VulDB Recent Entries

A vulnerability classified as problematic has been found in wealcoder Animation Addons for Elementor Plugin up to 2.6.3. This impacts the function render of the file widgets/weather.php of the component Weather Widget. Performing a manipulation of the argument weather_style/move_direction results in cross site scripting. This vulnerability is reported as CVE-2026-15299. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability described as critical has been identified in ninjew GEO my WP Plugin up to 4.5.4 on WordPress. This affects the function gmw_locations_query of the file plugins/posts-locator/includes/class-gmw-wp-query.php of the component Proximity-Search Query. Such manipulation of the argument distance/lat/lng leads to sql injection. This vulnerability is documented as CVE-2026-15300. The attack can be executed remotely. There is not any exploit available.

A vulnerability marked as problematic has been reported in kingaddons King Addons for Elementor Plugin up to 51.1.62. The impacted element is the function add_to_submissions/king_addons_submissions_custom_column_content of the component Form Submission Handler. This manipulation of the argument form_page_id causes cross site scripting. This vulnerability is registered as CVE-2026-15284. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability labeled as problematic has been found in wpvividplugins WPvivid Backup for MainWP Plugin up to 0.9.33. The affected element is an unknown function of the component Admin Settings. The manipulation results in cross site scripting. This vulnerability is cataloged as CVE-2026-15283. The attack may be launched remotely. There is no exploit available.

A vulnerability identified as critical has been detected in wpdevart Booking Calendar Appointment Booking System Plugin up to 3.2.17. Impacted is an unknown function of the component SQL Query Handler. The manipulation of the argument wpdevart_id leads to sql injection. This vulnerability is listed as CVE-2026-15289. The attack may be initiated remotely. There is no available exploit.

A vulnerability categorized as critical has been discovered in rtcamp rtMedia Plugin up to 4.6.18. This issue affects some unknown processing of the component Query Handler. Executing a manipulation of the argument order_by can lead to sql injection. This vulnerability is tracked as CVE-2026-15287. The attack can be launched remotely. No exploit exists.

A vulnerability was found in themeatelier ChatHelp Plugin up to 3.1.3. It has been rated as problematic. This vulnerability affects unknown code of the file /wp-json/chat-help/v1/leads of the component REST API. Performing a manipulation results in information disclosure. This vulnerability is identified as CVE-2026-15291. The attack can be initiated remotely. There is not any exploit available.

A vulnerability was found in brainstormforce SureForms Plugin up to 2.2.1. It has been declared as problematic. This affects the function create_payment_intent/create_subscription_intent of the component Payment Intent Handler. Such manipulation leads to improper input validation. This vulnerability is referenced as CVE-2026-15288. It is possible to launch the attack remotely. No exploit is available.

A vulnerability was found in stellarwp Kadence Blocks Plugin up to 3.5.32. It has been classified as critical. Affected by this issue is the function get_items_permission_check of the component REST API Endpoint. This manipulation causes improper authorization. The identification of this vulnerability is CVE-2026-15286. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability was found in tenteeglobal Instant Appointment Plugin up to 1.2 and classified as critical. Affected by this vulnerability is the function insapp_upload_image_as_attachment of the component File Upload. The manipulation results in unrestricted upload. This vulnerability was named CVE-2026-15282. The attack may be performed from remote. There is no available exploit.

A vulnerability has been found in posimyththemes Plus Addons for Elementor Plugin up to 6.4.11 and classified as problematic. Affected is the function render of the file modules/widgets/tp_button.php of the component Button Widget. The manipulation of the argument custom_attributes leads to cross site scripting. This vulnerability is uniquely identified as CVE-2026-15285. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability, which was classified as critical, was found in wpmanageninja Fluent Forms Plugin up to 6.2.1. This impacts an unknown function of the component Payment Cancellation. Executing a manipulation of the argument subscription_id can lead to improper authorization. This vulnerability is handled as CVE-2026-5069. The attack can be executed remotely. There is not any exploit available.

A vulnerability, which was classified as very critical, has been found in OpenStack Ironic up to 29.0.5/32.0.1/35.0.1/37.0.0. This affects an unknown function of the component Authorization. Performing a manipulation results in improper authorization. This vulnerability is known as CVE-2026-44918. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability classified as critical was found in OpenStack Ironic up to 29.0.5/32.0.1/35.0.1/37.0.0. The impacted element is the function send_raw of the component IPMI Management Interface. Such manipulation leads to improper access controls. This vulnerability is traded as CVE-2026-54423. The attack may be launched remotely. There is no exploit available.

A vulnerability classified as problematic has been found in thimpress WP Hotel Booking Plugin up to 2.3.1. The affected element is an unknown function of the component Booking. This manipulation of the argument check_in_date/check_out_date causes cross site scripting. This vulnerability appears as CVE-2026-11392. The attack may be initiated remotely. There is no available exploit.

A vulnerability described as critical has been identified in arraytics WPCafe Plugin up to 3.0.14. Impacted is an unknown function of the component Notification Flow Workflows. The manipulation results in authorization bypass. This vulnerability is reported as CVE-2026-11818. The attack can be launched remotely. No exploit exists.

A vulnerability marked as critical has been reported in WebRehab Super Forms Plugin up to 6.3.313. This issue affects the function submit_form of the component AJAX Handler. The manipulation leads to unrestricted upload. This vulnerability is documented as CVE-2026-14894. The attack can be initiated remotely. There is not any exploit available.

A vulnerability labeled as problematic has been found in wordpresschef Salon Booking System Plugin up to 10.30.32. This vulnerability affects the function setCustomText of the file translate-constants.php of the component Admin Interface. Executing a manipulation of the argument Value can lead to cross-site request forgery. This vulnerability is registered as CVE-2026-15070. It is possible to launch the attack remotely. No exploit is available.

A vulnerability identified as problematic has been detected in wpazleen Post Export Import with Media Plugin up to 1.13.1. This affects the function ajax_import_media_start of the file shell.php of the component File Upload/Validation. Performing a manipulation results in unrestricted upload. This vulnerability is cataloged as CVE-2026-13430. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability categorized as critical has been discovered in Langroid up to 0.65.2. Affected by this issue is some unknown functionality of the component Chat Interface. Such manipulation leads to code injection. This vulnerability is listed as CVE-2026-54771. The attack may be performed from remote. There is no available exploit.