Export limit exceeded: 411365 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (411365 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-121796 | 2026-11-07 | 6.8 Medium | ||
| The Add From Server Lite WordPress plugin before 6.0.0 does not restrict SVG uploads to users allowed to post unfiltered HTML, allowing users with the Author role and above to upload SVG files containing JavaScript and perform Stored XSS attacks. | ||||
| CVE-2026-121858 | 2026-11-07 | 6.3 Medium | ||
| The Event Tickets with Ticket Scanner WordPress plugin before 3.2.9 does not properly escape a search value before using it in SQL queries in several of its admin listings, allowing users with access to its admin area (administrators by default, or any role granted access in its settings) to perform SQL injection attacks. | ||||
| CVE-2026-122001 | 2026-11-07 | 8.8 High | ||
| The Komfortkasse for WooCommerce WordPress plugin before 1.4.9 does not properly validate the authenticity of REST API requests, overriding WordPress's own nonce verification so that a request forged in a logged-in administrator's browser is accepted, which can be used to create a new administrator account and fully take over the site. | ||||
| CVE-2026-124057 | 1 Totolink | 2 Ca300-poe, Ca300-poe Firmware | 2026-11-07 | 9.1 Critical |
| A security flaw has been discovered in TOTOLINK CA300-PoE 6.2c.884. This impacts the function setWiFiMultipleConfig of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument Key1Str1 results in buffer overflow. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. | ||||
| CVE-2026-124059 | 1 Totolink | 2 Ca300-poe, Ca300-poe Firmware | 2026-11-07 | 9.1 Critical |
| A security vulnerability has been detected in TOTOLINK CA300-PoE 6.2c.884. Affected by this vulnerability is the function setWiFiWdsAddConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ApCliKeyStr leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. | ||||
| CVE-2026-97191 | 2026-11-07 | 2.7 Low | ||
| The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not re-apply its field-group location rules when persisting values submitted through the post editor save path, allowing users with contributor-level access and above to write custom fields the site restricted to administrators onto their own posts. | ||||
| CVE-2026-118534 | 2026-11-07 | 4.3 Medium | ||
| The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify that the order targeted by its checkout payment-retry REST action belongs to the requesting user, allowing any authenticated user, such as a subscriber, to create payment-attempt records against other users' orders. | ||||
| CVE-2026-121380 | 2026-11-07 | 5.3 Medium | ||
| The Tournamatch WordPress plugin before 4.7.1 does not restrict access to its team invitation listing, allowing unauthenticated users to retrieve the email addresses of people invited to join teams. | ||||
| CVE-2026-121857 | 2026-11-07 | 4.2 Medium | ||
| The Event Tickets with Ticket Scanner WordPress plugin before 3.1.14 does not check that a user may manage WooCommerce orders before returning or removing ticket data for any order, allowing any role an administrator has granted access to the Event Tickets with Ticket Scanner WordPress plugin before 3.1.14's admin area (down to Subscriber) to view other customers' ticket codes and names and to remove tickets from their orders. | ||||
| CVE-2026-124058 | 1 Totolink | 2 Ca300-poe, Ca300-poe Firmware | 2026-11-07 | 9.1 Critical |
| A weakness has been identified in TOTOLINK CA300-PoE 6.2c.884. Affected is the function setWiFiRepeaterConfig of the file /cgi-bin/cstecgi.cgi. Executing a manipulation of the argument ApCliKeyStr can lead to buffer overflow. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. | ||||
| CVE-2026-66669 | 2026-11-07 | 8.8 High | ||
| Cross-Site Request Forgery (CSRF) vulnerability in Suplugins Superb Addons: Blocks, Patterns & Theme Designer superb-blocks allows Cross Site Request Forgery.This issue affects Superb Addons: Blocks, Patterns & Theme Designer: from n/a through 4.2.4. | ||||
| CVE-2026-52713 | 2 Thimpress, Wordpress-extensions | 2 Learnpress, Learnpress | 2026-11-07 | 5.4 Medium |
| Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.12. | ||||
| CVE-2026-124274 | 2026-11-07 | 5.3 Medium | ||
| Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2. | ||||
| CVE-2026-124258 | 2026-11-07 | 5.3 Medium | ||
| Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.3.1. | ||||
| CVE-2026-123861 | 2026-11-07 | 5.3 Medium | ||
| Authorization Bypass Through User-Controlled Key vulnerability in CrocoBlock JetFormBuilder – Hierarchical Select jet-form-builder-hierarchical-select allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder – Hierarchical Select: from n/a through 1.0.10. | ||||
| CVE-2026-123474 | 2026-11-07 | 5.3 Medium | ||
| Missing Authorization vulnerability in LeapWorx Premium Blocks – Gutenberg Blocks for WordPress premium-blocks-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premium Blocks – Gutenberg Blocks for WordPress: from n/a through 2.3.18. | ||||
| CVE-2026-123468 | 2026-11-07 | 4.3 Medium | ||
| Missing Authorization vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a through 1.4.128. | ||||
| CVE-2026-123467 | 2026-11-07 | 4.3 Medium | ||
| Missing Authorization vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a through 1.4.128. | ||||
| CVE-2026-123466 | 2026-11-07 | 5.3 Medium | ||
| Missing Authorization vulnerability in LeapWorx Premium Blocks – Gutenberg Blocks for WordPress premium-blocks-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premium Blocks – Gutenberg Blocks for WordPress: from n/a through 2.3.18. | ||||
| CVE-2026-123462 | 2026-11-07 | 5.3 Medium | ||
| Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2. | ||||