Export limit exceeded: 16163 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (16163 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-75981 | 2 Cozmoslabs, Wordpress | 2 Translatepress – Translate Multilingual Sites With Ai Translation, Wordpress | 2026-08-19 | 7.2 High |
| The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting in versions up to and including 3.2.5. The special gettext markers '#!trpst#' and '#!trpen#' are unconditionally rewritten to '<' and '>' by translate_page() in includes/class-translation-render.php (lines 538-539). Because those markers are plain text with no HTML-special characters, an unauthenticated attacker can embed them in a comment; the markers survive wp_kses, and when the post is viewed in a secondary language the substitution turns the attacker's '#!trpst#img ... #!trpen#' into a real <img> tag. remove_tags_from_output() only strips <script>/<style>, so an <img onerror=...> executes in the visitor's browser. | ||||
| CVE-2026-66589 | 2 Kings Plugins, Wordpress | 2 B2bking, Wordpress | 2026-08-19 | 5.4 Medium |
| Missing Authorization vulnerability in Kings Plugins B2BKing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects B2BKing: from n/a through 5.2.30. | ||||
| CVE-2026-74009 | 2 Razorpay, Wordpress | 2 Razorpay For Woocommerce, Wordpress | 2026-08-18 | 5.3 Medium |
| Unauthenticated Insecure Direct Object References (IDOR) in Razorpay for WooCommerce <= 4.8.7 versions. | ||||
| CVE-2026-74003 | 2 Rometheme, Wordpress | 2 Romethemeform For Elementor, Wordpress | 2026-08-18 | 4.3 Medium |
| Contributor Broken Access Control in RomethemeForm For Elementor <= 1.2.6 versions. | ||||
| CVE-2026-73995 | 2 Wordpress, Wpeverest | 2 Wordpress, User Registration | 2026-08-18 | 5.4 Medium |
| Subscriber Broken Authentication in User Registration <= 5.2.6 versions. | ||||
| CVE-2026-73398 | 2 Papaki, Wordpress | 2 Piraeus Bank Woocommerce Payment Gateway, Wordpress | 2026-08-18 | 6.5 Medium |
| Unauthenticated Broken Authentication in Piraeus Bank WooCommerce Payment Gateway 3.2.0 versions. | ||||
| CVE-2026-73382 | 2 Geminilabs, Wordpress | 2 Site Reviews, Wordpress | 2026-08-18 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.2.0 versions. | ||||
| CVE-2026-73367 | 2 Supsystic, Wordpress | 2 Easy Google Maps, Wordpress | 2026-08-18 | 7.2 High |
| Unauthenticated Remote File Inclusion in Easy Google Maps < 1.14.2 versions. | ||||
| CVE-2026-73360 | 2 Premio, Wordpress | 2 Chaty Pro, Wordpress | 2026-08-18 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Chaty Pro <= 3.5.8 versions. | ||||
| CVE-2026-73358 | 2 Wordpress, Wp.insider | 2 Wordpress, Affiliates Manager | 2026-08-18 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Affiliates Manager <= 2.9.53 versions. | ||||
| CVE-2026-73352 | 2 Nexcess, Wordpress | 2 Givewp, Wordpress | 2026-08-18 | 6.5 Medium |
| Unauthenticated Broken Access Control in GiveWP <= 4.16.5.1 versions. | ||||
| CVE-2026-73350 | 2 Psm Plugins, Wordpress | 2 Supportcandy, Wordpress | 2026-08-18 | 8.2 High |
| Unauthenticated Broken Authentication in SupportCandy <= 3.5.1 versions. | ||||
| CVE-2026-73343 | 2 Aresit, Wordpress | 2 Wp Compress, Wordpress | 2026-08-18 | 10 Critical |
| Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions. | ||||
| CVE-2026-73341 | 2 Metagauss, Wordpress | 2 Registrationmagic, Wordpress | 2026-08-18 | 9.8 Critical |
| Unauthenticated PHP Object Injection in RegistrationMagic <= 6.0.9.7 versions. | ||||
| CVE-2026-73187 | 2 Gingerplugins, Wordpress | 2 Sticky Chat Widget, Wordpress | 2026-08-18 | 9.3 Critical |
| Unauthenticated SQL Injection in Sticky Chat Widget <= 1.4.2 versions. | ||||
| CVE-2026-66679 | 2 Codepeople, Wordpress | 2 Appointment Hour Booking, Wordpress | 2026-08-18 | 6.5 Medium |
| Unauthenticated Broken Access Control in Appointment Hour Booking <= 1.5.91 versions. | ||||
| CVE-2026-66644 | 2 93digital, Wordpress | 2 Typing Effect, Wordpress | 2026-08-18 | 6.5 Medium |
| Contributor Cross Site Scripting (XSS) in Typing Effect <= 1.3.7 versions. | ||||
| CVE-2026-66622 | 2 Averta, Wordpress | 2 Depicter Slider, Wordpress | 2026-08-18 | 7.5 High |
| Unauthenticated SQL Injection in Depicter Slider <= 4.8.0 versions. | ||||
| CVE-2026-32470 | 2 Roxnor, Wordpress | 2 Fundengine, Wordpress | 2026-08-18 | 9.8 Critical |
| Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions. | ||||
| CVE-2026-18432 | 2 Shabti, Wordpress | 2 Frontend Admin By Dynamapps, Wordpress | 2026-08-18 | 9.8 Critical |
| The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because `ActionUser::conditions_logic()` gates the `current_user_can('edit_user', $user_id)` authorization check behind an `is_numeric()` test, causing the check to be skipped entirely when `$user_id` is a non-numeric string — a condition that can be induced by passing a crafted value such as `1one` through the unvalidated `item_id` parameter of the unauthenticated `wp_ajax_nopriv_frontend_admin/forms/change_form` AJAX endpoint. This makes it possible for attackers to escalate privileges to administrator by obtaining a server-signed `_acf_objects` payload carrying the non-numeric user ID, which WordPress subsequently coerces to integer 1 (the default administrator), allowing the attacker to overwrite that account's password or email address. Exploitation by unauthenticated users requires a public-facing frontend user form to be configured; in all other cases a subscriber-level account is sufficient. | ||||