Export limit exceeded: 16011 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (16011 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-78363 | 2 Mw Wp Form Project, Wordpress | 2 Mw Wp Form, Wordpress | 2026-09-01 | 4.8 Medium |
| The MW WP Form WordPress plugin before 5.1.5 does not prevent shortcodes in user-submitted values from being executed when it merges those values into a message that it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site. Exploitation requires the site to have been configured to echo a submitted value back to the visitor after submission. | ||||
| CVE-2026-74916 | 2 Wordpress, Wpfastestcache | 2 Wordpress, Wp Fastest Cache | 2026-09-01 | 6.5 Medium |
| The WP Fastest Cache WordPress plugin before 1.5.1 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered under their own request context stored under, and served from, the clean URL's cache entry to every subsequent visitor. | ||||
| CVE-2026-81297 | 2 Wordpress, Wpmanageninja | 2 Wordpress, Fluent Forms Pro Add On Pack | 2026-09-01 | 7.5 High |
| Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack <= 6.2.12 versions. | ||||
| CVE-2026-82228 | 2 Siteground, Wordpress | 2 Siteground Security, Wordpress | 2026-09-01 | 8.1 High |
| Unauthenticated Bypass Vulnerability in SiteGround Security <= 1.6.6 versions. | ||||
| CVE-2026-81293 | 2 Passionate Programmer Peter, Wordpress | 2 Wp Data Access, Wordpress | 2026-09-01 | 9.3 Critical |
| Unauthenticated SQL Injection in WP Data Access <= 5.5.81 versions. | ||||
| CVE-2026-82225 | 2 Metagauss, Wordpress | 2 Registrationmagic, Wordpress | 2026-09-01 | 7.4 High |
| Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.9.8 versions. | ||||
| CVE-2026-81287 | 2 Syed Balkhi, Wordpress | 2 Charitable, Wordpress | 2026-09-01 | 8.5 High |
| Subscriber SQL Injection in Charitable <= 1.8.12.1 versions. | ||||
| CVE-2026-81768 | 2 Highwarden, Wordpress | 2 Super Store Finder, Wordpress | 2026-09-01 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Super Store Finder <= 7.10 versions. | ||||
| CVE-2026-81758 | 2 Ownerrez, Wordpress | 2 Ownerrez Api, Wordpress | 2026-09-01 | 6.3 Medium |
| Subscriber Broken Access Control in OwnerRez API <= 1.2.6 versions. | ||||
| CVE-2026-81763 | 2 Wordpress, ウェブ屋のさとーさん | 2 Wordpress, Throws Spam Away | 2026-09-01 | 9.3 Critical |
| Unauthenticated SQL Injection in Throws SPAM Away <= 3.8.2 versions. | ||||
| CVE-2026-81278 | 2 Wordpress, Wpexperts | 2 Wordpress, Post Smtp | 2026-09-01 | 5.4 Medium |
| Missing Authorization vulnerability in WPExperts Post SMTP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Post SMTP: from 4.0.0 through beta.1. | ||||
| CVE-2026-81780 | 2 Hashthemes, Wordpress | 2 Hash Form, Wordpress | 2026-09-01 | 10 Critical |
| Unauthenticated Arbitrary File Upload in Hash Form <= 1.4.2 versions. | ||||
| CVE-2026-81280 | 2 Ukr Solution, Wordpress | 2 Print Barcode Labels For Your Woocommerce Products/orders, Wordpress | 2026-09-01 | 6.5 Medium |
| Subscriber Sensitive Data Exposure in Print Barcode Labels for your WooCommerce products/orders <= 4.0.0 versions. | ||||
| CVE-2026-19796 | 2 Webilia, Wordpress | 2 Listdom: Ai-powered Business Directory With Classifieds Ads Listings, Wordpress | 2026-09-01 | 7.2 High |
| The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lsd[displ][style]' Parameter in all versions up to, and including, 5.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Listdom Pro add-on to be active and the 'Display Options Per Listing' displ setting to be enabled, both of which are non-default configurations. | ||||
| CVE-2026-19952 | 2 Shabti, Wordpress | 2 Frontend Admin By Dynamapps, Wordpress | 2026-09-01 | 7.5 High |
| The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the move_folders function in all versions up to, and including, 3.29.12. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is exploitable without authentication when a form is configured with public visibility (who_can_see='all'), as the required nonce is publicly obtainable from the rendered form. | ||||
| CVE-2026-16786 | 2 Livecomposer, Wordpress | 2 Live Composer – Free Wordpress Website Builder, Wordpress | 2026-09-01 | 6.4 Medium |
| The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dslc_module_testimonials_output Shortcode in all versions up to, and including, 2.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload survives save-time wp_kses_post filtering because KSES treats shortcode delimiters as opaque, and the unescaped fields — including main_heading_title, view_all_link, main_heading_link_title, and main_filter_title_all — are only rendered when do_shortcode() executes at page-view time. | ||||
| CVE-2026-19573 | 2 Wordpress, Worschtebrot | 2 Wordpress, Affiliate Super Assistent | 2026-09-01 | 7.2 High |
| The Affiliate Super Assistent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘doCommentShortcode’ function in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-75964 | 2 Cozmoslabs, Wordpress | 2 User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor, Wordpress | 2026-09-01 | 6.1 Medium |
| The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload reaches administrators with the manage_options capability when they visit the Users > Unconfirmed Email Addresses list table and interact with row-action links, as the poisoned javascript: href is rendered verbatim into the page HTML by row_actions(). | ||||
| CVE-2026-12747 | 2 Shabti, Wordpress | 2 Frontend Admin By Dynamapps, Wordpress | 2026-09-01 | 6.4 Medium |
| The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tag' Shortcode Attribute in all versions up to, and including, 3.29.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-18752 | 2 Lukeseager, Wordpress | 2 Persistent Login, Wordpress | 2026-09-01 | 6.5 Medium |
| The Persistent Login plugin for WordPress is vulnerable to generic SQL Injection via 'wppl_device_id' Cookie in all versions up to, and including, 3.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This vulnerability is only exploitable when the plugin's Login History feature is enabled. | ||||