Export limit exceeded: 15167 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (15167 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-28142 | 2 Shamalli, Wordpress | 2 Web Directory Free, Wordpress | 2026-08-13 | 9.3 Critical |
| Unauthenticated SQL Injection in Web Directory Free <= 1.7.13 versions. | ||||
| CVE-2026-27544 | 2 Quarka, Wordpress | 2 Qa Analytics, Wordpress | 2026-08-13 | 10 Critical |
| Unauthenticated Remote Code Execution (RCE) in QA Analytics <= 5.2.0.0 versions. | ||||
| CVE-2026-27543 | 2 Fluxbuilder, Wordpress | 2 Mstore Api, Wordpress | 2026-08-13 | 8.1 High |
| Unauthenticated Privilege Escalation in MStore API <= 4.20.0 versions. | ||||
| CVE-2026-27538 | 2 Wordpress, Wpdirectorykit | 2 Wordpress, Wp Directory Kit | 2026-08-13 | 7.5 High |
| Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions. | ||||
| CVE-2026-27536 | 2 Pluginops, Wordpress | 2 Mailchimp Subscribe Form, Wordpress | 2026-08-13 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in MailChimp Subscribe Forms <= 4.3.3 versions. | ||||
| CVE-2026-27535 | 2 Solacewp, Wordpress | 2 Solace Extra, Wordpress | 2026-08-13 | 7.1 High |
| Subscriber Broken Access Control in Solace Extra <= 1.6.0 versions. | ||||
| CVE-2026-27380 | 2 Magepeopleteam, Wordpress | 2 Car Rental Manager, Wordpress | 2026-08-13 | 7.2 High |
| Editor PHP Object Injection in Car Rental Manager <= 1.3.9 versions. | ||||
| CVE-2026-13177 | 2 Eventin, Wordpress | 2 Eventin, Wordpress | 2026-08-13 | 4.3 Medium |
| The Eventin WordPress plugin before 4.1.20 does not properly restrict access to individual order records, allowing users with contributor-level access and above to read other customers' order data including personal information by iterating order identifiers. | ||||
| CVE-2026-17022 | 2 Salonbookingsystem, Wordpress | 2 Salon Booking System, Wordpress | 2026-08-13 | 7.5 High |
| The Salon Booking System WordPress plugin before 10.30.34 does not properly validate a booking's ownership token before loading it in its booking-wizard confirmation steps, allowing unauthenticated attackers to disclose other customers' booking records, including personal information, by supplying a sequential booking identifier. | ||||
| CVE-2026-49466 | 2 Dartiss, Wordpress | 2 Draft List, Wordpress | 2026-08-13 | 6.5 Medium |
| Draft List is a WordPress plugin to manage and promote unpublished content. Versions 2.6.3 and below are vulnerable to stored Cross-Site Scripting (XSS) in the `[drafts]` shortcode and Draft List widget when the documented custom `template` option places the `{{draft}}` placeholder inside an HTML attribute. The vulnerable code inserts the raw draft `post_title` into `{{draft}}` when the current viewer cannot edit posts. Because the template is sanitized before `{{draft}}` replacement, a Contributor can store a quote-only title payload that breaks out of an attribute in a site-configured Draft List template and executes JavaScript for visitors who load the public page. Version 2.6.4 fixes the issue. | ||||
| CVE-2026-19091 | 2 Paoltaia, Wordpress | 2 Geodirectory – Wp Business Directory Plugin And Classified Listings Directory, Wordpress | 2026-08-13 | 8.1 High |
| The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_revision function in all versions up to, and including, 2.8.169. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). By placing post_type=attachment exclusively in the query string to bypass the consistency check, an attacker can convert an auto-draft GeoDirectory listing into a WordPress attachment with attacker-controlled file paths injected into attachment metadata, which the delete_revision handler then dereferences and unlinks without any post-type or path validation. | ||||
| CVE-2026-19088 | 2 Roxnor, Wordpress | 2 Shopengine Elementor Woocommerce Builder Addon, Wordpress | 2026-08-13 | 5.4 Medium |
| The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin before 4.9.3 does not protect one of its authentication endpoints against CSRF, allowing an attacker to log a victim into an attacker-controlled account, so that the billing and shipping details the victim then enters at checkout are stored under and readable by the attacker. | ||||
