Export limit exceeded: 414950 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 414950 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (414950 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-77693 | 1 Wordpress-extensions | 1 Order Tip For Woocommerce | 2026-11-11 | 8.7 High |
| The Order Tip for WooCommerce WordPress plugin before 1.6.0 does not check the capability of the user requesting a file deletion, nor does it restrict which path may be deleted, allowing users with the Shop Manager role and above to delete arbitrary files on the server, which could lead to the site being taken over. | ||||
| CVE-2026-77695 | 1 Wordpress-extensions | 1 Woo Refund And Exchange Lite | 2026-11-11 | 6.5 Medium |
| The Return Refund and Exchange For WooCommerce WordPress plugin before 4.6.4 does not correctly verify the ownership of guest orders in some of the AJAX actions it exposes to unauthenticated users, allowing them to read private order messages, post messages and attachments in the customer's name, and cancel return requests on any guest order. | ||||
| CVE-2026-77757 | 1 Wordpress-extensions | 1 Directorist | 2026-11-11 | 5.4 Medium |
| The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.3 does not sanitize a user-supplied image reference before using it as the source of a file move, allowing users with a subscriber-level account to relocate arbitrary server-readable image files into a publicly accessible directory, and to delete them from their original location. | ||||
| CVE-2026-78146 | 1 Wordpress-extensions | 1 Noptin | 2026-11-11 | 6.5 Medium |
| The Simple Newsletter Plugin WordPress plugin before 4.3.3 does not verify that the requester is the subscriber named in a public request before rendering that subscriber's stored details, allowing unauthenticated users to disclose a subscriber's personal data along with the key that authorises changes to their record. | ||||
| CVE-2026-13414 | 1 Wordpress-extensions | 1 Cmp | 2026-11-11 | 4.8 Medium |
| The CMP WordPress plugin before 4.1.18 does not perform authorization checks on one of its AJAX actions and relies on a nonce that is skipped for certain (and exposed to anonymous visitors on others), allowing unauthenticated attackers to disable the site's maintenance/coming-soon mode under a non-default countdown configuration. | ||||
| CVE-2026-13415 | 1 Wordpress-extensions | 1 Cmp | 2026-11-11 | 7.2 High |
| The CMP WordPress plugin before 4.1.18 does not enforce an option-name allow-list when importing settings via one of its AJAX actions, allowing users with the Editor role (when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls) to update arbitrary WordPress options, including options that lead to privilege escalation to Administrator. | ||||
| CVE-2026-13416 | 1 Wordpress-extensions | 1 Cmp | 2026-11-11 | 3.5 Low |
| The CMP WordPress plugin before 4.1.18 does not sanitise and escape a settings value before outputting it on the coming-soon page, allowing users with the Editor role (when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls) to inject arbitrary web scripts that execute when a visitor views the page. | ||||
| CVE-2026-16567 | 1 Wordpress-extensions | 1 Document Embedder | 2026-11-11 | 5.3 Medium |
| The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token and streaming the file, allowing unauthenticated attackers to download arbitrary Document Embedder WordPress plugin before 2.3.1 documents, including private and draft ones, by enumerating IDs. | ||||
| CVE-2026-16568 | 1 Wordpress-extensions | 1 Shopapper | 2026-11-11 | 4.3 Medium |
| The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not verify that the requesting user owns the customer profile being queried through one of its REST endpoints, allowing any authenticated user (e.g. a customer/subscriber) to retrieve other users' personal data, including their email address, name, and roles. | ||||
| CVE-2026-16569 | 1 Wordpress-extensions | 1 Shopapper | 2026-11-11 | 4.3 Medium |
| The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not check the user's capabilities before allowing a stock-update operation through one of its REST endpoints, allowing any authenticated user, such as a customer or subscriber, to change the stock quantity of arbitrary products. | ||||
| CVE-2026-19223 | 1 Wordpress-extensions | 1 Smush | 2026-11-11 | 7.2 High |
| The Smush WordPress plugin before 4.3.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network. | ||||
| CVE-2026-19225 | 1 Wordpress-extensions | 1 Defender Security | 2026-11-11 | 6.6 Medium |
| The Defender Security WordPress plugin before 6.2.0 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network. | ||||
| CVE-2026-19715 | 1 Wordpress-extensions | 1 Wp Oauth Server | 2026-11-11 | 7.5 High |
| The WP OAuth Server ( Login with WordPress ) WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user records including password hashes when debug logging is enabled. | ||||
| CVE-2026-77016 | 1 Wordpress-extensions | 1 Workeera | 2026-11-11 | 9.6 Critical |
| The Workeera WordPress plugin before 1.0.6 does not restrict which values may be written to a user's own candidate profile, and does not validate or contain the stored file path before deleting it, allowing users with a role as low as subscriber to delete arbitrary files on the server. | ||||
| CVE-2026-77017 | 1 Wordpress-extensions | 1 Workeera | 2026-11-11 | 7.7 High |
| The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor confine the stored file location to an allowed directory before serving it, allowing users with a role as low as subscriber to read arbitrary files on the server, including its configuration file and authentication secrets. | ||||
| CVE-2026-77018 | 1 Wordpress-extensions | 1 Workeera | 2026-11-11 | 8.8 High |
| The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate the type of the file it subsequently writes into a publicly reachable directory, allowing users with a role as low as subscriber to upload arbitrary files and achieve remote code execution. | ||||
| CVE-2026-78137 | 1 Wordpress-extensions | 1 Storegrowth | 2026-11-11 | 7.5 High |
| The StoreGrowth WordPress plugin before 2.1.2 does not validate a browser-supplied product price on two of its unauthenticated actions, allowing unauthenticated attackers to add a product to the cart at an arbitrary, attacker-chosen price that carries through to the checkout total when the BOGO offer feature is enabled. | ||||
| CVE-2026-78138 | 1 Wordpress-extensions | 1 Finale Lite | 2026-11-11 | 4.3 Medium |
| The Finale Lite WordPress plugin before 2.21.0 does not perform a capability check on an AJAX action that returns a sales-campaign's configuration for an arbitrary post ID, allowing any authenticated user (Subscriber and above) to read the Finale Lite WordPress plugin before 2.21.0's campaign configuration and scheduling data. | ||||
| CVE-2026-78139 | 1 Wordpress-extensions | 1 Notifima | 2026-11-11 | 4.3 Medium |
| The Notifima WordPress plugin before 3.1.4 does not verify that the caller owns the subscription being modified on one of its REST endpoints in all versions up to, and including, 3.1.3, allowing authenticated attackers with Subscriber-level access to unsubscribe arbitrary customers from product stock-alert notifications. | ||||
| CVE-2026-78333 | 1 Wordpress-extensions | 1 12 Step Meeting List | 2026-11-11 | 8.8 High |
| The 12 Step Meeting List WordPress plugin before 3.19.17 does not sanitise and escape a value submitted by unauthenticated users before storing it in its activity log and outputting it back in an admin area page, leading to a Stored Cross-Site Scripting issue which could be used against high privilege users such as admin. | ||||