Export limit exceeded: 421002 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (421002 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-120408 | 2026-11-06 | 8 High | ||
| The All-in-One Video Gallery WordPress plugin before 5.1.0 does not escape a video's stored thumbnail URL before outputting it in the admin video list, and does not sanitise that value when it is written outside its own editor, allowing users with a role as low as Subscriber to perform Stored Cross-Site Scripting attacks against administrators. | ||||
| CVE-2026-115230 | 2026-11-06 | 9.8 Critical | ||
| The WHIZZ WordPress plugin through 1.1.8 does not validate the password-reset key before updating a user's password, relying only on a nonce that is exposed to unauthenticated visitors, allowing attackers to set an arbitrary password for any user, including administrators, and fully take over their accounts. | ||||
| CVE-2026-110955 | 2026-11-06 | 9.8 Critical | ||
| The Wurdey WordPress plugin through 1.0.0 does not verify a request signature before logging a user in, allowing unauthenticated attackers to authenticate as an administrator knowing only the administrator's username. | ||||
| CVE-2026-118045 | 2026-11-06 | 8.7 High | ||
| The Ever Accounting WordPress plugin before 2.3.3 does not restrict the file path supplied to its CSV import routine to an allowed directory, allowing users with its custom Accounting Manager role (which does not have administrator privileges) to delete arbitrary files on the server, such as wp-config.php, which takes the entire site offline. | ||||
| CVE-2026-116533 | 2026-11-06 | 9.8 Critical | ||
| The Static Snapshot WordPress plugin through 0.2.1 does not sanitise shell metacharacters in a user-supplied value before concatenating it into operating-system commands run by the server, allowing unauthenticated attackers to execute arbitrary commands on the host. | ||||
| CVE-2026-110525 | 2026-11-06 | 8.8 High | ||
| The MCB WordPress plugin through 1.0.0 does not sanitise or escape request header values before storing them and later rendering them in the administrator statistics grid, allowing unauthenticated attackers to store malicious JavaScript that executes in an administrator's browser session when the statistics page is viewed. | ||||
| CVE-2026-92396 | 2026-11-06 | 6.8 Medium | ||
| The ShopEngine Gutenberg WooCommerce Builder Blocks Addon WordPress plugin before 2.4.4 does not validate the user's capabilities or the ownership of the targeted post in one of its AJAX actions, and does not escape the stored value before outputting it in a JavaScript context, allowing users with a role as low as contributor to inject arbitrary scripts into any post that will run when a higher privileged user edits it. | ||||
| CVE-2026-121636 | 2026-11-06 | 5.3 Medium | ||
| The Quick Event Manager WordPress plugin before 9.19 does not verify the authenticity of PayPal payment notifications before marking event registrations as paid, which could allow unauthenticated attackers to mark registrations as paid without making a payment. | ||||
| CVE-2026-87784 | 2026-11-06 | 8.8 High | ||
| The Cool Media Filter WordPress plugin through 1.0.1 does not perform any capability or nonce check when updating the capabilities of a role, allowing any authenticated user, such as a subscriber, to grant their own role administrator capabilities and take over the site. | ||||
| CVE-2026-118639 | 1 Wordpress-extensions | 1 Surfer | 2026-11-06 | 6.5 Medium |
| The Surfer WordPress plugin before 1.8.1.759 discloses a sensitive API credential to low-privileged users through the post editor page and relies on that same credential as the sole authorization for its privileged REST API, allowing users with contributor-level access and above to read the credential and escalate to publishing arbitrary posts and other privileged actions. | ||||
| CVE-2026-118186 | 2026-11-06 | 4.9 Medium | ||
| The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not correctly restrict who may publish content, allowing users such as Contributors who can edit but not publish to make unreviewed posts and pages publicly live, bypassing the intended editorial approval workflow. | ||||
| CVE-2026-118188 | 2026-11-06 | 4.3 Medium | ||
| The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not verify that a user is permitted to read a given post before returning its content through its revision-comparison feature, allowing any authenticated user, including a Subscriber, to read the title, content and excerpt of any other user's private, draft, pending, scheduled or trashed post. | ||||
| CVE-2026-118187 | 2026-11-06 | 2.7 Low | ||
| The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not verify that a user requesting to duplicate or revise a post has access to that specific post, only that they can edit posts of that type, allowing users with contributor-level access and above to duplicate another user's private, draft, pending or scheduled post into one they own and read its full content. | ||||
| CVE-2026-118239 | 2026-11-06 | 5.6 Medium | ||
| The AutomatorWP WordPress plugin before 6.0.7 does not check that the user completing its Zoom and AWeber integration connections is allowed to do so, allowing unauthenticated attackers to replace the stored integration credentials with their own and divert the data the site sends to those services into an account they control. Exploitation requires the integration to already be connected and knowledge of the site's OAuth client identifier. | ||||
| CVE-2026-118423 | 2026-11-06 | 10 Critical | ||
| The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution. | ||||
| CVE-2026-115673 | 2026-11-06 | 7.5 High | ||
| The Anti-Spam, Spam FireWall by CleanTalk WordPress plugin before 6.91 does not escape a commenter-supplied value before outputting it on an administrative spam-review screen, allowing unauthenticated users to inject arbitrary web scripts that execute in the browser of an administrator who reviews flagged comments. | ||||
| CVE-2026-12967 | 2026-11-06 | 6.5 Medium | ||
| The WCFM Membership WordPress plugin before 2.12.1 does not verify that payment was made before completing a paid membership, allowing any authenticated Subscriber/Customer to activate a paid vendor membership for free and gain the marketplace vendor role. | ||||
| CVE-2026-63663 | 2026-11-06 | 6.5 Medium | ||
| CloudBeaver is a cloud database manager. From version 23.2.3 until 26.1.2, a path traversal vulnerability in its SQL result-editing functionality allows an authenticated user with SQL result-editing privileges to cause the server to open files outside the intended temporary upload directory. In affected database value-handling scenarios, this can disclose local files readable by the CloudBeaver server process. Version 26.1.2 prevents traversal outside the intended temporary upload directory. | ||||
| CVE-2026-101393 | 1 Oracle | 2 Siebel Apps - Marketing, Siebel Crm | 2026-11-06 | 4.3 Medium |
| Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Marketing. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel Apps - Marketing accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N). | ||||
| CVE-2026-63664 | 2026-11-06 | 6.5 Medium | ||
| CloudBeaver is a cloud database manager. In versions up to and including 26.1.1, some server-side export operations do not consistently enforce the global data export restriction. An authenticated non-administrative user with access to a shared database connection can initiate certain server-side data exports even when an administrator has disabled exports. This can disclose database contents that the user is permitted to query but is not permitted to export. The issue does not grant additional database read privileges. It is fixed in 26.1.2 by consistently enforcing the global restriction for server-side exports. | ||||