Export limit exceeded: 415337 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 415337 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (415337 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-92895 | 2 Jiangweifang, Wordpress-extensions | 2 Live2dwebcanvas, Live2dwebcanvas | 2026-11-12 | 8.1 High |
| The Live2DWebCanvas plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.2.1 via the download_one_file function. This is due to missing file extension whitelist and MIME type validation in download_one_file() when writing files derived from attacker-controlled manifest entries to the web-served plugin directory. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible when the plugin's apiType setting is configured as custom-local (self-hosted model mode), a non-default option that requires a paid license and prints the REST nonce and one-time session tokens into every front-end page. | ||||
| CVE-2026-119178 | 2 Shark986, Wordpress-extensions | 2 Smart Cookie Kit, Smart Cookie Kit | 2026-11-12 | 5.4 Medium |
| The Smart Cookie Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is specifically crafted to survive wp_kses on save by storing hostile characters inside allowed HTML elements, with the attribute-breaking double-quote smuggled inside a permitted <code> body and reconstructed into a <abbr title> attribute only at render time by the plugin's own output buffer; exploitation requires an administrator to approve the comment and subsequently view the affected public post. | ||||
| CVE-2026-107658 | 2 Themekraft, Wordpress-extensions | 2 Buddyforms, Buddyforms | 2026-11-12 | 5.4 Medium |
| The BuddyForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bf_post_type (and buddyforms_form_content)' parameter in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that at least one BuddyForms form with public submissions enabled exists on the site (so that the required nonce can be harvested from the public form page) and that the active theme registers a widgetized sidebar, allowing the injected customize_changeset to place a malicious Custom HTML widget into the site's front end. | ||||
| CVE-2026-109884 | 2 Elementor, Wordpress-extensions | 2 Elementor Website Builder, Elementor Website Builder | 2026-11-12 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Reflected XSS.This issue affects Elementor Website Builder: from n/a through 4.3.5. | ||||
| CVE-2026-109883 | 2 Elementor, Wordpress-extensions | 2 Elementor Website Builder, Elementor Website Builder | 2026-11-12 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Code Injection.This issue affects Elementor Website Builder: from n/a through 4.3.5. | ||||
| CVE-2026-115431 | 2 Wordpress-extensions, Wp Swings | 2 Upsell Order Bump Offer For Woocommerce, Upsell Order Bump Offer For Woocommerce | 2026-11-12 | 7.1 High |
| Missing Authorization vulnerability in WP Swings Upsell Order Bump Offer for WooCommerce upsell-order-bump-offer-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Upsell Order Bump Offer for WooCommerce: from n/a through 3.1.6. | ||||
| CVE-2026-120851 | 2 Publishpress, Wordpress-extensions | 2 Publishpress Revisions, Publishpress Revisions | 2026-11-12 | 4.3 Medium |
| Missing Authorization vulnerability in PublishPress PublishPress Revisions revisionary allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PublishPress Revisions: from n/a through 4.2.0. | ||||
| CVE-2026-123471 | 2 Mycred, Wordpress-extensions | 2 Mycred, Mycred | 2026-11-12 | 4.3 Medium |
| Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in myCred myCred mycred allows Code Injection.This issue affects myCred: from n/a through 4.0.2. | ||||
| CVE-2026-120845 | 2 Wordpress-extensions, Wpmudev | 2 Smush Image Compression And Optimization, Smush Image Compression And Optimization | 2026-11-12 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Smush Image Compression and Optimization wp-smushit allows Stored XSS.This issue affects Smush Image Compression and Optimization: from n/a through 4.3.5. | ||||
| CVE-2026-27356 | 2 Ibericode, Wordpress-extensions | 2 Mc4wp, Mc4wp | 2026-11-12 | 5.3 Medium |
| Missing Authorization vulnerability in ibericode MC4WP mailchimp-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MC4WP: from n/a through 4.14.1. | ||||
| CVE-2026-119219 | 2 Artbees, Wordpress-extensions | 2 Jupiter X Core, Jupiter X Core | 2026-11-12 | 5.4 Medium |
| The Jupiter X Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fields[<custom_meta_field_id>]' parameter in all versions up to, and including, 4.62.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Execution requires that the attacker-registered account be assigned as the post_author of a page or post whose template includes the Raven Author Box widget, a fixture an administrator can create by reassigning authorship to any user including newly registered Subscribers. | ||||
| CVE-2026-120737 | 2 Artbees, Wordpress-extensions | 2 Jupiter X Core, Jupiter X Core | 2026-11-12 | 5.9 Medium |
| The Jupiter X Core plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.62.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to enumerate and render arbitrary published post types not intended for public listing — including Flamingo CF7 submission records containing submitter names, email addresses, phone numbers, full messages, and IP addresses — and perform meta_query boolean-oracle reads against the postmeta of any published post. Exploitation requires that a Posts or Advanced Posts widget on the site has 'Is Archive Template' enabled, which is the standard Jupiter X archive-template configuration used by most Jupiter X sites; additionally, the nonce verified by the second endpoint is minted via wp_create_nonce and printed on every frontend page as ravenTools.nonce, rendering it ineffective as an authorization barrier. | ||||
