Export limit exceeded: 15995 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (15995 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-81799 | 2 Wordpress, Wpswings | 2 Wordpress, Return Refund And Exchange For Woocommerce | 2026-09-11 | 7.5 High |
| Unauthenticated Broken Access Control in Return Refund and Exchange For WooCommerce <= 4.6.4 versions. | ||||
| CVE-2026-84816 | 2 Realmag777, Wordpress | 2 Wpcs, Wordpress | 2026-09-11 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in WPCS <= 1.3.2 versions. | ||||
| CVE-2026-78536 | 2 Robokassa, Wordpress | 2 Payment Gateway For Woocommerce, Wordpress | 2026-09-11 | 6.5 Medium |
| Unauthenticated Broken Access Control in Robokassa payment gateway for Woocommerce <= 1.8.9 versions. | ||||
| CVE-2026-81782 | 2 Fahad Mahmood, Wordpress | 2 Wp Docs, Wordpress | 2026-09-11 | 6.5 Medium |
| Subscriber Cross Site Scripting (XSS) in WP Docs <= 2.3.1 versions. | ||||
| CVE-2026-84819 | 2 Greg Winiarski, Wordpress | 2 Wpadverts, Wordpress | 2026-09-11 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in WPAdverts <= 2.3.3 versions. | ||||
| CVE-2026-85310 | 2 Adrian Tobey, Wordpress | 2 Groundhogg, Wordpress | 2026-09-11 | 6.5 Medium |
| import_contacts Path Traversal in Groundhogg <= 4.7.1 versions. | ||||
| CVE-2026-81796 | 2 Wordpress, Wp Travel | 2 Wordpress, Wp Travel | 2026-09-11 | 7.3 High |
| Unauthenticated Broken Authentication in WP Travel <= 12.0.3 versions. | ||||
| CVE-2026-81784 | 2 Marcin, Wordpress | 2 Wise Chat, Wordpress | 2026-09-11 | 8.1 High |
| Unauthenticated PHP Object Injection in Wise Chat <= 3.4 versions. | ||||
| CVE-2026-73392 | 2 Highwarden, Wordpress | 2 Super Store Finder, Wordpress | 2026-09-11 | N/A |
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Duplicate to CVE-2026-12965. | ||||
| CVE-2026-77807 | 2 Acyba, Wordpress | 2 Acymailing – An Ultimate Newsletter Plugin And Marketing Automation Solution For Wordpress, Wordpress | 2026-09-11 | 7.5 High |
| The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 11.0.4 via the `user[name]` Parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires "Embed images" option in AcyMailing configuration being enabled. | ||||
| CVE-2026-19797 | 2 Gm Alex, Wordpress | 2 User Access Manager, Wordpress | 2026-09-10 | 6.1 Medium |
| The User Access Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab_group_section' parameter in all versions up to, and including, 2.3.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. | ||||
| CVE-2026-84908 | 2 Getwpfunnels, Wordpress | 2 Wpfunnels – Funnel Builder For Woocommerce With Checkout & One Click Upsell, Wordpress | 2026-09-10 | 5.3 Medium |
| The WPFunnels plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.12.13. This is due to the plugin registering the 'wpfnl_load_payment' AJAX action for both authenticated and unauthenticated (wp_ajax_nopriv_) users and the underlying add_offer_product_to_cart() function performing no nonce verification, no capability check, and no validation that the attacker-supplied product_id is the offer product actually configured on the attacker-supplied step_id. This makes it possible for unauthenticated attackers to add arbitrary WooCommerce products to a cart at any discounted price configured on any funnel step, enabling price manipulation and revenue loss at checkout. | ||||
| CVE-2026-17553 | 2 Levelfourstorefront, Wordpress | 2 Shopping Cart \& Ecommerce Store, Wordpress | 2026-09-10 | 7.2 High |
| The WP EasyCart plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.9.3. This is due to the ec_ajax_save_page_default_options() AJAX handler iterating over every $_POST key and passing it directly into update_option() without any allowlist, while gating the handler only on 'manage_options' OR the plugin's custom 'wpec_manager' capability. The plugin's built-in 'wpec_store_manager' role holds 'wpec_manager' but not 'manage_options', and the required nonce is emitted on frontend product/category templates that render for any user with 'wpec_manager'. This makes it possible for authenticated attackers, with Store Manager-level access and above, to elevate their privileges to administrator by updating arbitrary WordPress options such as default_role='administrator' and users_can_register='1', then self-registering a new account that is assigned the administrator role. | ||||
| CVE-2026-7804 | 2 Woobewoo, Wordpress | 2 Product Filter For Woocommerce By Wbw, Wordpress | 2026-09-10 | 6.1 Medium |
| The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpf_fid' parameter in all versions up to, and including, 3.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the crafted request to target a page where a filter using the vulnerable recalculation output is present. | ||||
| CVE-2026-77186 | 2 Joedolson, Wordpress | 2 My Calendar – Accessible Event Manager, Wordpress | 2026-09-10 | 6.4 Medium |
| The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fallback' Shortcode Attribute in all versions up to, and including, 3.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The bypass relies on hex-encoded shortcode attribute payloads (e.g. \x3cscript\x3e), which wp_kses_post cannot strip on save because they appear as literal backslash sequences rather than real HTML tags; WordPress core's shortcode_parse_atts() then calls stripcslashes() at render time, decoding the escapes into real angle brackets before they reach the unescaped sink. | ||||
| CVE-2026-77187 | 2 Joedolson, Wordpress | 2 My Calendar – Accessible Event Manager, Wordpress | 2026-09-10 | 6.4 Medium |
| The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes in all versions up to, and including, 3.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-19944 | 2 Themeum, Wordpress | 2 Wp Crowdfunding, Wordpress | 2026-09-10 | 4.9 Medium |
| The WP Crowdfunding plugin for WordPress is vulnerable to generic SQL Injection via 'wpneo_reward' Post Meta in all versions up to, and including, 2.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with shop manager-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a second-order injection: a Shop Manager writes the malicious payload once via the WooCommerce REST products endpoint (POST/PUT /wp-json/wc/v3/products/{id}), and the injected query executes on every subsequent public page view that renders the campaign rewards sidebar. | ||||
| CVE-2026-75905 | 2 Brechtvds, Wordpress | 2 Wp Recipe Maker, Wordpress | 2026-09-10 | 4.3 Medium |
| The WP Recipe Maker plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.8.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to take ownership of any admin-authored recipe by rewriting its post_author to the attacker's user ID, and unpublish it by overwriting its post_status with the contributor's draft or pending post status. This requires the default 'recipe_use_author' setting to be set to 'parent' for the ownership transfer to occur, though unpublishing remains possible regardless of this setting. | ||||
| CVE-2026-14989 | 2 Wordpress, Wplegalpages | 2 Wordpress, Wplp Cookie Consent – Cookie Banner & Consent Management For Gdpr, Ccpa & Google Consent Mode | 2026-09-10 | 7.2 High |
| The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpl_user_preference' parameter in all versions up to, and including, 4.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The consent-logging AJAX endpoint is registered for unauthenticated users and its required nonce (wpl_consent_logging_nonce) is publicly emitted via wp_localize_script on the frontend, meaning any unauthenticated site visitor can plant a payload without any prior authentication or privileged access. | ||||
| CVE-2026-19945 | 2 Themeum, Wordpress | 2 Wp Crowdfunding, Wordpress | 2026-09-10 | 6.4 Medium |
| The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. An administrator viewing any user's profile via the ?show_user_id= parameter will render the attacker's stored payload in the admin's browser session, enabling cross-privilege script execution. | ||||