Export limit exceeded: 424637 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 424637 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (424637 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-126331 | 2026-11-11 | N/A | ||
| Insertion of sensitive information into sent data in the user list endpoint in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with delegated user-viewing permissions to obtain users' API key secret hashes via the user list API response. | ||||
| CVE-2026-126328 | 2026-11-11 | N/A | ||
| Insertion of sensitive information into sent data in the user endpoints in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with delegated user-viewing permissions to obtain users' MFA shared secrets via the user API responses. | ||||
| CVE-2026-126327 | 2026-11-11 | N/A | ||
| Improper access control in the connection history in Devolutions Server 2026.3.13.0 allows an authenticated user without the permission to view passwords to obtain historical entry passwords via the connection history API. | ||||
| CVE-2026-19697 | 1 Wordpress-extensions | 1 Gutenkit | 2026-11-11 | 6.8 Medium |
| The GutenKit WordPress plugin before 2.5.0 does not sanitise uploaded SVG files on all of the upload paths it enables, allowing users with the file upload capability, such as Author, to upload a malicious SVG and perform Stored Cross-Site Scripting attacks against any user opening it, including administrators. | ||||
| CVE-2026-19699 | 1 Wordpress-extensions | 1 Gutenkit | 2026-11-11 | 2.7 Low |
| The GutenKit WordPress plugin before 2.5.0 does not have a sufficient capability check on some of its REST API endpoints, allowing users with the Contributor role and above to retrieve mailing-list audience metadata from the site's connected marketing account. | ||||
| CVE-2026-75860 | 1 Wordpress-extensions | 1 Json Options | 2026-11-11 | 9.8 Critical |
| The JSON Options WordPress plugin through 0.0.4 does not have any capability check or nonce verification on one of its actions, which runs on every request and is available to unauthenticated users, allowing them to update arbitrary WordPress options. This can be leveraged to enable user registration and set the default role to administrator, leading to privilege escalation and full site takeover. | ||||
| CVE-2026-13736 | 1 Wordpress-extensions | 1 Newpath Wildapricotpress Add-on | 2026-11-11 | 5.3 Medium |
| The NewPath WildApricotPress Add-on WordPress plugin through 1.0.0 does not enforce its members-only field privacy on an unauthenticated REST route, allowing anonymous visitors to read member email addresses and phone numbers that are configured to be visible to members only. | ||||
| CVE-2026-15046 | 1 Wordpress-extensions | 1 Store To Woocommerce Migration | 2026-11-11 | 4.2 Medium |
| The LitExtension WordPress plugin through 1.2.5 does not verify a nonce before an administrative action that overwrites the store-migration connector's authentication token, allowing attackers to take over the connector token by tricking a logged-in administrator into clicking a crafted link (CSRF). | ||||
| CVE-2026-14187 | 1 Wordpress-extensions | 1 Tutor Lms | 2026-11-11 | 2.7 Low |
| The Tutor LMS WordPress plugin before 4.0.6 does not enforce per-object ownership checks on its course content type, allowing any user with the instructor role to read the content of private courses belonging to other instructors. | ||||
| CVE-2026-2811 | 1 Wordpress-extensions | 1 Ajaxify Comments | 2026-11-11 | 5.4 Medium |
| The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary HTTP headers. | ||||
| CVE-2025-15691 | 1 Wordpress-extensions | 1 Wpfunnels | 2026-11-11 | 5.3 Medium |
| The WPFunnels WordPress plugin before 3.13.0 does not check whether user registration is enabled on the site before creating accounts from opt-in form submissions, relying on a value supplied in the request instead, allowing unauthenticated attackers to create WordPress user accounts even when registration is disabled. This is an incomplete fix for CVE-2025-12353: the check added in 3.6.3 covers only one of the three registration paths. | ||||
| CVE-2026-16281 | 1 Wordpress-extensions | 1 Classified Listing | 2026-11-11 | 7.1 High |
| The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes or attaches media, allowing any authenticated user, including a subscriber, to permanently delete attachments from, and attach files to, any listing owned by another user. | ||||
| CVE-2026-17517 | 1 Wordpress-extensions | 1 Content Views | 2026-11-11 | 5.3 Medium |
| The Content Views WordPress plugin before 4.5.1.2 does not check whether the user requesting a view is allowed to read the posts it returns, allowing unauthenticated attackers to obtain the title and content of non-public posts, such as draft, pending, private and scheduled posts, when a view has been configured to include them. | ||||
| CVE-2026-19224 | 1 Wordpress-extensions | 1 Hummingbird | 2026-11-11 | 7.2 High |
| The Hummingbird Performance WordPress plugin before 3.21.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network. | ||||
| CVE-2026-74853 | 1 Wordpress-extensions | 1 Pods | 2026-11-11 | 6.8 Medium |
| The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display callback may resolve to, allowing users with the author role and above to read arbitrary files from the server, including files outside the web root. Only sites using the restricted display-callback mode are affected, which is the automatic default on installations whose first Pods version predates 3.1. | ||||
| CVE-2026-82186 | 1 Wordpress-extensions | 1 Wplp Cookie Consent | 2026-11-11 | 4.1 Medium |
| The WPLP Cookie Consent WordPress plugin before 4.4.2 does not properly validate a pagination parameter before using it in a SQL query, allowing users with administrator privileges to perform SQL injection attacks. | ||||
| CVE-2026-84066 | 1 Wordpress-extensions | 1 Directorist | 2026-11-11 | 3.1 Low |
| The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9 does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadata, allowing users with the subscriber role and above to overwrite image metadata on posts belonging to other users. | ||||
| CVE-2026-84043 | 1 Wordpress-extensions | 1 Epayco Payment Gateway For Woocommerce | 2026-11-11 | 5.3 Medium |
| The ePayco Payment Gateway for WooCommerce WordPress plugin before 8.4.7 does not properly verify the authenticity of payment confirmation requests, allowing unauthenticated attackers to mark orders as paid without a valid gateway signature. | ||||
| CVE-2026-84044 | 1 Wordpress-extensions | 1 Restaurant Menu And Food Ordering | 2026-11-11 | 5.3 Medium |
| The Restaurant Menu and Food Ordering WordPress plugin before 2.4.12 does not verify that a PayPal payment notification genuinely originates from PayPal, allowing unauthenticated attackers to forge a payment notification and mark their own order as paid and completed without making any payment. | ||||
| CVE-2026-19861 | 1 Wordpress-extensions | 1 Jetformbuilder | 2026-11-11 | 4.7 Medium |
| The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not properly sanitise and escape a form field's value before including it in the HTML notification emails it sends, allowing unauthenticated users to inject arbitrary HTML into messages delivered to administrators and other recipients. Whether injected script executes depends on the recipient's mail client, but the injected markup is rendered regardless. | ||||