Export limit exceeded: 412491 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (412491 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-9833 | 1 Wordpress-extensions | 1 Tag Groups | 2026-11-10 | 7.1 High |
| The Tag Groups is the Advanced Way to Display Your Taxonomy Terms WordPress plugin before 2.2.0 does not properly escape one of its AJAX parameters before reflecting it in the response body served with an HTML content type, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of a logged-in user with `edit_pages` capability (Editor or higher) who is tricked into following a crafted link. | ||||
| CVE-2026-11767 | 1 Wordpress-extensions | 1 Crt Addons For Elementor | 2026-11-10 | 8.8 High |
| The Free Builder for Elementor WordPress plugin before 1.6.7 does not sanitise submitted contact form field values before storing them and outputting them in the admin dashboard, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute when a logged-in administrator views the form submissions. | ||||
| CVE-2026-13693 | 1 Wordpress-extensions | 1 Bit Form | 2026-11-10 | 5.9 Medium |
| The Bit Form WordPress plugin before 3.1.0 does not restrict a form file-field value to a safe path before reading the file and attaching it to a notification email, allowing unauthenticated attackers to read arbitrary server files such as the WordPress configuration file. | ||||
| CVE-2026-13694 | 1 Wordpress-extensions | 1 Bit Form | 2026-11-10 | 6.5 Medium |
| The Bit Form WordPress plugin before 3.1.0 does not properly validate its workflow-trigger token once the associated transient has expired, allowing unauthenticated attackers to re-trigger a form's configured workflow actions such as notification emails and integrations. | ||||
| CVE-2026-14183 | 1 Wordpress-extensions | 1 Classified Listing | 2026-11-10 | 4.3 Medium |
| The Classified Listing WordPress plugin before 5.3.9 does not verify that the order targeted by its payment-receipt handler belongs to the requesting user, allowing authenticated users with subscriber-level access to read the payment receipt details of any other user's order. | ||||
| CVE-2026-14185 | 1 Wordpress-extensions | 1 Wpbot | 2026-11-10 | 4.3 Medium |
| The WPBot WordPress plugin before 8.2.0 does not perform a capability or nonce check in one of its retrieval-augmented-generation settings handlers, allowing authenticated users with subscriber-level access to modify the WPBot WordPress plugin before 8.2.0's configuration. | ||||
| CVE-2026-8082 | 1 Wordpress-extensions | 1 Bpost Shipping Platform | 2026-11-10 | 7.5 High |
| The bpost-shipping-platform WordPress plugin before 3.2.3 does not properly sanitize a parameter before using it in a SQL query during WooCommerce order submission, allowing unauthenticated attackers to perform time-based blind SQL injection on stores running this bpost-shipping-platform WordPress plugin before 3.2.3. | ||||
| CVE-2026-12968 | 1 Wordpress-extensions | 1 Wowaddons | 2026-11-10 | 8.8 High |
| The Product Addons and Product Options With Custom Fields WordPress plugin before 1.6.15 does not restrict an unauthenticated file-upload endpoint and accepts SVG files that are stored and served inline, allowing an unauthenticated attacker to upload a malicious SVG whose embedded script executes in the session of any user (such as an administrator) who later opens the file. | ||||
| CVE-2026-12421 | 1 Wordpress-extensions | 1 Arforms | 2026-11-10 | 7.2 High |
| The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'password' Field Values in all versions up to, and including, 7.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-12877 | 1 Wordpress-extensions | 1 Software Issue Manager | 2026-11-10 | 9.1 Critical |
| The Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0 does not sanitise and escape user supplied input before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks. This is exploitable in the Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0's standard front-end issue-tracker configuration. | ||||
| CVE-2026-12394 | 1 Wordpress-extensions | 1 Memberglut | 2026-11-10 | 9.8 Critical |
| The MemberGlut WordPress plugin before 1.1.5 does not validate the role chosen during front-end registration, allowing unauthenticated users to register an account with an arbitrary role, including administrator, leading to full site compromise. | ||||
