) with a medium severity CVSS score of 4.3 due to a…
CVE-2026-2022: Smart Forms <= 2.6.99 Missing Authorization to Authenticated (Subscriber+) Campaign Data Exposure PoC, Patch Analysis & Rule
March 18, 2026
CVE-2026-2022 affects the Smart Forms plugin (up to version 2.6.99) with a medium severity (CVSS 4.3) vulnerability. Authenticated users can…
CVE-2026-1903: Ravelry Designs Widget <= 1.0.0 Authenticated (Contributor+) Stored Cross-Site Scripting via 'sb_ravelry_designs' Shortcode 'layout' Attribute PoC, Patch Analysis & Rule
March 18, 2026
CVE-2026-1903 affects the Ravelry Designs Widget plugin (up to 1.0.0) with a CVSS score of 6.4. Authenticated users can exploit…
CVE-2026-1985: Press3D <= 1.0.2 Authenticated (Author+) Stored Cross-Site Scripting via Link URL Parameter in 3D Model Block PoC, Patch Analysis & Rule
March 18, 2026
CVE-2026-1985 affects the Press3D plugin (up to v1.0.2) with a CVSS score of 6.4 due to stored cross-site scripting. Users…
CVE-2026-0736: Chatbot for WordPress by Collect.chat ⚡️ <= 2.4.8 Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta Field PoC, Patch Analysis & Rule
March 18, 2026
CVE-2026-0736 affects the Collect.chat plugin (up to v2.4.8) with a medium severity CVSS score of 6.4. Authenticated users can exploit…
CVE-2026-1910: UpMenu <= 3.1 Authenticated (Contributor+) Stored Cross-Site Scripting via 'upmenu-menu' Shortcode 'lang' Attribute PoC, Patch Analysis & Rule
March 18, 2026
CVE-2026-1910 affects the UpMenu plugin for WordPress (up to v3.1) with a medium severity CVSS of 6.4. Authenticated attackers can…
←
1
…
110
111
112
113
114
…
120
→