Export limit exceeded: 425979 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425979 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-110987 | 1 Wordpress-extensions | 1 Registrationmagic | 2026-11-15 | N/A |
| The RegistrationMagic WordPress plugin before 6.1.0.4 does not properly escape a user-supplied value before printing it inside an inline script block on several of its admin screens, allowing unauthenticated attackers to inject arbitrary JavaScript that executes in the session of an administrator who is tricked into opening a crafted link. | ||||
| CVE-2026-110989 | 1 Wordpress-extensions | 1 Registrationmagic | 2026-11-15 | N/A |
| The RegistrationMagic WordPress plugin before 6.1.0.4 does not verify ownership of the submitted email address before updating the associated WordPress user account, allowing unauthenticated attackers to overwrite the profile fields of arbitrary non-administrator users by submitting a public form that contains name and primary-email fields. | ||||
| CVE-2026-114451 | 1 Wordpress-extensions | 1 Kadence Memberships | 2026-11-15 | N/A |
| The Membership Plugin WordPress plugin before 4.0.6 does not perform any authorization or CSRF check before running a schema-altering database maintenance routine, allowing unauthenticated users to convert the Membership Plugin WordPress plugin before 4.0.6's own tables to a narrower character set, which irreversibly replaces every 4-byte character (such as emoji and some CJK characters) in the membership level, discount code and payment records with a question mark. | ||||
| CVE-2026-114452 | 1 Wordpress-extensions | 1 Kadence Memberships | 2026-11-15 | N/A |
| The Membership Plugin WordPress plugin before 4.0.6 does not verify that the membership referenced in a saved-card payment request belongs to the user making it, allowing subscriber-level members to disclose another member's Stripe payment client secret and attach a payment method of their choosing to another member's pending payment. | ||||
| CVE-2026-127048 | 1 Wordpress-extensions | 1 Lazy Blocks | 2026-11-15 | N/A |
| The Custom Block Builder WordPress plugin before 3.0.0 does not properly deny unauthorised requests to its REST routes, as its permission checks return a non-error response that WordPress treats as granted, allowing unauthenticated users to execute arbitrary PHP code on the server. | ||||
| CVE-2026-82568 | 2 Givewp, Wordpress-extensions | 2 Give - Peer-to-peer, Give Peer To Peer | 2026-11-15 | 7.5 High |
| The Give - Peer-to-Peer plugin for WordPress is vulnerable to time-based SQL Injection via the 'sort' parameter in all versions up to, and including, 2.9.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Successful exploitation requires the existence of at least one Peer-to-Peer campaign. This vulnerability can be combined with CVE-2026-82663 to achieve unauthenticated remote code execution. | ||||
| CVE-2026-82663 | 2 Givewp, Wordpress-extensions | 2 Give - Peer-to-peer, Give - Peer-to-peer | 2026-11-15 | 7.5 High |
| The Give - Peer-to-Peer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.9.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers who know or discover an existing campaign and team ID to modify the team's name, story, goal, access and notification settings, set its profile image URL, and upload WordPress-allowed media files as parentless attachments. This vulnerability can be combined with CVE-2026-82568 to achieve unauthenticated remote code execution. | ||||
| CVE-2026-129467 | 1 Tess1o | 1 Geopulse | 2026-11-15 | 4.3 Medium |
| GeoPulse 1.5.0 through 2.3.0 contains an insecure direct object reference vulnerability in GET /api/v1/places/geocoding/{id} that allows authenticated users to read other users' private locations. Attackers can enumerate sequential reverse_geocoding_location ids to retrieve other users' custom place names, city, country, coordinates and bounding boxes from their history. | ||||
| CVE-2026-122662 | 2 Barn2 Plugins, Wordpress-extensions | 2 Document Library Pro, Document Library Pro | 2026-11-15 | 9.8 Critical |
| Deserialization of Untrusted Data vulnerability in Barn2 Plugins Document Library Pro document-library-pro allows Object Injection.This issue affects Document Library Pro: from n/a before 4.2.2. | ||||
| CVE-2026-124995 | 2 Michal Jaworski, Wordpress-extensions | 2 Track, Analyze & Optimize By Wp Tao, Track, Analyze & Optimize By Wp Tao | 2026-11-15 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michal Jaworski Track, Analyze & Optimize by WP Tao wp-tao allows Stored XSS.This issue affects Track, Analyze & Optimize by WP Tao: from n/a through 1.3.1. | ||||
| CVE-2026-125813 | 2 Ays-pro, Wordpress-extensions | 2 Survey Maker, Survey Maker | 2026-11-15 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Survey Maker survey-maker allows Reflected XSS.This issue affects Survey Maker: from n/a through 5.2.4.3. | ||||
| CVE-2026-124254 | 2 Exactly Www Llc, Wordpress-extensions | 2 Ewww Image Optimizer, Ewww Image Optimizer | 2026-11-15 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Exactly WWW LLC EWWW Image Optimizer ewww-image-optimizer allows Stored XSS.This issue affects EWWW Image Optimizer: from n/a through 8.9.1. | ||||
| CVE-2026-125791 | 2 Iworks, Wordpress-extensions | 2 Orphans, Orphans | 2026-11-15 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iWorks Orphans sierotki allows Stored XSS.This issue affects Orphans: from n/a through 3.4.6. | ||||
| CVE-2026-125449 | 2 Mamunur Rashid, Wordpress-extensions | 2 Testimonial Slider, Testimonial Slider | 2026-11-15 | 8.8 High |
| Deserialization of Untrusted Data vulnerability in Mamunur Rashid Testimonial Slider testimonial-slider-and-showcase allows Object Injection.This issue affects Testimonial Slider: from n/a through 3.0.2. | ||||
| CVE-2026-125780 | 2 Acowebs, Wordpress-extensions | 2 Woocommerce Custom Product Addons Pro, Woocommerce Custom Product Addons Pro | 2026-11-15 | 7.5 High |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Acowebs Woocommerce Custom Product Addons Pro woo-custom-product-addons-pro allows Path Traversal.This issue affects Woocommerce Custom Product Addons Pro: from n/a through 5.9.0. | ||||
| CVE-2026-125733 | 2 Devitems, Wordpress-extensions | 2 Shoplentor, Shoplentor | 2026-11-15 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DevItems ShopLentor woolentor-addons allows Reflected XSS.This issue affects ShopLentor: from n/a through 3.5.7. | ||||
| CVE-2026-125447 | 2 Kaliforms, Wordpress-extensions | 2 Kali Forms, Kali Forms | 2026-11-15 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kaliforms Kali Forms kali-forms allows Reflected XSS.This issue affects Kali Forms: from n/a through 2.4.31. | ||||
| CVE-2026-128893 | 2 Marcin, Wordpress-extensions | 2 Wise Chat, Wise Chat | 2026-11-15 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcin Wise Chat wise-chat allows Reflected XSS.This issue affects Wise Chat: from n/a through 3.4.5. | ||||
| CVE-2026-125765 | 2 Shortpixel, Wordpress-extensions | 2 Shortpixel Adaptive Images, Shortpixel Adaptive Images | 2026-11-15 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShortPixel ShortPixel Adaptive Images shortpixel-adaptive-images allows Stored XSS.This issue affects ShortPixel Adaptive Images: from n/a through 3.11.6. | ||||
| CVE-2026-125798 | 2 Wordpress-extensions, Zaytech | 2 Smart Online Order For Clover, Smart Online Order For Clover | 2026-11-15 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zaytech Smart Online Order for Clover clover-online-orders allows DOM-Based XSS.This issue affects Smart Online Order for Clover: from n/a through 1.6.6. | ||||