Export limit exceeded: 14427 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (14427 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-66477 | 2 Shufflehound, Wordpress | 2 Gillion, Wordpress | 2026-07-28 | 5.3 Medium |
| Unauthenticated Broken Access Control in Gillion <= 4.13 versions. | ||||
| CVE-2026-15304 | 2 Foomagoo, Wordpress | 2 Plugin Organizer, Wordpress | 2026-07-28 | 6.5 Medium |
| The Plugin Organizer plugin for WordPress is vulnerable to SQL Injection via the 'PO_plugin_path' parameter in versions up to, and including, 10.2.4. This is due to insufficient escaping on the user-supplied parameter in the perform_plugin_search() function, where esc_sql() output is passed as the replacement string to preg_replace(), which collapses backslash escapes and defeats the quoting protection; additionally, the AJAX handler lacks both nonce verification and capability checks. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | ||||
| CVE-2026-66473 | 2 Wordpress, Xendit | 2 Wordpress, Xendit Payment | 2026-07-28 | 7.5 High |
| Unauthenticated Broken Access Control in Xendit Payment <= 7.1.0 versions. | ||||
| CVE-2026-65443 | 2 Wordpress, Wp Media | 2 Wordpress, Backwpup | 2026-07-28 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in BackWPup <= 5.7.4 versions. | ||||
| CVE-2026-65445 | 2 Isaumya, Wordpress | 2 Ad Invalid Click Protector, Wordpress | 2026-07-28 | 6.5 Medium |
| Unauthenticated Broken Access Control in Ad Invalid Click Protector (AICP) <= 1.3.0 versions. | ||||
| CVE-2026-65448 | 2 Acymailing Newsletter Team, Wordpress | 2 Anti Spam And List Cleaner – Acychecker, Wordpress | 2026-07-28 | 6.5 Medium |
| Unauthenticated Cross Site Scripting (XSS) in Anti Spam and list cleaner – AcyChecker <= 1.8.1 versions. | ||||
| CVE-2026-12124 | 2 Wordpress, Wpeverest | 2 Wordpress, Pdfdraft – Drag & Drop Pdf Builder, Pdf Viewer, Embed & Download Pdf, Certificate & Invoice Designer | 2026-07-28 | 5.3 Medium |
| The PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the serveTemplatePdfAjax() function and the serveTemplatePdf() REST route (which is registered with `permission_callback => '__return_true'`) in versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to download stored template PDFs — which may contain customer PII, invoice, order, and certificate data — by requesting the publicly registered admin-ajax action `pdfdraft_embed_pdf` or the REST endpoint `/wp-json/pdfdraft/v1/embed-pdf/templates/{slug}/pdf` with a known or guessable design slug, bypassing the plugin's own . | ||||
| CVE-2026-6251 | 2 Chaty, Wordpress | 2 Chaty Pro, Wordpress | 2026-07-28 | 6.5 Medium |
| The Chaty Pro plugin for WordPress is vulnerable to Authenticated Time-Based Blind SQL Injection in versions up to and including 3.5.5. This is due to the fetch_custom_field() function in admin/class-admin-base.php retrieving the widget_id POST parameter via filter_input(INPUT_POST, ...) and directly concatenating the value into a raw SQL query in a numeric context without using $wpdb->prepare() or any integer casting. Additionally, the nonce verification check is performed after the SQL query has already executed, providing no protection against the injection. This makes it possible for authenticated attackers with subscriber-level access and above to inject arbitrary SQL commands, potentially leading to unauthorized extraction of sensitive database contents including user credentials and configuration data. | ||||
| CVE-2026-15012 | 2 Deveasel, Wordpress | 2 Demi – One Click Demo Import, Backup & Site Migration, Wordpress | 2026-07-28 | 5.3 Medium |
| The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Copy in all versions up to, and including, 0.0.8 via the handle_restore_step function. This is due to missing HTTP access controls on the wp-content/uploads/demi-backup-state/ directory, which exposes the cryptographic restore key used to both authenticate the unauthenticated AJAX handler and forge signed restore-state envelopes. This makes it possible for unauthenticated attackers to copy arbitrary files to attacker-controlled destinations on the server. An active restore operation must have been initiated, which writes the .restore_key and .restore_step_token files to the public upload directory, before the exposed secrets can be harvested and chained to achieve unauthenticated arbitrary file copy. | ||||
| CVE-2026-14490 | 2 Deveasel, Wordpress | 2 Demi – One Click Demo Import, Backup & Site Migration, Wordpress | 2026-07-28 | 7.5 High |
| The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 0.0.7. The vulnerability exists because the plugin stores its HMAC signing key and per-step restore token as dotfiles inside a publicly accessible subdirectory of the WordPress uploads folder — without any `.htaccess` or index file protection — and the `demi_restore_step` AJAX handler, registered for unauthenticated callers, explicitly accepts possession of the on-disk signing key as a standalone alternative to WordPress capability and nonce checks; an unauthenticated attacker who retrieves the exposed key can forge a valid signed state envelope to invoke `CleanDir::execute()` with a caller-supplied absolute path that is subject to no allow-list or path-canonicalization check. This makes it possible for unauthenticated attackers to recursively delete arbitrary directories on the server. | ||||
| CVE-2026-15136 | 2 Wordpress, Wplegalpages | 2 Wordpress, Wplp Cookie Consent – Cookie Banner & Consent Management For Gdpr, Ccpa & Google Consent Mode | 2026-07-28 | 4.3 Medium |
