Export limit exceeded: 425694 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425694 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425694 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-97072 | 2 Mycred, Wordpress-extensions | 2 Mycred, Mycred | 2026-11-12 | 4.3 Medium |
| Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2. | ||||
| CVE-2026-119509 | 2 Eranfl, Wordpress-extensions | 2 Clickcease Click Fraud Protection, Clickcease Click Fraud Protection | 2026-11-12 | 5.3 Medium |
| Missing Authorization vulnerability in eranfl ClickCease Click Fraud Protection clickcease-click-fraud-protection allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ClickCease Click Fraud Protection: from n/a through 3.3.0. | ||||
| CVE-2026-121509 | 2 Headless Cms Plugin, Wordpress-extensions | 2 Headless Cms Plugin, Headless Cms Plugin | 2026-11-12 | 5.3 Medium |
| A security flaw has been discovered in Headless CMS Plugin up to 2.0.4 on WordPress. This affects the function get_required_post_data of the file /wp-json/rae/v1/post of the component REST API. The manipulation of the argument post_id/post_slug results in information disclosure. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-105296 | 2 Akeeba, Wordpress-extensions | 5 Admin Tools For Joomla!, Akeeba Backup For Joomla!, Akeeba Backup For Wordpress and 2 more | 2026-11-12 | N/A |
| Multiple Akeeba products lack the anti-CSRF check on some actions. If the user access a malicious page while logged into the product, unintended operations may be performed. | ||||
| CVE-2026-104719 | 1 Wordpress-extensions | 1 Cookieyes | 2026-11-12 | 6.4 Medium |
| The CookieYes WordPress plugin before 3.5.8 does not correctly restrict who can write its cookie-category script fields, and does not sanitize or escape them, allowing users with the Contributor role to store JavaScript that executes in the browsers of site visitors and of an administrator reviewing the content. | ||||
| CVE-2026-106000 | 1 Wordpress-extensions | 1 Booking Package | 2026-11-12 | 5.3 Medium |
| The Booking Package WordPress plugin before 1.7.34 does not require payment to be completed before saving a booking on calendars configured to require online payment, allowing unauthenticated users to create confirmed bookings without paying. | ||||
| CVE-2026-110692 | 1 Wordpress-extensions | 1 Powerpack Addons For Elementor | 2026-11-12 | 4.1 Medium |
| The PowerPack Addons for Elementor: Widgets, Form Styler and Templates WordPress plugin before 3.1.3 does not validate a user-supplied URL before using it in a server-side HTTP request, which could allow users with the contributor role and above to perform Server-Side Request Forgery attacks against internal and loopback resources and read the response back. | ||||
| CVE-2026-111740 | 1 Wordpress-extensions | 1 Post Duplicator | 2026-11-12 | 2.7 Low |
| The Post Duplicator WordPress plugin before 3.0.17 does not check whether the requesting user may view each post before returning a list of posts for a post type, allowing users with a role as low as Contributor to read the titles and hierarchy of other users' draft and private posts. | ||||
| CVE-2026-112243 | 1 Wordpress-extensions | 2 Duplicator, Duplicator-pro | 2026-11-12 | 5.8 Medium |
| The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not sanitise and escape a parameter before reflecting it on one of its administrative pages in certain configurations, leading to Reflected Cross-Site Scripting that executes in the session of a logged-in administrator who is tricked into opening a crafted link. | ||||
| CVE-2026-112244 | 1 Wordpress-extensions | 2 Duplicator, Duplicator-pro | 2026-11-12 | 5.3 Medium |
| The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not prevent direct access to some of its bundled PHP files, which initialise without their expected context, trigger a fatal error, and return a stack trace that discloses the server's absolute filesystem paths to unauthenticated users. | ||||
| CVE-2026-115250 | 1 Wordpress-extensions | 1 Text Typing | 2026-11-12 | 6.8 Medium |
| The Text Typing WordPress plugin before 2.2.2 does not properly sanitize and escape a block attribute before storing it and later outputting it into a page element that is read and rendered by client-side script, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of anyone viewing the affected page. | ||||
| CVE-2026-115257 | 1 Wordpress-extensions | 1 Wp Roster | 2026-11-12 | 5.3 Medium |
| The WP Roster WordPress plugin before 2.36 does not perform any capability or nonce checks before writing its stored roster data, allowing unauthenticated attackers to overwrite, wipe or restore the content of any roster. | ||||
| CVE-2026-115262 | 1 Wordpress-extensions | 2 Duplicator, Duplicator-pro | 2026-11-12 | 4.8 Medium |
| The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not restrict its database charset and collation rewrite to schema statements during a restore, so a value a Subscriber stores in their own profile can break out of its string literal and inject SQL into the restore's INSERT statement when an administrator restores the backup onto a server lacking one of the source's charsets or collations. | ||||
| CVE-2026-118422 | 1 Wordpress-extensions | 1 Stape Conversion Tracking | 2026-11-12 | 7.1 High |
| The Stape Conversion Tracking WordPress plugin before 2.3.11 does not validate the sub-path appended to its same-origin proxy's upstream endpoint, allowing unauthenticated visitors to redirect the server-side request to an arbitrary host and have the response body and its content type returned from the site's own origin with security response headers stripped, leading to Server-Side Request Forgery, including loopback and internal hosts, and Cross-Site Scripting. | ||||
| CVE-2026-118523 | 1 Wordpress-extensions | 1 Eventprime | 2026-11-12 | 5.3 Medium |
| The EventPrime WordPress plugin before 4.3.6.1 does not keep the built-in Pending Review post status non-public, allowing unauthenticated users to view posts, pages and other content that are awaiting review. | ||||
| CVE-2026-118983 | 1 Wordpress-extensions | 1 Vikwidgetsloader | 2026-11-12 | 6.8 Medium |
| The VikWidgetsLoader WordPress plugin before 1.12.3 does not sanitise or escape several block attributes before outputting them inside HTML attributes, allowing users with the Contributor role to store arbitrary JavaScript that executes in the browser of any user viewing the affected post, including the administrator or editor who reviews the pending submission. | ||||
| CVE-2026-62000 | 2 Wclovers, Wordpress-extensions | 2 Wcfm Marketplace, Wcfm Marketplace | 2026-11-12 | 7.5 High |
| Missing Authorization vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketplace allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Marketplace: from n/a through 3.8.2. | ||||
| CVE-2026-54851 | 2 Awesomemotive, Wordpress-extensions | 2 Contact Form By Wpforms, Contact Form By Wpforms | 2026-11-12 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Awesomemotive Contact Form by WPForms wpforms-lite allows Reflected XSS.This issue affects Contact Form by WPForms: from n/a through 2.0.3. | ||||
| CVE-2026-56065 | 2 Doofinder, Wordpress-extensions | 2 Doofinder For Woocommerce, Doofinder For Woocommerce | 2026-11-12 | 7.5 High |
| Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Doofinder Doofinder for WooCommerce doofinder-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Doofinder for WooCommerce: from n/a through 2.17.2. | ||||
| CVE-2026-62126 | 2 Miniorange, Wordpress-extensions | 2 Saml Sp Single Sign On, Saml Sp Single Sign On | 2026-11-12 | 7.5 High |
| Allocation of Resources Without Limits or Throttling vulnerability in miniOrange SAML SP Single Sign On miniorange-saml-20-single-sign-on allows HTTP DoS.This issue affects SAML SP Single Sign On: from n/a through 6.1.0. | ||||