Export limit exceeded: 16303 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (16303 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-82224 | 2 Iova.mihai, Wordpress | 2 Slicewp, Wordpress | 2026-09-02 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in SliceWP <= 1.2.10 versions. | ||||
| CVE-2026-81765 | 2 Tailored Media, Wordpress | 2 Tailored Tools, Wordpress | 2026-09-02 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Tailored Tools <= 3.0.2 versions. | ||||
| CVE-2026-77189 | 2 Smub, Wordpress | 2 Charitable – Donation & Fundraising Platform (donation Forms, Recurring Donations & Fundraising Campaigns), Wordpress | 2026-09-02 | 6.5 Medium |
| The Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) plugin for WordPress is vulnerable to generic SQL Injection via 'order' Shortcode Attribute in all versions up to, and including, 1.8.12.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The [charitable_donors] shortcode is accessible to Contributor-level users via draft or pending post previews, providing an authenticated but low-privileged entry point for exploitation. | ||||
| CVE-2026-76006 | 2 Ays-pro, Wordpress | 2 Photo Gallery By Ays – Responsive Image Gallery, Wordpress | 2026-09-02 | 4.9 Medium |
| The Photo Gallery by Ays – Responsive Image Gallery plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 6.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerability exists across two execution paths — $wpdb->get_var() in record_count() and $wpdb->get_results() in prepare_items()/get_image_categories() — enabling both blind and UNION-based exfiltration techniques. | ||||
| CVE-2026-81294 | 2 Paul Ryan, Wordpress | 2 Authorizer, Wordpress | 2026-09-02 | 9.8 Critical |
| Unauthenticated Privilege Escalation in Authorizer <= 3.15.1 versions. | ||||
| CVE-2026-81770 | 2 Mapgeo, Wordpress | 2 Interactive Geo Maps, Wordpress | 2026-09-02 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Interactive Geo Maps <= 1.6.30 versions. | ||||
| CVE-2026-81771 | 2 Trustedsite, Wordpress | 2 Trustedsite, Wordpress | 2026-09-02 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in TrustedSite <= 1.2.5 versions. | ||||
| CVE-2026-84770 | 2 Kitae-park, Wordpress | 2 Mang Board Wp, Wordpress | 2026-09-02 | 8.8 High |
| Unauthenticated Cross Site Request Forgery (CSRF) in Mang Board WP <= 2.3.8 versions. | ||||
| CVE-2026-82223 | 2 Arraytics, Wordpress | 2 Wp Event Solution, Wordpress | 2026-09-02 | 6.5 Medium |
| Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.22 versions. | ||||
| CVE-2026-81288 | 2 Wordpress, Wp Swings | 2 Wordpress, Upsell Order Bump Offer For Woocommerce | 2026-09-02 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Upsell Order Bump Offer for WooCommerce <= 3.1.5 versions. | ||||
| CVE-2026-66652 | 2 Themegoods, Wordpress | 2 Grand Tour, Wordpress | 2026-09-02 | 5.4 Medium |
| Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Tour allows Cross Site Request Forgery. This issue affects Grand Tour: from n/a through 5.5.1. | ||||
| CVE-2026-82852 | 2 Mapsvg, Wordpress | 2 Mapsvg, Wordpress | 2026-09-02 | 5.4 Medium |
| Unauthenticated Server Side Request Forgery (SSRF) in MapSVG <= 8.15.0 versions. | ||||
| CVE-2026-81756 | 2 E-goi, Wordpress | 2 Smart Marketing Sms And Newsletters Forms, Wordpress | 2026-09-02 | 9.3 Critical |
| Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms <= 5.1.24 versions. | ||||
| CVE-2026-81291 | 2 Uncode, Wordpress | 2 Uncode, Wordpress | 2026-09-02 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Uncode <= 2.12.7 versions. | ||||
| CVE-2026-74010 | 2 John James Jacoby, Wordpress | 2 Bbpress, Wordpress | 2026-09-02 | 5.3 Medium |
| Missing Authorization vulnerability in John James Jacoby bbPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects bbPress: from n/a through 2.6.14. | ||||
| CVE-2026-74927 | 2 Multivendorx, Wordpress | 2 Multivendorx, Wordpress | 2026-09-02 | 5.3 Medium |
| The MultiVendorX WordPress plugin before 5.0.15 does not have proper authorisation controls on one of its REST API listing routes, allowing unauthenticated users to retrieve vendor contact and payout details, pending payout amounts, and administrative notes attached to store applications. | ||||
| CVE-2026-83562 | 2 Wclovers, Wordpress | 2 Wcfm Marketplace, Wordpress | 2026-09-02 | 6.5 Medium |
| Contributor Cross Site Scripting (XSS) in WCFM Marketplace <= 3.8.2 versions. | ||||
| CVE-2026-19251 | 2 Ultimatemember, Wordpress | 2 Ultimate Member, Wordpress | 2026-09-02 | 5.3 Medium |
| The Ultimate Member WordPress plugin before 2.13.0 does not check whether a comment has been approved, or whether the profile it belongs to is private, before returning profile activity to unauthenticated visitors, allowing them to read the content of comments still awaiting moderation. | ||||
| CVE-2026-19453 | 2 Jetbackup, Wordpress | 2 Jetbackup, Wordpress | 2026-09-02 | 7.1 High |
| The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capabilities of the account it preserves across a restore or migration before granting it administrator privileges, allowing a subscriber-level user to gain administrator access after the site owner restores or migrates the site. | ||||
| CVE-2026-77783 | 2 Rank Math Seo, Wordpress | 2 Rank Math Seo, Wordpress | 2026-09-02 | 3.7 Low |
| The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the post whose schema it renders on the front end is publicly viewable, allowing unauthenticated visitors to disclose the schema and associated content of draft, pending, private, scheduled and password-protected posts. | ||||