| CVE-2026-14213 | 2 Ameliabooking, Wordpress | 2 Booking For Appointments And Events Calendar, Wordpress | 2026-08-13 | 3.7 Low |
| The Booking for Appointments and Events Calendar WordPress plugin before 2.4.6 does not verify that an authenticated employee (provider) is assigned to the appointment being accessed, allowing any employee to read any appointment by its identifier and disclose the booked customer's personal data. | ||||
| CVE-2026-14182 | 2 Wordpress, Wpfactory | 2 Wordpress, Customer Email Verification For Woocommerce | 2026-08-13 | 9.8 Critical |
| The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a loose comparison that an attacker can satisfy with a crafted value type, allowing unauthenticated users to verify and take over the account of any registered user who has not yet confirmed their email address. | ||||
| CVE-2026-3835 | 2 Buildwps, Wordpress | 2 Prevent Direct Access – Protect Wordpress Files, Wordpress | 2026-08-13 | 5.3 Medium |
| The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token validation in the `get_advance_file_by_url()` method in all versions up to, and including, 2.8.8.8 The method uses a SQL `LIKE` operator for token lookup without escaping wildcard characters via `$wpdb->esc_like()`. This makes it possible for unauthenticated attackers to bypass the private token requirement by supplying SQL wildcard characters (such as `%`) as the token value, matching any record in the plugin's file table and downloading any protected file. | ||||
| CVE-2026-18146 | 2 Wordpress, Wpmanageninja | 2 Wordpress, Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder | 2026-08-13 | 7.2 High |
| The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Notification Smartcode Values in all versions up to, and including, 6.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in the browser of an administrator (or any user with the Fluent Forms entry-viewing capability) when they view the form's entry Submission Logs in the WordPress admin dashboard. Exploitation requires that a site administrator or Fluent Forms manager has configured an email notification whose subject or static (direct) Send To value references an attacker-influenced Smartcode such as an input_password field value, a cookie value, or submission.response. | ||||
| CVE-2026-17021 | 2 Salonbookingsystem, Wordpress | 2 Salon Booking System, Wordpress | 2026-08-13 | 5.3 Medium |
| The Salon Booking System WordPress plugin before 10.30.34 does not properly restrict access to some of its booking-modification AJAX actions and does not verify ownership of the targeted booking, allowing unauthenticated users to tamper with the stored total of arbitrary bookings. | ||||
| CVE-2026-17020 | 2 Salonbookingsystem, Wordpress | 2 Salon Booking System, Wordpress | 2026-08-13 | 4.3 Medium |
| The Salon Booking System WordPress plugin through 10.31.0 does not verify that a requested booking belongs to the caller on one of its REST API endpoints, requiring only a basic read capability, allowing any authenticated user (including a Subscriber or self-registered customer account) to disclose any customer's booking personal data such as name, email, phone number, address and private notes by enumerating booking identifiers. | ||||
| CVE-2026-15237 | 2 Motopress Hotel Booking, Wordpress | 2 Motopress Hotel Booking, Wordpress | 2026-08-13 | 5.3 Medium |
| The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not perform any authorization or ownership check on a REST endpoint that creates payment records, allowing unauthenticated users to create completed payment records against arbitrary bookings and falsely mark them as paid. | ||||
| CVE-2026-15388 | 2 Cookie Consent Project, Wordpress | 2 Cookie Consent, Wordpress | 2026-08-13 | 4.3 Medium |
| The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on its consent-settings REST routes, so they fall back to an authentication-only gate, allowing any authenticated user such as a subscriber to update the Cookie Consent WordPress plugin before 0.0.10's consent settings and, on sites connected to the vendor's paid plan, read stored visitor consent logs. | ||||