Export limit exceeded: 415337 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (415337 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-109984 | 2 Foliovision, Wordpress-extensions | 2 Fv Flowplayer Video Player, Fv Flowplayer Video Player | 2026-11-12 | 5.4 Medium |
| The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 7.5.55.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the 'Parse Vimeo and YouTube links' option to be enabled and a site administrator to approve the comment containing the malicious shortcode; execution is then triggered for any visitor who interacts with the video player on that page. | ||||
| CVE-2026-105894 | 2 Akbilisim, Wordpress-extensions | 2 Ak Framework, Ak Framework | 2026-11-12 | 8.8 High |
| The Ak Framework plugin for WordPress, included in the Newsy - Viral News & Magazine WordPress Theme, is vulnerable to Privilege Escalation in all versions up to, and including, 2.9.8. This is due to missing capability checks in the ajax_refresh_nonce and ak_admin_ajax handlers before passing attacker-controlled option names and values to update_option(). This makes it possible for unauthenticated attackers to update arbitrary WordPress options including users_can_register and default_role to escalate privileges to administrator by enabling user registration with administrator as the default role. | ||||
| CVE-2026-119113 | 2 Paoltaia, Wordpress-extensions | 2 Geodirectory, Geodirectory | 2026-11-12 | 6.4 Medium |
| The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the listing description (post_content) in versions up to, and including, 2.8.199 This is due to insufficient input sanitization on save (the bundled geodir_kses_safe_embed_attributes() helper only neutralises data-embed-url, data-src and data-embed, while WordPress core wp_kses_post permits data-* attributes on standard HTML tags) combined with the AyeCode UI library initializing every [data-bs-toggle="popover-html"] element with { html: true, sanitize: false }, which inserts the attacker-controlled data-bs-content value into the popover body as HTML at render time. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-62057 | 2 Fahim Reza, Wordpress-extensions | 2 Divi Contact Form 7, Divi Contact Form 7 | 2026-11-12 | 5.3 Medium |
| Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Fahim Reza Divi Contact Form 7 cf7-styler-for-divi allows Code Injection.This issue affects Divi Contact Form 7: from n/a through 4.1.0. | ||||
| CVE-2026-54854 | 2 Cozmoslabs, Wordpress-extensions | 2 Profile Builder, Profile Builder | 2026-11-12 | 6.3 Medium |
| Contributor Privilege Escalation in Profile Builder <= 4.0.5 versions. | ||||
| CVE-2026-54855 | 2 Cozmoslabs, Wordpress-extensions | 2 Profile Builder, Profile Builder | 2026-11-12 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Profile Builder <= 4.0.5 versions. | ||||
| CVE-2026-78527 | 2 Gsplugins, Wordpress-extensions | 2 Gs Testimonial Slider, Gs Testimonial Slider | 2026-11-12 | 8.8 High |
| Contributor PHP Object Injection in GS Testimonial Slider <= 3.3.10 versions. | ||||
| CVE-2026-90888 | 2 Leadsnap, Wordpress-extensions | 2 Leadsnap, Leadsnap | 2026-11-12 | 9.8 Critical |
| Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions. | ||||
| CVE-2026-94175 | 2 Saad Iqbal, Wordpress-extensions | 2 All In One Login, All In One Login | 2026-11-12 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in All In One Login <= 2.4.1 versions. | ||||
| CVE-2026-107868 | 2 Wordpress-extensions, Yithemes | 2 Yith Woocommerce Product Add Ons, Yith Woocommerce Product Add-ons | 2026-11-12 | 5.3 Medium |
| Unauthenticated Bypass Vulnerability in YITH WooCommerce Product Add-Ons <= 4.34.0 versions. | ||||
| CVE-2026-115947 | 2 Realmag777, Wordpress-extensions | 2 Husky, Husky | 2026-11-12 | 6.5 Medium |
| Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions. | ||||
| CVE-2026-116401 | 2 Realmag777, Wordpress-extensions | 2 Husky, Husky | 2026-11-12 | 7.5 High |
| Unauthenticated Broken Access Control in HUSKY <= 1.4.6 versions. | ||||
| CVE-2026-116851 | 2 Implecode, Wordpress-extensions | 2 Ecommerce Product Catalog, Ecommerce Product Catalog | 2026-11-12 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.6.5 versions. | ||||
| CVE-2026-116852 | 2 Marketingfire, Wordpress-extensions | 2 Widget-options, Widget Options | 2026-11-12 | 9.1 Critical |
| Author Remote Code Execution (RCE) in Widget Options <= 4.2.5 versions. | ||||
| CVE-2026-116854 | 2 Aguilatechnologies, Wordpress-extensions | 2 Wp Customer Area, Wp Customer Area | 2026-11-12 | 6.5 Medium |
| Subscriber Cross Site Scripting (XSS) in WP Customer Area <= 8.4.0 versions. | ||||
| CVE-2026-116861 | 2 Wordpress-extensions, Wpdesk | 2 Flexible Chat, Flexible Chat | 2026-11-12 | 7.5 High |
| Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 versions. | ||||
| CVE-2026-116862 | 2 Acato, Wordpress-extensions | 2 Wp Rest Cache, Wp Rest Cache | 2026-11-12 | 7.5 High |
| Unauthenticated Broken Access Control in WP REST Cache <= 2026.3.1 versions. | ||||
| CVE-2026-118086 | 2 Hakan Ozevin, Wordpress-extensions | 2 Wp Base Booking, Wp Base Booking | 2026-11-12 | 8.8 High |
| Subscriber Privilege Escalation in WP BASE Booking <= 6.5.2 versions. | ||||
| CVE-2026-127208 | 2026-11-12 | 8.8 High | ||
| datamodel-code-generator before 0.84.0 contains a code injection vulnerability that allows attackers to achieve arbitrary code execution by supplying a malicious JSON Schema with a crafted x-python-type annotation containing a string ast.Constant node in a subscript slice position, which bypasses validation in parse_python_type_annotation and _python_type_expr_from_ast. Attackers can embed malicious Python expressions such as __import__ calls within quoted string literals in the generated source code, which Pydantic v2 evaluates as a ForwardRef via eval() during model_rebuild(), resulting in arbitrary code execution on developer workstations, CI/CD pipelines, or applications that generate and import the produced models at runtime. | ||||
| CVE-2026-118089 | 2 Rextheme, Wordpress-extensions | 2 Product Feed Manager, Product Feed Manager | 2026-11-12 | 7.2 High |
| Shop manager PHP Object Injection in Product Feed Manager <= 7.14.1 versions. | ||||