Export limit exceeded: 16798 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 18186 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (18186 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-76877 | 2026-11-11 | 8.1 High | ||
| The WPML Multilingual CMS plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in versions up to, and including, 4.9.7. This is due to the `process_iframe_request` function's language-per-domain SSO handler generating the cross-domain sign-in token via `wp_create_nonce('wpml_sso')` on the logout landing page, where the browser has already discarded its authentication cookies — so `wp_get_session_token()` returns an empty string and the token collapses to the shared anonymous nonce for the current 12-hour tick rather than a user-bound secret — and then storing it in the `wpml_sso_user_<token>_<sha256('wpml_sso'.$domain)>` transient mapped to the victim's `user_id` with no binding to the specific sign-out action or requesting client. Because an unauthenticated attacker can independently derive the identical token by triggering the logout confirmation flow on `wp-login.php?action=logout`, and because the `is_iframe_request()` gate conditions (the per-domain SSO `started` transient and domain-hash derived from the public constant `SSO_NONCE`) are fully computable within the 60-second `SSO_TIMEOUT` window, an unauthenticated attacker can submit the forged `wpml_sso_token_domain` parameter with a `wpml_user_signed_in` status to a secondary language-domain endpoint before the legitimate `wpml_user_signed_out` iframe fires, causing WordPress authentication cookies to be issued for the victim. This makes it possible for unauthenticated attackers to gain access to accounts of users — including administrators — who are actively in the process of logging out during the race window. | ||||
| CVE-2026-118412 | 2026-11-11 | 3.1 Low | ||
| Improper Authentication in Apache Roller 5.1.0 through 6.1.6 allows a user whose account an administrator has disabled to sign in again through OpenID and read unpublished entries. The OpenID sign-in path did not check whether the account was enabled. Only sites that enable the non-default OpenID authentication mode are affected; later major versions do not include OpenID 2.0. Users are recommended to upgrade to Apache Roller 6.1.7 or later. | ||||
| CVE-2026-88813 | 2026-11-11 | 5.3 Medium | ||
| The YITH WooCommerce Gift Cards WordPress plugin through 4.39.0 does not reconcile the value of a gift card it issues against the amount actually paid for it, instead crediting the new card with the item's pre-discount price, which allows customers to apply an ordinary store coupon at checkout and receive a gift card worth more than they paid. | ||||
| CVE-2026-121873 | 2026-11-11 | 5.3 Medium | ||
| The Redirection for Contact Form 7 WordPress plugin before 3.2.16 does not verify ownership of the email address supplied through its data request form action and by default records the resulting request as already confirmed, allowing unauthenticated visitors to create verified WordPress personal data erasure or export requests for addresses they do not control. | ||||
| CVE-2026-117523 | 2026-11-11 | 4.3 Medium | ||
| The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not perform a capability or nonce check on an AJAX action that saves its module configuration, allowing any authenticated user, including Subscribers, to enable or disable the Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1's modules site-wide. | ||||
| CVE-2026-115733 | 2026-11-11 | 9.1 Critical | ||
| The Printaura-Woocommerce WordPress plugin through 4.0.2 does not properly restrict access to the WooCommerce REST API, causing every WooCommerce REST route to accept unauthenticated requests, which allows unauthenticated attackers to read and modify store data including customer orders and personal information, store and payment settings, and webhooks. | ||||
| CVE-2026-110949 | 2026-11-11 | 3.7 Low | ||
| The Download Manager WordPress plugin before 3.3.73, Download Manager WordPress plugin before 7.6.2 does not verify a package's configured role restriction when validating a package password, allowing an unauthenticated user who knows the password of a role-restricted package to obtain a download key and download the protected file. | ||||
| CVE-2026-110948 | 2026-11-11 | 3.7 Low | ||
| The Download Manager WordPress plugin before 3.3.73, Download Manager WordPress plugin before 7.6.2 does not verify that a visitor is allowed to access a package before its media-preview renderers issue a download key for it, allowing unauthenticated visitors to download password-locked and role-restricted files by reading the key from a public page. | ||||
| CVE-2026-109873 | 2026-11-11 | 5.3 Medium | ||
| The User Registration & Membership WordPress plugin before 5.3.2 does not enforce its payment-before-login restriction when a registration is submitted without a membership selection, allowing unauthenticated users to create an account on a payment-gated registration form and log in without completing payment. | ||||
| CVE-2026-109871 | 2026-11-11 | 4.3 Medium | ||
