Skip to main content
Skip to footer
Opens in a new tab
Home
CVE Analysis
How it Works
Resources
Pricing
Log in
Create Account
Home
CVE Analysis
How it Works
Resources
Pricing
Log in
Create Account
Severity:
medium
CVE-2026-1613: Wonka Slide <= 1.3.3 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode PoC, Patch Analysis & Rule
March 18, 2026
CVE-2026-1613 affects the Wonka Slide plugin for WordPress (up to version 1.3.3) with a medium severity CVSS score of 6.4.…
CVE-2025-13463: Bold Page Builder <= 5.5.3 Authenticated (Author+) Stored DOM-based Cross-Site Scripting in Post Grid PoC, Patch Analysis & Rule
March 18, 2026
CVE-2025-13463 affects the Bold Page Builder plugin (up to version 5.5.3) with a CVSS score of 6.4. Authenticated attackers can…
CVE-2026-1675: Advanced Country Blocker <= 2.3.1 Unauthenticated Authorization Bypass via Insecure Default Secret Key PoC, Patch Analysis & Rule
March 18, 2026
CVE-2026-1675 affects the Advanced Country Blocker plugin for WordPress (up to v2.3.1), allowing unauthenticated bypass of geolocation blocking. Update to…
CVE-2026-1082: TITLE ANIMATOR <= 1.0 Cross-Site Request Forgery to Settings Update PoC, Patch Analysis & Rule
March 18, 2026
CVE-2026-1082 affects the Title Animator plugin for WordPress (v1.0) with a medium severity CVSS score of 4.3. Ensure you patch…
CVE-2026-1643: MP-Ukagaka <= 1.5.2 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
March 18, 2026
CVE-2026-1643 affects the Mp Ukagaka plugin for WordPress (up to version 1.5.2) with a medium severity CVSS score of 6.1.…
CVE-2026-1573: OMIGO <= 3.3 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode PoC, Patch Analysis & Rule
March 18, 2026
CVE-2026-1573 affects the Omigo plugin for WordPress (up to version 3.3) with a medium severity (CVSS 6.4) due to stored…
CVE-2026-1808: Orange Confort+ accessibility toolbar for WordPress <= 0.7 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
March 18, 2026
CVE-2026-1808 affects the Orange Confort Plus plugin (up to v0.7) with a CVSS score of 6.4. Authenticated users can exploit…
CVE-2026-1888: Docus <= 1.0.6 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
March 18, 2026
CVE-2026-1888 affects the Docus plugin for WordPress, versions up to 1.0.6, with a medium severity CVSS score of 6.4. Users…
CVE-2025-10753: OAuth Single Sign On – SSO (OAuth Client) <= 6.26.14 Missing Authorization PoC, Patch Analysis & Rule
March 18, 2026
CVE-2025-10753 affects the Miniorange Login With Eve Online Google Facebook plugin (up to version 6.26.14) with a CVSS score of…
CVE-2026-1293: Yoast SEO <= 26.8 Authenticated (Contributor+) Stored Cross-Site Scripting via 'yoast-schema' Block Attribute PoC, Patch Analysis & Rule
March 18, 2026
CVE-2026-1293 affects the Yoast SEO plugin for WordPress versions up to 26.8, with a medium severity (CVSS 6.4) due to…
CVE-2026-1785: Code Snippets <= 3.9.4 Cross-Site Request Forgery to Cloud Snippet Download/Update Actions PoC, Patch Analysis & Rule
March 18, 2026
CVE-2026-1785 affects the Code Snippets plugin for WordPress (up to version 3.9.4) with a medium severity CVSS score of 4.3…
CVE-2026-1252: Events Listing Widget <= 1.3.4 Authenticated (Author+) Stored Cross-Site Scripting via Event URL Field PoC, Patch Analysis & Rule
March 18, 2026
CVE-2026-1252 affects the Events Listing Widget plugin (up to v1.3.4) with a medium severity (CVSS 6.4) XSS vulnerability. Update to…
CVE-2025-15267: Bold Page Builder <= 5.5.7 Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_accordion_item Shortcode PoC, Patch Analysis & Rule
March 18, 2026
CVE-2025-15267 affects the Bold Page Builder plugin (up to v5.5.7) with a medium severity CVSS score of 6.4 due to…
CVE-2025-12803: Bold Builder <= 5.5.1 Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_tabs Shortcode PoC, Patch Analysis & Rule
March 18, 2026
CVE-2025-12803 affects the Bold Page Builder plugin (up to v5.5.1) with a medium severity CVSS score of 6.4. Authenticated attackers…
CVE-2025-68028: GA4WP: Google Analytics for WordPress <= 2.10.0 Missing Authorization PoC, Patch Analysis & Rule
March 18, 2026
CVE-2025-68028 affects the GA4WP plugin (up to v2.10.0) with a medium severity (CVSS 5.3) vulnerability allowing unauthorized access. Ensure you…
CVE-2026-1228: Timeline Block <= 1.3.3 Insecure Direct Object Reference to Authenticated (Author+) Private Timeline Exposure via Shortcode Attribute PoC, Patch Analysis & Rule
March 18, 2026
CVE-2026-1228 affects the Timeline Block plugin (up to v1.3.3) with a CVSS score of 4.3. Authenticated users can access private…
CVE-2026-1909: WaveSurfer-WP <= 2.8.3 Authenticated (Contributor+) Stored Cross-Site Scripting via 'src' Shortcode Attribute PoC, Patch Analysis & Rule
March 18, 2026
CVE-2026-1909 affects the WaveSurfer WP plugin (up to v2.8.3) with a medium severity CVSS score of 6.4 due to stored…
CVE-2026-1279: Employee Directory <= 1.2.1 Authenticated (Contributor+) Stored Cross-Site Scripting via 'form_title' Shortcode Attribute PoC, Patch Analysis & Rule
March 18, 2026
CVE-2026-1279 affects the Employee Staff Directory plugin (up to v1.2.1) with a medium severity (CVSS 6.4) cross-site scripting vulnerability. Update…
CVE-2025-68851: Okay Toolkit <= 2.3 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
March 18, 2026
CVE-2025-68851 affects the Okay Toolkit plugin for WordPress (up to version 2.3) with a medium severity CVSS score of 6.1.…
CVE-2025-68862: Woo File Dropzone <= 1.1.7 Authenticated (Subscriber+) Arbitrary File Deletion PoC, Patch Analysis & Rule
March 18, 2026
CVE-2025-68862 affects the Woo File Dropzone plugin (up to v1.1.7) with a CVSS score of 4.3. Authenticated users can exploit…
←
1
…
89
90
91
92
93
…
120
→