Export limit exceeded: 16007 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (16007 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-12843 | 2 Stellarwp, Wordpress | 2 Learndash Lms, Wordpress | 2026-09-07 | 5.4 Medium |
| The LearnDash LMS plugin for WordPress is vulnerable to authorization bypass in versions 4.25.0 - 5.1.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to enroll arbitrary users in paid courses without payment verification, bypassing the entire payment system and gaining unauthorized access to premium educational content. | ||||
| CVE-2026-11613 | 2 Divi Engine, Wordpress | 2 Divi Ajax Filter, Wordpress | 2026-09-07 | 9.8 Critical |
| The Divi Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.1.2 via the 'custom_loop_template' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. This vulnerability is only exploitable when the loop_templates parameter is set to 'custom-template'. | ||||
| CVE-2025-9049 | 2 Scriptsbundle, Wordpress | 2 Nokri – Job Board Wordpress Theme, Wordpress | 2026-09-07 | 8.8 High |
| The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nokri_account_member_permissions' function in all versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add new Subscriber users with employer account member permissions, who in turn can escalate privileges by updating the email address of any user, including Administrator users. | ||||
| CVE-2025-14945 | 2 Netweblogic, Wordpress | 2 Events Manager – Calendar, Bookings, Tickets, And More!, Wordpress | 2026-09-07 | 5.4 Medium |
| The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via event attribute values in all versions up to, and including, 7.3.3. This is due to insufficient input sanitization when storing attribute values (using only `wp_unslash()` without sanitization) and lack of output escaping when rendering the '#_ATT{key}' placeholder. This makes it possible for authenticated attackers, with Author-level access and above, or unauthenticated attackers when anonymous event submissions are enabled, to inject arbitrary web scripts that execute when any user views the affected event page. | ||||
| CVE-2024-11080 | 2 Pickplugins, Wordpress | 2 Post Grid, Wordpress | 2026-09-07 | 9.8 Critical |
| The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Unauthenticated Hook Injection in versions 2.2.32 to 2.3.1 via several functions in the ~/includes/blocks/form-wrap/function.php file. This makes it possible for unauthenticated attackers to execute actions with hooks in WordPress, granted no other security controls are present in the function. | ||||
| CVE-2025-15489 | 2 Passster Project, Wordpress | 2 Passster, Wordpress | 2026-09-07 | 5.3 Medium |
| The Passster WordPress plugin before 4.2.24 does not handle input properly in an AJAX action, allowing unauthenticated users to retrieve the value of password protected content | ||||
| CVE-2026-84849 | 2 Brightplugins, Wordpress | 2 Pre-orders For Woocommerce, Wordpress | 2026-09-07 | 6.5 Medium |
| Unauthenticated Bypass Vulnerability in Pre-Orders for WooCommerce <= 2.3 versions. | ||||
| CVE-2026-81773 | 2 Saturdaydrive, Wordpress | 2 Ninja Forms - File Uploads, Wordpress | 2026-09-07 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Ninja Forms File Uploads Extension <= 3.3.26 versions. | ||||
| CVE-2026-84753 | 2 Getwpfunnels, Wordpress | 2 Mail Mint, Wordpress | 2026-09-07 | 9.8 Critical |
| Unauthenticated PHP Object Injection in Mail Mint <= 1.31.0 versions. | ||||
| CVE-2026-84754 | 2 Getwpfunnels, Wordpress | 2 Wpfunnels, Wordpress | 2026-09-07 | 6.5 Medium |
| Unauthenticated Broken Access Control in WPFunnels <= 3.12.13 versions. | ||||
| CVE-2026-84755 | 2 Getwpfunnels, Wordpress | 2 Mail Mint, Wordpress | 2026-09-07 | 6.5 Medium |
| Unauthenticated Broken Access Control in Mail Mint <= 1.31.0 versions. | ||||
| CVE-2026-84758 | 2 Strategy11team, Wordpress | 2 Business Directory Plugin, Wordpress | 2026-09-07 | 6.5 Medium |
| Unauthenticated Broken Access Control in Business Directory <= 6.4.26 versions. | ||||
| CVE-2026-84766 | 2 Wordpress, Wpmanageninja | 2 Wordpress, Fluent Booking | 2026-09-07 | 5.9 Medium |
| Unauthenticated Bypass Vulnerability in FluentBooking Pro <= 2.2.1 versions. | ||||
| CVE-2026-84812 | 2 Wordplus, Wordpress | 2 Better Messages, Wordpress | 2026-09-07 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.27 versions. | ||||
| CVE-2026-85303 | 2 Magepeople, Wordpress | 2 Booking & Rental Manager, Wordpress | 2026-09-07 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magepeople inc. Booking and Rental Manager allows Stored XSS. This issue affects Booking and Rental Manager: from n/a through 2.7.7. | ||||
| CVE-2026-15984 | 2 Themovation, Wordpress | 2 Quickcal, Wordpress | 2026-09-07 | 7.2 High |
| The QuickCal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Field Parameters in all versions up to, and including, 1.0.20 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce guarding the unauthenticated booked_add_appt AJAX action is publicly embedded on any page rendering the booking calendar shortcode, making it trivially obtainable by unauthenticated attackers without any prior account or privilege. | ||||
| CVE-2025-15693 | 2 Jch Optimize Project, Wordpress | 2 Jch Optimize, Wordpress | 2026-09-07 | 2.7 Low |
| The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided to one of its administrative image-browsing features to within the site, allowing high-privilege users, administrators on single-site and sub-site administrators on multisite, to enumerate directories and file names outside the web root. | ||||
| CVE-2025-15694 | 2 Wordpress, Wpjoli | 2 Wordpress, Joli Table Of Contents | 2026-09-07 | 3.5 Low |
| The Joli Table Of Contents WordPress plugin before 2.8.1 does not sanitise and escape some of its settings before outputting them in an admin page, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed, for example in a multisite setup. | ||||
| CVE-2026-15247 | 2 Search Atlas Group, Wordpress | 2 Search Atlas Seo, Wordpress | 2026-09-07 | 5.4 Medium |
| The Search Atlas SEO WordPress plugin before 2.6.24 does not perform a nonce or capability check before processing a settings update in one of its early-priority handlers, allowing any authenticated user such as a Subscriber to overwrite or delete the site's stored Google service-account credentials. | ||||
| CVE-2026-19858 | 2 Jetmonsters, Wordpress | 2 Jetformbuilder — Dynamic Blocks Form Builder, Wordpress | 2026-09-07 | 7.5 High |
| The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks when resolving request-derived data during page rendering, allowing unauthenticated users to read arbitrary user, post and term properties and metadata, including password hashes, private and draft content, and secrets other JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 store in metadata. | ||||