| CVE-2026-11351 | 1 Wordpress-extensions | 1 Shinystat Analytics | 2026-11-10 | 5.3 Medium |
| The ShinyStat Analytics WordPress plugin before 1.0.17 does not perform any authorization check on one of its REST API endpoints, allowing unauthenticated users to retrieve information about non-published (e.g. draft, pending or private) WooCommerce products. | ||||
| CVE-2026-11974 | 1 Wordpress-extensions | 1 Media Folder Addon | 2026-11-10 | 8.6 High |
| The wp-media-folder-addon WordPress plugin before 4.1.7 does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions available to unauthenticated users, leading to Arbitrary File Disclosure and Server-Side Request Forgery on sites where a cloud storage connection has been configured. This is an incomplete fix of CVE-2026-9690, whose patch hardened only one of the affected cloud-storage handlers and left the others unpatched. | ||||
| CVE-2026-14333 | 1 Wordpress-extensions | 1 Demi | 2026-11-10 | 7.5 High |
| The Demi WordPress plugin before 0.0.7 stores its full-site backup archives in a publicly accessible location under a predictable filename and without access protection, allowing unauthenticated attackers to download complete backups including the site database and its user password hashes. | ||||
| CVE-2026-14830 | 1 Wordpress-extensions | 1 Flxwoo | 2026-11-10 | 7.5 High |
| The FlxWoo WordPress plugin before 3.1.1 does not verify with the payment processor that a checkout session was actually paid before marking the associated order as paid, allowing unauthenticated attackers to complete WooCommerce orders without paying. | ||||
| CVE-2026-14833 | 1 Wordpress-extensions | 1 Lightbox With Photoswipe | 2026-11-10 | 6.8 Medium |
| The Lightbox with PhotoSwipe WordPress plugin before 5.9.0 does not sanitise or escape a link data attribute before rendering it into the image lightbox caption in the browser, allowing users with author-level access and above (who lack the unfiltered_html capability) to store JavaScript that runs when a visitor or administrator opens the lightbox. | ||||
| CVE-2026-14834 | 1 Wordpress-extensions | 1 Mailgun For Wordpress | 2026-11-10 | 6.5 Medium |
| The Mailgun for WordPress plugin before 2.2.1 does not perform any capability or nonce check on an unauthenticated AJAX action that adds subscribers to the site owner's configured email service mailing lists, allowing unauthenticated attackers to enrol arbitrary email addresses into those lists using the owner's stored API credentials. | ||||
| CVE-2026-14849 | 1 Wordpress-extensions | 1 Paid Member Subscriptions | 2026-11-10 | 3.7 Low |
| The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not protect the member and payment export files it writes to a predictable location in the uploads directory, allowing unauthenticated users to download the exported member and payment data (including PII) while an export artifact is present. | ||||
| CVE-2026-14922 | 1 Wordpress-extensions | 1 Wp Photo Album Plus | 2026-11-10 | 6.1 Medium |
| WP Photo Album Plus is vulnerable to stored Cross-Site Scripting in all versions up to, and including, 9.2.03.001 through a decode-after-sanitize (double-encoding) flaw in the photo-comment pipeline. On write, `wppa_do_comment()` sanitizes the comment with `wppa_filter_html()` (wp_kses) followed by `wp_strip_all_tags()` (`wppa-functions.php:2623-2624`). Because `wp_strip_all_tags()` only removes *real* tags, an attacker who submits a **double HTML-entity-encoded** payload (e.g. `&lt;img src=... onload=...&gt;`) passes the write filters as harmless entity text and is stored one decode-level down (`<img ... onload=...>`). | ||||
| CVE-2026-14927 | 1 Wordpress-extensions | 1 Fluentcart | 2026-11-10 | 3.7 Low |
| The FluentCart A New Era of eCommerce WordPress plugin before 1.5.3 does not perform any authorization or ownership check before rendering customer order documents keyed on a sequential numeric identifier, allowing unauthenticated visitors to enumerate and disclose customer personal data (names, email addresses, billing and shipping postal addresses, and order details) across the store. | ||||