| The User Registration & Membership WordPress plugin before 5.3.2 does not verify that a payment has actually been completed before extending a paid membership subscription, allowing authenticated users with an active paid subscription to renew it indefinitely without paying. | ||||
| CVE-2025-29940 | 2026-11-11 | N/A | ||
| Unverified ownership in Secure Encrypted Virtualization (SEV) firmware could allow a privileged attacker with access to a malicious hypervisor to overwrite guest memory if segmented Reverse Map Table (RMP) is enabled potentially resulting in loss of guest data integrity. | ||||
| CVE-2026-118108 | 1 Microsoft | 8 Microsoft Sql Server 2017 For X64-based Systems \(cu31\), Microsoft Sql Server 2019 For X64-based Systems \(cu32\), Microsoft Sql Server 2022 For X64-based Systems \(cu27\) and 5 more | 2026-11-11 | 7.5 High |
| Improper authorization in SQL Server allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-105544 | 1 Microsoft | 16 .net 10.0 Installed On Linux, .net 10.0 Installed On Mac Os, .net 10.0 Installed On Windows and 13 more | 2026-11-11 | 7.5 High |
| Improper access control in .NET allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-103883 | 2026-11-11 | 8.8 High | ||
| The 6Storage Rentals plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 2.31.0. The vulnerability exists because the `six_storage_portal_registration()` AJAX handler — registered on `wp_ajax_six_storage_portal_plugin_registration` — performs no capability check and no nonce verification before writing the caller-supplied `six_storage_online_api_url` POST parameter to the site-wide option of the same name; the unauthenticated `six_storage_create_wp_user()` handler then redeems a transient seeded from that attacker-controlled URL's response and unconditionally calls `wp_set_current_user()` and `wp_set_auth_cookie()` with no ownership or credential verification. This makes it possible for authenticated attackers, with Subscriber-level access and above, to authenticate as any existing WordPress user — including any administrator whose email address is known or guessable — resulting in full site compromise. This issue represents an incomplete fix for a prior vulnerability: the 2.29.0 remediation moved the target email out of POST data into a server-side transient, but because any Subscriber can still overwrite the outbound API URL that populates that transient, the full authentication bypass chain remains exploitable in three AJAX requests. | ||||
| CVE-2026-124738 | 1 Redhat | 2 Hummingbird, Rhel Els | 2026-11-11 | 5.3 Medium |
| A flaw was found in BusyBox. When the HTTP daemon (httpd) has pre-compressed file support enabled, authentication checks are evaluated only against the requested URL path rather than the pre-compressed file being served. A remote attacker can exploit this flaw by requesting an uncompressed file path while specifying gzip encoding, bypassing password rules configured specifically for the compressed file. This vulnerability can lead to unauthorized information disclosure of sensitive files. | ||||
| CVE-2026-106025 | 2026-11-11 | 5.3 Medium | ||
| The Cargo Shipping Location for WooCommerce WordPress plugin before 6.0 does not properly restrict access to a REST API endpoint that updates order shipment statuses, relying on an attacker-controllable value for authorization, allowing unauthenticated users to manipulate order statuses and shipment metadata. | ||||
| CVE-2026-14214 | 1 Wordpress-extensions | 1 Amelia | 2026-11-11 | 2.7 Low |
| The Booking for Appointments and Events Calendar WordPress plugin before 2.4.4 does not restrict which fields can be written through its customer import, allowing a user with the Amelia Manager role to modify arbitrary columns of any stored user record by supplying them in the import request. | ||||
| CVE-2026-14315 | 1 Wordpress-extensions | 1 Pixel Tag Manager For Woocommerce | 2026-11-11 | 6.5 Medium |
| The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.1 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to submit forged e-commerce conversion events to the site's configured server-side advertising conversion APIs using the site's stored credentials. | ||||
| CVE-2026-14561 | 1 Wordpress-extensions | 1 Authora | 2026-11-11 | 6.5 Medium |
| The Authora : Easy login with mobile number WordPress plugin before 1.7.7 does not keep its one-time login code confidential, returning the code and a valid verification token in the response of an unauthenticated action, allowing unauthenticated attackers to log in as any user whose registered mobile number they know (including administrators) or to create arbitrary accounts. | ||||
| CVE-2026-15151 | 1 Wordpress-extensions | 1 Five Star Restaurant Reservations | 2026-11-11 | 7.5 High |
| The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not perform a capability check on one of its AJAX actions, allowing users with the lowest booking-management role (which by default cannot access the Five Star Restaurant Reservations WordPress plugin before 2.7.23's settings) to reset the site's configured booking notification rules. | ||||