Export limit exceeded: 349497 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 349497 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (349497 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2020-36724 | 1 Wordable | 1 Wordable | 2026-04-08 | 9.8 Critical |
| The Wordable plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.1.1. This is due to the use of a user supplied hashing algorithm passed to the hash_hmac() function and the use of a loose comparison on the hash which allows an attacker to trick the function into thinking it has a valid hash. This makes it possible for unauthenticated attackers to gain administrator privileges. | ||||
| CVE-2020-36723 | 1 Cridio | 1 Listingpro | 2026-04-08 | 5.3 Medium |
| The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Sensitive Data Exposure in versions before 2.6.1 via the ~/listingpro-plugin/functions.php file. This makes it possible for unauthenticated attackers to extract sensitive data including usernames, full names, email addresses, phone numbers, physical addresses and user post counts. | ||||
| CVE-2020-36722 | 1 Visualcomposer | 1 Visual Composer Website Builder | 2026-04-08 | 5.5 Medium |
| The Visual Composer plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 26.0 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser. | ||||
| CVE-2020-36721 | 3 Colorlib, Cpothemes, Machothemes | 15 Activello, Bonkers, Illdy and 12 more | 2026-04-08 | 6.5 Medium |
| The Brilliance <= 1.2.7, Activello <= 1.4.0, and Newspaper X <= 1.3.1 themes for WordPress are vulnerable to Plugin Activation/Deactivation. This is due to the 'activello_activate_plugin' and 'activello_deactivate_plugin' functions in the 'inc/welcome-screen/class-activello-welcome.php' file missing capability and security checks/nonces. This makes it possible for unauthenticated attackers to activate and deactivate arbitrary plugins installed on a vulnerable site. | ||||
| CVE-2020-36718 | 1 Ninjateam | 1 Gpdr Ccpa Compliance Support | 2026-04-08 | 9.8 Critical |
| The GDPR CCPA Compliance Support plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.3 via deserialization of untrusted input "njt_gdpr_allow_permissions" value. This allows unauthenticated attackers to inject a PHP Object. | ||||
| CVE-2020-36717 | 1 Kaliforms | 1 Kali Forms | 2026-04-08 | 8.8 High |
| The Kali Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1.1. This is due to incorrect nonce handling throughout the plugin's function. This makes it possible for unauthenticated attackers to access the plugin's administrative functions via forged request granted they can trick a site administrator into performing an action such as clicking on a link. | ||||
| CVE-2019-25152 | 1 Tychesoftwares | 2 Abandoned Cart Lite For Woocommerce, Abandoned Cart Pro For Woocommerce | 2026-04-08 | 7.2 High |
| The Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for WordPress are vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 5.1.3 and 7.12.0 respectively, due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in user input that will execute on the admin dashboard. | ||||
| CVE-2019-25151 | 1 Cartflows | 1 Cartflows | 2026-04-08 | 5.4 Medium |
| The Funnel Builder plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the activate_plugin function in versions up to, and including, 1.3.0. This makes it possible for authenticated attackers to activate any plugin on the vulnerable service. | ||||
| CVE-2019-25150 | 1 Wpexperts | 1 Email Templates | 2026-04-08 | 8.8 High |
| The Email Templates plugin for WordPress is vulnerable to HTML Injection in versions up to, and including, 1.3. This makes it possible for attackers to present phishing forms or conduct cross-site request forgery attacks against site administrators. | ||||
| CVE-2019-25149 | 1 Robogallery | 1 Gallery Images Ape | 2026-04-08 | 7.6 High |
| The Gallery Images Ape plugin for WordPress is vulnerable to Arbitrary Plugin Deactivation in versions up to, and including, 2.0.6. This allows authenticated attackers with any capability level to deactivate any plugin on the site, including plugins necessary to site functionality or security. | ||||
| CVE-2019-25148 | 1 Codemiq | 1 Wp Html Mail | 2026-04-08 | 6.1 Medium |
| The WP HTML Mail plugin for WordPress is vulnerable to HTML injection in versions up to, and including, 2.9.0.3 due to insufficient input sanitization. This makes it possible for unauthenticated attackers to inject arbitrary HTML in pages that execute if they can successfully trick a administrator into performing an action such as clicking on a link. | ||||
| CVE-2019-25147 | 1 Prettylinks | 1 Pretty Links | 2026-04-08 | 7.2 High |
| The Pretty Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via various IP headers as well as the referer header in versions up to, and including, 2.1.9 due to insufficient input sanitization and output escaping in the track_link function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2019-25146 | 1 Delucks | 1 Delucks Seo | 2026-04-08 | 7.2 High |
| The DELUCKS SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the saveSettings() function that had no capability checks in versions up to, and including, 2.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute whenever a victim accesses the page. | ||||
| CVE-2016-15033 | 1 Delete All Comments Project | 1 Delete All Comments | 2026-04-08 | 9.8 Critical |
| The Delete All Comments plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the via the delete-all-comments.php file in versions up to, and including, 2.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible. | ||||
| CVE-2024-9988 | 1 Odude | 2 Crypto, Crypto Tool | 2026-04-08 | 9.8 Critical |
| The Crypto plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.19. This is due to missing validation on the user being supplied in the 'crypto_connect_ajax_process::register' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username. | ||||
| CVE-2024-9939 | 1 Iptanus | 1 Wordpress File Upload | 2026-04-08 | 7.5 High |
| The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.13 via wfu_file_downloader.php. This makes it possible for unauthenticated attackers to read files outside of the originally intended directory. | ||||
| CVE-2024-9708 | 1 Delowerhossain | 1 Easy Svg Upload | 2026-04-08 | 6.4 Medium |
| The Easy SVG Upload plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. | ||||
| CVE-2024-9705 | 1 Rstheme | 1 Ultimate Coming Soon \& Maintenance | 2026-04-08 | 4.3 Medium |
| The Ultimate Coming Soon & Maintenance plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ucsm_update_template_name_lite' function in all versions up to, and including, 1.0.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change the name of the plugin's templates. | ||||
| CVE-2024-9702 | 1 Wpsocialrocket | 1 Social Rocket | 2026-04-08 | 6.4 Medium |
| The Social Rocket – Social Sharing Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'socialrocket-floating' shortcode in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2024-9637 | 2 Igexsolutions, Jdsofttech | 2 Wpschoolpress, School Management System | 2026-04-08 | 8.8 High |
| The School Management System – WPSchoolPress plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.2.10. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes it possible for authenticated attackers, with teacher-level access and above, to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account. | ||||