| CVE-2026-121519 | 2 Themeisle, Wordpress-extensions | 2 Social Slider Feed, Social Slider Feed | 2026-11-12 | 6.4 Medium |
| The Social Slider Feed – Social Media Feed & Gallery Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slidespeed' parameter in all versions up to, and including, 2.3.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The missing current_user_can() check in the Factory framework's connect() dispatcher allows Subscriber-level users to bypass the manage_options capability gate and both harvest a valid wis_edit_feed nonce and overwrite any feed's slidespeed setting, after which the stored payload fires on every public pageview embedding the feed shortcode. | ||||
| CVE-2026-119616 | 2 Picocodes, Wordpress-extensions | 2 Noptin – Newsletter, New Post Notifications & Email Automation, Noptin | 2026-11-12 | 5.9 Medium |
| The Noptin – Newsletter, New Post Notifications & Email Automation plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.4.3 via the 'noptin_fields[first_name]' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. The public Manage Preferences page issues a nonce to unauthenticated visitors, meaning there is no effective authorization barrier — an unauthenticated attacker can store the malicious payload as their first_name and have it executed the next time any newsletter is sent by the site operator. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own. | ||||
| CVE-2026-120555 | 2 Artbees, Wordpress-extensions | 2 Jupiter X Core, Jupiter X Core | 2026-11-12 | 5.3 Medium |
| The Jupiter X Core plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.62.0 via the 'file' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The path confinement check introduced in the CVE-2023-3813 fix (strpos + realpath) is present and working, so reads are confined to wp-content/uploads/ and cannot reach wp-config.php or other files outside that directory. | ||||
| CVE-2026-119098 | 2 Lifterlms, Wordpress-extensions | 2 Lifterlms, Lifterlms | 2026-11-12 | 6.4 Medium |
| The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'answer[]' parameter in all versions up to, and including, 10.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the attacker to be enrolled as a student in a course containing a Content-type quiz question; the injected payload executes in the administrator's browser session during the normal grading workflow when 'Start a Review' is clicked on the affected attempt. | ||||
| CVE-2026-119213 | 2 Wordpress-extensions, Wpmanageninja | 2 Fluent Support, Fluent Support | 2026-11-12 | 3.7 Low |
| The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to unauthenticated modification of a linked customer's stored profile fields in versions up to, and including, 2.4.7 Its first-party Fluent Forms integration (FeedIntegration::notify()) opens a ticket from each public form submission and, for a logged-out submitter, resolves the submitted email to an existing WordPress account via get_user_by('email', ...) without verifying the submitter controls that address, then passes the attacker-supplied data to Customer::maybeCreateCustomer(). This makes it possible for unauthenticated attackers to overwrite a limited set of a registered customer's stored profile fields where an administrator has enabled a FluentSupport feed on a public form. The email address, role and status are never changed; first and last name are overwritten only when the target user has no name set in user meta; and other fields (title, address, city, state, zip, country) are writable only where an administrator has mapped them in the feed. | ||||
| CVE-2026-119165 | 2 Wordpress-extensions, Wpbakery | 2 Wpbakery Page Builder, Wpbakery Page Builder | 2026-11-12 | 6.4 Medium |
| The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name / nickname' parameter in all versions up to, and including, 9.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful execution requires that at least one public post attributed to the attacker's account be rendered through a Basic Grid using a Grid Builder template with the Post Author element configured to link to the post author; Author-level users can satisfy this precondition unassisted, while Subscribers depend on an administrator having assigned or published a post under their account. | ||||
| CVE-2026-104913 | 2 Esaia, Wordpress-extensions | 2 Interactive Real Estate – Floor Plan & Building Visualizer, Interactive Real Estate | 2026-11-12 | 8.8 High |
| The Interactive Real Estate – Floor Plan & Building Visualizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.6.0 via the extract_zip_data function. This is due to missing capability check, nonce verification, and file extension or MIME type validation before copying attacker-supplied ZIP members to the uploads directory. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. This vulnerability is only exploitable on sites where the plugin's Freemius Premium license or trial is active, as the sole gate in the handler is a site-level license check rather than a per-user capability check. | ||||
| CVE-2026-121515 | 2 Foliovision, Wordpress-extensions | 2 Fv Flowplayer Video Player, Fv Flowplayer Video Player | 2026-11-12 | 5.4 Medium |
| The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 7.5.56.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the 'Parse Vimeo and YouTube links' option to be enabled, and the injected comment must be approved before the script executes for site visitors. | ||||