Ajax

WavePlayer Unauthenticated Arbitrary File Upload to RCE (CVE-2025-12057) newCVE-2025-12057webCRITICAL 9.8Unverified2026-07-06YayMail WooCommerce Plugin Missing Authorization to Privilege Escalation — CVE-2026-1937 newCVE-2026-1937webHIGH 7.2Unverified2026-07-05WP Captcha PRO Subscriber-to-Administrator Authentication Bypass — CVE-2026-5415 newCVE-2026-5415webHIGH 8.8Unverified2026-07-05WordPress SignUp/SignIn & Invoice Generator Password-Reset Account Takeover (CVE-2026-12416 / CVE-2026-12417) newCVE-2026-12416, CVE-2026-12417webCRITICAL 9.8Unverified2026-07-05WebStack WordPress Theme Unauthenticated Arbitrary File Upload RCE — CVE-2026-1555 newCVE-2026-1555webCRITICAL 9.8Unverified2026-07-05User Registration & Membership Unauthenticated Admin Privilege Escalation (CVE-2026-1492) new EPSS 24%CVE-2026-1492webCRITICAL 9.8Unverified2026-07-05Simple File List Plugin Unauthenticated File Modification / Path Traversal — CVE-2026-11912 newCVE-2026-11912webHIGH 7.5Patched2026-07-05Schema & Structured Data for WP & AMP Unauthenticated Unrestricted File Upload (CVE-2026-9067) newCVE-2026-9067webHIGH 8.1Unverified2026-07-05Prodigy Commerce WordPress Plugin — Unauthenticated Local File Inclusion (CVE-2026-0926) newCVE-2026-0926webHIGHUnverified2026-07-05OpenSTAManager Global Search Amplified Time-Based Blind SQL Injection — CVE-2026-24417 newCVE-2026-24417webHIGHPatched2026-07-05OpenSTAManager Article Pricing Time-Based Blind SQL Injection — CVE-2026-24416 newCVE-2026-24416webHIGHPatched2026-07-05midi-Synth WordPress Plugin Arbitrary File Upload (CVE-2026-1306) newCVE-2026-1306webCRITICAL 9.8Unverified2026-07-05LatePoint Calendar Booking Plugin Contributor-to-Administrator Privilege Escalation (CVE-2026-49083) newCVE-2026-49083webHIGH 8.8Unverified2026-07-05LA-Studio Element Kit for Elementor — Unauthenticated Admin Account Creation (CVE-2026-0920) newCVE-2026-0920webCRITICAL 9.8Unverified2026-07-05JetSearch WordPress Plugin Unauthenticated SQL Injection (CVE-2026-49079) newCVE-2026-49079webHIGH 7.5Unverified2026-07-05EventPrime WordPress Plugin Unauthenticated Arbitrary File Upload — CVE-2026-1657 newCVE-2026-1657webMEDIUMPatched2026-07-05Easy Elements for Elementor Unauthenticated Privilege Escalation via `custom_meta` Overwrite (CVE-2026-9018) newCVE-2026-9018webHIGH 8.8Patched2026-07-05Dolibarr selectobject.php Authenticated Local File Inclusion (CVE-2026-34036) newCVE-2026-34036webMEDIUMPatched2026-07-05AdForest WordPress Theme OTP Login Authentication Bypass — CVE-2026-1729 newCVE-2026-1729webCRITICALUnverified2026-07-05