Export limit exceeded: 414644 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 414644 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (414644 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-14858 | 1 Wordpress-extensions | 1 Wp Crowdfunding | 2026-11-11 | 4.3 Medium |
| The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details, allowing any authenticated users such as Subscribers to read the personal data of any WooCommerce order and enumerate every order in the store. | ||||
| CVE-2026-14859 | 1 Wordpress-extensions | 1 Wp Crowdfunding | 2026-11-11 | 4.3 Medium |
| The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX actions, allowing any authenticated users such as Subscribers to create crowdfunding campaign posts despite not being granted that permission. | ||||
| CVE-2026-110992 | 2026-11-11 | 6.5 Medium | ||
| A user who can create Git Sync provisioning jobs (the Editor role by default) could delete or move files outside the configured repository path with a job that references a resource whose source path contains ../ sequences (path traversal). With a local filesystem repository on versions before 13.0.4 and 13.1.1, this reached files on the Grafana host. | ||||
| CVE-2026-14925 | 1 Wordpress-extensions | 1 Import Wp | 2026-11-11 | 7.5 High |
| The Import WP WordPress plugin before 2.14.23 does not perform any authorization check on one of its export-file download handlers, allowing unauthenticated attackers to download export files generated by administrators, which may contain user personal data such as email addresses, login names and roles. Exploitation requires an unconsumed export to already exist and a low-entropy, time-based download key to be obtained. | ||||
| CVE-2026-15039 | 1 Wordpress-extensions | 1 Gift Cards For Woocommerce Pro | 2026-11-11 | 9.8 Critical |
| The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of its upload paths, allowing unauthenticated users to upload arbitrary files, including PHP code, which can lead to remote code execution. | ||||
| CVE-2026-15249 | 1 Wordpress-extensions | 1 Patterns Kit | 2026-11-11 | 5.4 Medium |
| The Patterns Kit WordPress plugin through 1.0.3 does not escape a link attribute before its client-side script inserts it into the page, allowing users with a role as low as Contributor to store a payload that executes in the browser of a user who views the content and clicks the affected element. | ||||
| CVE-2026-16051 | 1 Wordpress-extensions | 1 Wpmudev-updates | 2026-11-11 | 9.8 Critical |
| The wpmudev-updates WordPress plugin before 5.0.1 does not verify the integrity of the packages installed through its remote management interface, nor protect those requests against replay, allowing an attacker able to obtain or replay a valid signed management request to install and execute arbitrary code (remote code execution). | ||||
| CVE-2026-16253 | 1 Wordpress-extensions | 1 Total Upkeep | 2026-11-11 | 7.5 High |
| The Total Upkeep WordPress plugin before 1.17.3 does not adequately protect the secret that authorizes its backup-restore functionality and exposes it to unauthenticated users, allowing them to disclose sensitive backup information and to force a full site restore that overwrites the live site's files and database. This is an incomplete fix of CVE-2020-36848, as the protection added at the time never took effect on distributed copies of the plugin. | ||||
| CVE-2026-16538 | 1 Wordpress-extensions | 1 Wallet For Woocommerce | 2026-11-11 | 9.1 Critical |
| The Wallet for WooCommerce WordPress plugin before 1.6.10 does not verify the amount actually collected for a wallet top-up before crediting the wallet, allowing customers to top up their wallet balance for less than its value. | ||||
| CVE-2026-19217 | 1 Wordpress-extensions | 1 Royal Elementor Addons | 2026-11-11 | 5.4 Medium |
| The Royal Addons for Elementor WordPress plugin before 1.7.1065 does not validate a widget setting used to build an HTML tag before outputting it, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks. | ||||
| CVE-2026-15045 | 1 Wordpress-extensions | 1 Wallet System For Woocommerce | 2026-11-11 | 6.5 Medium |
| The Wallet System for WooCommerce WordPress plugin before 2.7.10 does not validate a user-supplied wallet amount against the customer's actual stored balance during checkout, allowing authenticated customers to arbitrarily reduce their own order total, including down to zero, and complete checkout without paying the merchant. | ||||
| CVE-2026-16990 | 1 Wordpress-extensions | 1 Payment Button For Paypal | 2026-11-11 | 5.3 Medium |
| The Payment Button for PayPal WordPress plugin through 1.2.3.44 does not enforce the merchant-configured price server-side and trusts a client-supplied payment amount, allowing unauthenticated attackers to create a real PayPal order against the merchant for an arbitrary lower amount. | ||||
| CVE-2026-17008 | 1 Wordpress-extensions | 1 Quick Paypal Payments | 2026-11-11 | 5.3 Medium |
| The Quick Paypal Payments WordPress plugin through 5.7.50 does not verify the paid amount, receiver, or payment status in its PayPal IPN handler and marks an order paid on an order-token match alone, so a buyer who pays an arbitrary small amount can have a full-price order marked paid. | ||||
| CVE-2026-82014 | 2026-11-11 | 4.3 Medium | ||
| Any authenticated user, including a Viewer, could change the preferences of any team, such as its home dashboard, theme and timezone, through an undocumented endpoint with no access control, and so redirect every member of that team to a dashboard of their choice (missing authorization). | ||||
| CVE-2026-13328 | 1 Wordpress-extensions | 1 Food Menu | 2026-11-11 | 5.3 Medium |
| The Food Menu WordPress plugin before 6.0.2 does not perform any capability or ownership check on its reservation-status update action, which is also exposed to unauthenticated users and gated only by a nonce that is publicly available to visitors, allowing unauthenticated attackers to change the status of arbitrary reservations. | ||||
| CVE-2026-18945 | 1 Wordpress-extensions | 1 Wp Helper Premium | 2026-11-11 | 8.2 High |
| The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its custom order confirmation page or when handling the related AJAX actions, allowing unauthenticated users to view other customers' order details, including personal information, as well as change the state of arbitrary orders. Exploitation requires WooCommerce to be active and the WP Helper Premium WordPress plugin before 4.7.6's optional order confirmation page module to be enabled. | ||||
| CVE-2026-15413 | 1 Wordpress-extensions | 1 Link Factory | 2026-11-11 | 10 Critical |
| The Link Factory WordPress plugin is a backdoor. Distributed as a "homepage sentence publisher", it exposes an operator-controlled REST API under /wp-json/link-factory/v1/ - authenticated by a detached Ed25519 signature verified against a hardcoded operator public key (except for the health check). | ||||
| CVE-2026-14290 | 1 Wordpress-extensions | 1 Embed Google Photos Album | 2026-11-11 | 6.8 Medium |
| The Embed Google Photos album WordPress plugin through 2.2.1 does not escape a shortcode attribute value before outputting it inside an HTML attribute, allowing users with the Contributor role or above to inject arbitrary JavaScript that executes in the browser of any user, including administrators, who views the affected post. | ||||
| CVE-2026-15205 | 1 Wordpress-extensions | 1 Paymob For Woocommerce | 2026-11-11 | 8.6 High |
| The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthenticated payment callback, and performs this query before verifying the payment provider's HMAC signature. This allows unauthenticated attackers to perform SQL injection and read arbitrary data from the database — including user credentials and other secrets — through both in-band (reflected) and time-based blind extraction. | ||||
| CVE-2026-16739 | 1 Wordpress-extensions | 1 Epeken All Kurir | 2026-11-11 | 5.9 Medium |
| The Epeken All Kurir for Woocommerce WordPress plugin through 2.1.4 does not verify that a payment-confirmation request originates from the owner of the targeted order, nor that any payment actually occurred, allowing unauthenticated attackers to mark arbitrary orders as confirmed and, in a non-default configuration, paid. | ||||