| The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.3.7. This is due to missing or incorrect nonce validation on the process_bulk_action function. This makes it possible for unauthenticated attackers to permanently delete or forcibly resolve arbitrary GDPR data request records stored in the wpl_data_req table via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. | ||||
| CVE-2026-16587 | 2 Nasirahmed, Wordpress | 2 Advanced Form Integration — Connect Forms To 200+ Apps, Wordpress | 2026-07-28 | 4.3 Medium |
| The Advanced Form Integration — Connect Forms to 200+ Apps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the site's stored MailUp OAuth tokens in the adfoin_mailup_keys option with attacker-controlled tokens, hijacking future form-submission data to a MailUp account they control or nulling the tokens to break the integration entirely. This is exploitable by any authenticated user who can reach /wp-admin/profile.php, as admin_init fires for all logged-in users visiting any wp-admin page. | ||||
| CVE-2026-16585 | 2 Wordplus, Wordpress | 2 Better Messages – Chat Rooms, Group Chat, Private Messages & Ai Chat Bots, Wordpress | 2026-07-28 | 7.2 High |
| The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_sticker function in all versions up to, and including, 2.15.19. This makes it possible for authenticated attackers, with administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The prefix check intended to restrict deletion to the uploads directory can be bypassed by crafting a URL that begins with the legitimate uploads base URL but embeds ../ traversal sequences in the path portion, as the normalize_sticker function only applies esc_url_raw(), which does not strip ../ sequences, allowing the traversal payload to be stored verbatim in WordPress options. | ||||
| CVE-2026-14545 | 2 Truebooker, Wordpress | 2 Truebooker, Wordpress | 2026-07-28 | 9.8 Critical |
| The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to set an arbitrary password on any account, including an administrator, and take over the site. | ||||
| CVE-2026-14924 | 2 Tablesome, Wordpress | 2 Tablesome Table, Wordpress | 2026-07-28 | 7.5 High |
| The Tablesome Table WordPress plugin before 1.1.31 does not perform any authentication, capability, or nonce checks in one of its AJAX actions, allowing unauthenticated users to create new published posts and to overwrite arbitrary existing posts and pages. | ||||
| CVE-2026-14926 | 2 Fluentcart, Wordpress | 2 A New Era Of Ecommerce, Wordpress | 2026-07-28 | 4.2 Medium |
| The FluentCart A New Era of eCommerce WordPress plugin before 1.4.0 does not verify that a subscription belongs to the requesting customer in several of its payment-method endpoints, allowing any authenticated customer to act on another customer's subscription (changing its payment method, or cancelling and re-binding it) when they know the target subscription identifier. | ||||
| CVE-2026-8167 | 2 Thewp Digital Solutions, Wordpress | 2 News Theme V8, Wordpress | 2026-07-28 | 6.1 Medium |
| Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in THEWP Digital Solutions News Theme V8 allows Reflected XSS. This issue affects News Theme V8: through 16.06.2026. | ||||
| CVE-2026-10207 | 2 Pickplugins, Wordpress | 2 Pickplugins Question Answer, Wordpress | 2026-07-28 | 7.5 High |
| The PickPlugins Question Answer plugin for WordPress is vulnerable to SQL Injection in versions up to and including 1.2.73. This is due to insufficient sanitization of user-supplied input via the 'id' GET parameter in the user profile template combined with the use of wp_unslash() which removes WordPress's magic quotes protection, followed by direct concatenation into a SQL query without proper escaping or prepared statements in the qa_user_profile_card() function. This makes it possible for unauthenticated attackers to append additional SQL queries into existing queries, which can be used to extract sensitive information from the database. | ||||
| CVE-2026-14328 | 2 Eazyplugins, Wordpress | 2 Eazy Plugin Manager – Powerful Plugin Management Solution For Wordpress, Wordpress | 2026-07-28 | 8.8 High |
| The Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.4.1. This is due to insufficient authorization on the `wp_ajax_pos_get_option` AJAX handler, which verifies only a nonce that is localized to every logged-in admin-area user via `admin_enqueue_scripts` — without any capability check — before returning the value of any arbitrary WordPress option via `get_option()`, combined with the `admin_login_endpoint_handler` REST endpoint (`GET /wp-json/epm/v1/admin/login`) being registered as publicly accessible and authenticating callers solely by a whirlpool hash of values stored in those same options. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the `site_url`, `connection_key`, and `remote_user_id` values stored in the `eazywp_connecting_info` and `eazywp_connection` options, compute the required `auth_key`, call the `admin/login` REST endpoint to obtain Administrator authentication cookies, and fully take over the site. Exploitation requires the plugin's remote connection feature to have been configured, as the `eazywp_connecting_info` and `eazywp_connection` options must be populated with valid credentials. | ||||
| CVE-2026-11598 | 2 Lrnz, Wordpress | 2 Shortcodify, Wordpress | 2026-07-28 | 5 Medium |
| The Shortcodify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'name' Shortcode Attribute in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||