Export limit exceeded: 10221 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 15931 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (15931 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-81785 | 2 Themekraft, Wordpress | 2 Buddyforms, Wordpress | 2026-09-11 | 6.5 Medium |
| Unauthenticated Broken Access Control in BuddyForms <= 2.9.0 versions. | ||||
| CVE-2026-81788 | 2 Idxbroker, Wordpress | 2 Impress For Idx Broker, Wordpress | 2026-09-11 | 6.3 Medium |
| Subscriber Broken Access Control in IMPress for IDX Broker <= 3.3.0 versions. | ||||
| CVE-2026-81793 | 2 Dimitri Grassi, Wordpress | 2 Salon Booking System, Wordpress | 2026-09-11 | 6.5 Medium |
| Unauthenticated Broken Access Control in Salon booking system <= 10.31.5 versions. | ||||
| CVE-2026-81803 | 2 Ateeq Rafeeq, Wordpress | 2 Repairbuddy, Wordpress | 2026-09-11 | 7.5 High |
| Subscriber Remote Code Execution (RCE) in RepairBuddy <= 4.1224 versions. | ||||
| CVE-2026-84821 | 2 Epsiloncool, Wordpress | 2 Wp Fast Total Search, Wordpress | 2026-09-11 | 7.5 High |
| Unauthenticated Broken Access Control in WP Fast Total Search <= 1.82.284 versions. | ||||
| CVE-2026-81799 | 2 Wordpress, Wpswings | 2 Wordpress, Return Refund And Exchange For Woocommerce | 2026-09-11 | 7.5 High |
| Unauthenticated Broken Access Control in Return Refund and Exchange For WooCommerce <= 4.6.4 versions. | ||||
| CVE-2026-78536 | 2 Robokassa, Wordpress | 2 Payment Gateway For Woocommerce, Wordpress | 2026-09-11 | 6.5 Medium |
| Unauthenticated Broken Access Control in Robokassa payment gateway for Woocommerce <= 1.8.9 versions. | ||||
| CVE-2026-81782 | 2 Fahad Mahmood, Wordpress | 2 Wp Docs, Wordpress | 2026-09-11 | 6.5 Medium |
| Subscriber Cross Site Scripting (XSS) in WP Docs <= 2.3.1 versions. | ||||
| CVE-2026-84819 | 2 Greg Winiarski, Wordpress | 2 Wpadverts, Wordpress | 2026-09-11 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in WPAdverts <= 2.3.3 versions. | ||||
| CVE-2026-85310 | 2 Adrian Tobey, Wordpress | 2 Groundhogg, Wordpress | 2026-09-11 | 6.5 Medium |
| import_contacts Path Traversal in Groundhogg <= 4.7.1 versions. | ||||
| CVE-2026-81796 | 2 Wordpress, Wp Travel | 2 Wordpress, Wp Travel | 2026-09-11 | 7.3 High |
| Unauthenticated Broken Authentication in WP Travel <= 12.0.3 versions. | ||||
| CVE-2026-81784 | 2 Marcin, Wordpress | 2 Wise Chat, Wordpress | 2026-09-11 | 8.1 High |
| Unauthenticated PHP Object Injection in Wise Chat <= 3.4 versions. | ||||
| CVE-2026-73392 | 2 Highwarden, Wordpress | 2 Super Store Finder, Wordpress | 2026-09-11 | N/A |
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Duplicate to CVE-2026-12965. | ||||
| CVE-2026-19797 | 2 Gm Alex, Wordpress | 2 User Access Manager, Wordpress | 2026-09-10 | 6.1 Medium |
| The User Access Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab_group_section' parameter in all versions up to, and including, 2.3.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. | ||||
| CVE-2026-84908 | 2 Getwpfunnels, Wordpress | 2 Wpfunnels – Funnel Builder For Woocommerce With Checkout & One Click Upsell, Wordpress | 2026-09-10 | 5.3 Medium |
| The WPFunnels plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.12.13. This is due to the plugin registering the 'wpfnl_load_payment' AJAX action for both authenticated and unauthenticated (wp_ajax_nopriv_) users and the underlying add_offer_product_to_cart() function performing no nonce verification, no capability check, and no validation that the attacker-supplied product_id is the offer product actually configured on the attacker-supplied step_id. This makes it possible for unauthenticated attackers to add arbitrary WooCommerce products to a cart at any discounted price configured on any funnel step, enabling price manipulation and revenue loss at checkout. | ||||
| CVE-2026-17553 | 2 Levelfourstorefront, Wordpress | 2 Shopping Cart \& Ecommerce Store, Wordpress | 2026-09-10 | 7.2 High |
| The WP EasyCart plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.9.3. This is due to the ec_ajax_save_page_default_options() AJAX handler iterating over every $_POST key and passing it directly into update_option() without any allowlist, while gating the handler only on 'manage_options' OR the plugin's custom 'wpec_manager' capability. The plugin's built-in 'wpec_store_manager' role holds 'wpec_manager' but not 'manage_options', and the required nonce is emitted on frontend product/category templates that render for any user with 'wpec_manager'. This makes it possible for authenticated attackers, with Store Manager-level access and above, to elevate their privileges to administrator by updating arbitrary WordPress options such as default_role='administrator' and users_can_register='1', then self-registering a new account that is assigned the administrator role. | ||||
| CVE-2026-7804 | 2 Woobewoo, Wordpress | 2 Product Filter For Woocommerce By Wbw, Wordpress | 2026-09-10 | 6.1 Medium |
| The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpf_fid' parameter in all versions up to, and including, 3.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the crafted request to target a page where a filter using the vulnerable recalculation output is present. | ||||
| CVE-2026-77186 | 2 Joedolson, Wordpress | 2 My Calendar – Accessible Event Manager, Wordpress | 2026-09-10 | 6.4 Medium |
| The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fallback' Shortcode Attribute in all versions up to, and including, 3.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The bypass relies on hex-encoded shortcode attribute payloads (e.g. \x3cscript\x3e), which wp_kses_post cannot strip on save because they appear as literal backslash sequences rather than real HTML tags; WordPress core's shortcode_parse_atts() then calls stripcslashes() at render time, decoding the escapes into real angle brackets before they reach the unescaped sink. | ||||
| CVE-2026-77187 | 2 Joedolson, Wordpress | 2 My Calendar – Accessible Event Manager, Wordpress | 2026-09-10 | 6.4 Medium |
| The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes in all versions up to, and including, 3.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-19944 | 2 Themeum, Wordpress | 2 Wp Crowdfunding, Wordpress | 2026-09-10 | 4.9 Medium |
| The WP Crowdfunding plugin for WordPress is vulnerable to generic SQL Injection via 'wpneo_reward' Post Meta in all versions up to, and including, 2.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with shop manager-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a second-order injection: a Shop Manager writes the malicious payload once via the WooCommerce REST products endpoint (POST/PUT /wp-json/wc/v3/products/{id}), and the injected query executes on every subsequent public page view that renders the campaign rewards sidebar. | ||||