Export limit exceeded: 377282 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (92759 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-9713 | 2 King-theme, Wordpress | 2 Product Designer For Woocommerce Wordpress | Lumise, Wordpress | 2026-07-23 | 7.5 High |
| The Lumise Product Designer for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'id' and 'table' parameters in the uploaded cart JSON file processed by the checkout AJAX action in versions up to, and including, 2.1.1. This is due to insufficient escaping on the user-supplied parameters before they are appended directly to a raw SQL query in the find_resource() function — the 'id' field is interpolated without quotes into a WHERE clause (numeric context) and 'table' is interpolated into the FROM clause, neither of which is protected by wp_magic_quotes or passed through $wpdb->prepare(). This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | ||||
| CVE-2026-25405 | 2 Digitalme, Wordpress | 2 Eroom, Wordpress | 2026-07-23 | 8.5 High |
| Contributor SQL Injection in eRoom <= 1.7.1 versions. | ||||
| CVE-2026-57370 | 2 Codepress It Solutions Llc, Wordpress | 2 Visitor Traffic Real Time Statistics Pro, Wordpress | 2026-07-23 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.9.1 versions. | ||||
| CVE-2026-57397 | 2 Thimpress., Wordpress | 2 Coaching, Wordpress | 2026-07-23 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Coaching <= 3.9.2 versions. | ||||
| CVE-2026-57427 | 2 Download Monitor, Wordpress | 2 Download Monitor - Wpforms Lock, Wordpress | 2026-07-23 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Download Monitor - WPForms Lock <= 1.0.4 versions. | ||||
| CVE-2026-57699 | 2 Bqworks, Wordpress | 2 Slider Pro, Wordpress | 2026-07-23 | 7.1 High |
| Subscriber Cross Site Scripting (XSS) in Slider Pro <= 4.8.13 versions. | ||||
| CVE-2026-57785 | 2 Apustheme, Wordpress | 2 Apuslisting, Wordpress | 2026-07-23 | 8.8 High |
| Unauthenticated Cross Site Request Forgery (CSRF) in ApusListing <= 1.2.63 versions. | ||||
| CVE-2026-59542 | 2 Wordpress, Wp Chill | 2 Wordpress, Kali Forms | 2026-07-23 | 7.7 High |
| Subscriber Arbitrary File Deletion in Kali Forms <= 2.4.18 versions. | ||||
| CVE-2026-61947 | 2 Wordpress, Wpvibes | 2 Wordpress, Form Vibes – Database Manager For Forms | 2026-07-23 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Form Vibes – Database Manager for Forms <= 1.5.2 versions. | ||||
| CVE-2026-61954 | 2 Payu India, Wordpress | 2 Payu India, Wordpress | 2026-07-23 | 7.5 High |
| Unauthenticated Broken Access Control in PayU India <= 3.8.9 versions. | ||||
| CVE-2026-65492 | 2 Dokan Wordpress Plugin, Wordpress | 2 Dokan Pro, Wordpress | 2026-07-23 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Dokan Pro <= 5.0.0 versions. | ||||
| CVE-2026-65500 | 2 Pixelacehq, Wordpress | 2 Manual - Documentation, Knowledge Base & Education Wordpress Theme, Wordpress | 2026-07-23 | 7.5 High |
| Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions. | ||||
| CVE-2026-65511 | 2 Pixelacehq, Wordpress | 2 Manual - Documentation, Knowledge Base & Education Wordpress Theme, Wordpress | 2026-07-23 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions. | ||||
| CVE-2026-65539 | 2 Bimal Rekhadiya, Wordpress | 2 Kwayy Html Sitemap, Wordpress | 2026-07-23 | 7.1 High |
| Unauthenticated Cross Site Request Forgery (CSRF) in Kwayy HTML Sitemap <= 4.0 versions. | ||||
| CVE-2026-65540 | 2 Metin Saraç, Wordpress | 2 Popup For Cf7 With Sweet Alert, Wordpress | 2026-07-23 | 7.1 High |
| Unauthenticated Cross Site Request Forgery (CSRF) in Popup for CF7 with Sweet Alert <= 1.6.5 versions. | ||||
| CVE-2026-65450 | 2 Romancode, Wordpress | 2 Mapsvg, Wordpress | 2026-07-23 | 8.5 High |
| Contributor SQL Injection in MapSVG <= 8.14.0 versions. | ||||
| CVE-2026-62234 | 1 Getgrav | 1 Grav | 2026-07-23 | 8.1 High |
| Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated users with api.webhooks.write permission to create webhooks with file://, dict://, or gopher:// URLs. Attackers can trigger webhook events to read local files, access process information, or pivot to internal services via unrestricted protocol handlers. | ||||
| CVE-2026-62386 | 1 Getgrav | 1 Grav | 2026-07-23 | 7.5 High |
| The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 accepts JWT access tokens through the ?token= URL query parameter on every API route (JwtAuthenticator::extractBearerToken fallback). Because tokens are embedded in URLs, they are logged verbatim in web server access logs, leaked via the Referer header, stored in browser history, and captured by upstream proxy and CDN logs, exposing valid admin access tokens. A leaked token grants unauthorized API access, including reading configuration and user data, creating admin accounts, modifying system settings, and deleting pages. | ||||
| CVE-2026-64621 | 1 Freerdp | 1 Freerdp | 2026-07-23 | 7.3 High |
| FreeRDP before 3.28.0 (affected 3.x through 3.27.1) contains a double-free vulnerability in freerdp_client_rdp_file_apply_to_settings() (client/common/file.c) when parsing the selectedmonitors field of a .rdp connection file. The MonitorIds array is allocated through the settings object, and a raw non-owning pointer to it is freed on the strtoul error path without clearing settings->MonitorIds, leaving it dangling; at teardown freerdp_settings_free() frees the same buffer again. An attacker who convinces a victim to open a crafted .rdp file with oversized monitor tokens can trigger a size-controlled double-free in any FreeRDP CLI client (xfreerdp/sdl-freerdp/wlfreerdp) in the default configuration. | ||||
| CVE-2026-13078 | 1 Mongodb | 1 Mongodb Server | 2026-07-23 | 7.7 High |
| A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit this through crafted aggregation pipeline commands to read sensitive files accessible to the MongoDB server process. | ||||