Export limit exceeded: 425024 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425024 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425024 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-118041 | 1 Wordpress-extensions | 1 Contest Gallery | 2026-11-12 | 8.8 High |
| The Contest Gallery WordPress plugin before 34.0.3 does not sanitise the name of files uploaded through its e-commerce sale file-replacement feature, allowing authenticated users with Author-level access and above to write files with an arbitrary name and extension to a web-accessible directory and, by overwriting the directory's protection file through the same flow, achieve Remote Code Execution. | ||||
| CVE-2026-118241 | 1 Wordpress-extensions | 1 Smush | 2026-11-12 | 2.7 Low |
| The Smush WordPress plugin before 4.3.6 does not verify that a user is authorised to act on the targeted media attachment, only checking a broad upload-files capability, which allows users with the Author role and above to optimise and restore attachments owned by other users, altering their files on disk and consuming the stored backup. | ||||
| CVE-2026-118439 | 1 Wordpress-extensions | 1 Limit Login Attempts Reloaded | 2026-11-12 | 4.1 Medium |
| The Limit Login Attempts Security WordPress plugin before 3.4.2 does not validate the destination of a server-side request built from a user-supplied setup value, allowing users with administrator privileges to make the site issue requests to arbitrary hosts, including internal ones (SSRF). | ||||
| CVE-2026-119032 | 2026-11-12 | 5.3 Medium | ||
| The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not check that the importing user may edit the posts named in a settings backup, nor restrict the import to its own post types, allowing users whose role an administrator has granted access to the Schema & Structured Data for WP & AMP WordPress plugin before 1.70's settings to modify, re-author, unpublish or trash any post or page on the site and write arbitrary post meta. | ||||
| CVE-2026-119171 | 2026-11-12 | 5.3 Medium | ||
| The Advanced Product Fields (Product Addons) for WooCommerce WordPress plugin from 1.6.22 to 1.7.3 does not validate that a submitted value for a required paid product option matches one of the configured choices, only that it is not empty, allowing unauthenticated users to add a product to the cart and complete an order while skipping the required option's surcharge and paying only the base product price. | ||||
| CVE-2026-119529 | 1 Wordpress-extensions | 1 Gravity Forms | 2026-11-12 | 5.9 Medium |
| The Gravity Forms WordPress plugin before 3.2.2 does not properly restrict the file types that unauthenticated users can upload through its chunked file upload feature, allowing them to read server environment variables and the contents of files within the web root on servers configured to parse Server-Side Include documents, such as Apache with SSI enabled. | ||||
| CVE-2026-119531 | 1 Wordpress-extensions | 1 Live Composer | 2026-11-12 | 6.8 Medium |
| The Live Composer WordPress plugin before 2.1.24 does not escape several attributes of one of its page-builder shortcodes before outputting them inside HTML tag attributes, allowing users with the Contributor role and above to store a payload that executes in the browser of anyone who views the post, including an administrator reviewing the pending submission. | ||||
| CVE-2026-121472 | 1 Wordpress-extensions | 1 Automatorwp | 2026-11-12 | 5 Medium |
| The AutomatorWP WordPress plugin before 6.0.8 does not bind the requests that complete its Zoom and AWeber integration connections to the administrator who started them, allowing attackers to make a logged-in administrator replace the stored integration credentials with the attacker's own via a CSRF attack, diverting the data the site sends to those services into an account the attacker controls. Exploitation requires the integration to already be connected and knowledge of the site's OAuth client identifier. | ||||
| CVE-2026-123667 | 1 Wordpress-extensions | 1 Photo Engine | 2026-11-12 | 6.4 Medium |
| The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.2 does not sanitise and escape keyword names before storing them and outputting them on its debugging page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks against administrators who have enabled that page. | ||||
| CVE-2026-92408 | 2026-11-12 | 5.3 Medium | ||
| The WPS Bookings for WooCommerce WordPress plugin before 3.13.1 does not validate a price value taken from user input before using it to set the product price, allowing unauthenticated users to purchase bookable services at a price of their choosing, including zero. | ||||
| CVE-2026-109871 | 2026-11-12 | 4.3 Medium | ||
| The User Registration & Membership WordPress plugin before 5.3.2 does not verify that a payment has actually been completed before extending a paid membership subscription, allowing authenticated users with an active paid subscription to renew it indefinitely without paying. | ||||
| CVE-2026-109873 | 2026-11-12 | 5.3 Medium | ||
| The User Registration & Membership WordPress plugin before 5.3.2 does not enforce its payment-before-login restriction when a registration is submitted without a membership selection, allowing unauthenticated users to create an account on a payment-gated registration form and log in without completing payment. | ||||
| CVE-2026-110949 | 2026-11-12 | 3.7 Low | ||
| The Download Manager WordPress plugin before 3.3.73, Download Manager WordPress plugin before 7.6.2 does not verify a package's configured role restriction when validating a package password, allowing an unauthenticated user who knows the password of a role-restricted package to obtain a download key and download the protected file. | ||||
| CVE-2026-121497 | 1 Wordpress-extensions | 1 Askany | 2026-11-12 | 9.8 Critical |
| The AskAny WordPress plugin before 2.2.0 does not validate the extension or content of files attached to chat messages, trusting the browser-supplied file type instead, which allows unauthenticated users to upload PHP files and execute arbitrary code when visitor attachments are enabled. | ||||
| CVE-2026-119302 | 1 Wordpress-extensions | 1 Notificationx | 2026-11-12 | 6.5 Medium |
| The NotificationX WordPress plugin before 3.3.7 does not perform any capability, authentication or nonce check on its notification preview path, allowing unauthenticated users to disclose the content of private, draft, pending and password-protected posts and to execute arbitrary registered shortcodes by supplying crafted preview data on any front-end request. | ||||
| CVE-2026-123668 | 1 Wordpress-extensions | 1 Getpaid | 2026-11-12 | 5.3 Medium |
| The GetPaid WordPress plugin from 2.8.63 to 2.8.64 does not ensure item quantities on its payment forms are whole numbers, allowing unauthenticated users to have an invoice for a priced item marked as paid without being charged. | ||||
| CVE-2026-88813 | 2026-11-12 | 5.3 Medium | ||
| The YITH WooCommerce Gift Cards WordPress plugin through 4.39.0 does not reconcile the value of a gift card it issues against the amount actually paid for it, instead crediting the new card with the item's pre-discount price, which allows customers to apply an ordinary store coupon at checkout and receive a gift card worth more than they paid. | ||||
| CVE-2026-119034 | 2026-11-12 | 5.3 Medium | ||
| The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not verify that a post is publicly viewable before returning its approved comments through the review feature, allowing unauthenticated attackers to read approved comments on private, draft and password-protected posts, and to retrieve approved comments site-wide. | ||||
| CVE-2026-104718 | 2026-11-12 | 6.8 Medium | ||
| The Elementor Website Builder WordPress plugin before 4.3.6 does not validate or escape an element identifier before rendering it into a client-side framework attribute that is evaluated as JavaScript, allowing users with the Contributor role to store scripts that execute in the browser of anyone viewing the affected content, including an administrator reviewing the submission for publication. | ||||
| CVE-2026-119033 | 2026-11-12 | 2.2 Low | ||
| The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not verify that a user may edit a post before letting them change that post's structured data settings, allowing users with the Contributor role and above, when an administrator has granted them access to the Schema & Structured Data for WP & AMP WordPress plugin before 1.70, to disable, alter or reset the structured data of posts they do not own. | ||||