Export limit exceeded: 425066 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425066 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425066 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-121491 | 1 Wordpress-extensions | 1 Fiber Admin | 2026-11-12 | 9.0 Critical |
| The Fiber Admin WordPress plugin before 4.0.1 does not validate or escape a request header before writing it into a PHP file it regenerates on an unprotected admin hook, allowing unauthenticated attackers to execute arbitrary code when its custom database error page is enabled and they win a race against an administrator saving its settings. | ||||
| CVE-2026-121492 | 1 Wordpress-extensions | 1 Fiber Admin | 2026-11-12 | 5.3 Medium |
| The Fiber Admin WordPress plugin before 4.0.1 does not have authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the order of arbitrary posts, including drafts, private posts and navigation menu items, as well as the order of taxonomy terms when term ordering is enabled. | ||||
| CVE-2026-121796 | 1 Wordpress-extensions | 1 Add From Server Lite | 2026-11-12 | 6.8 Medium |
| The Add From Server Lite WordPress plugin before 6.0.0 does not restrict SVG uploads to users allowed to post unfiltered HTML, allowing users with the Author role and above to upload SVG files containing JavaScript and perform Stored XSS attacks. | ||||
| CVE-2026-121848 | 1 Wordpress-extensions | 1 Magic Link | 2026-11-12 | 8.8 High |
| The Magic Link WordPress plugin before 2.2.6 does not check that the user requesting a login link is authorised to generate one for the chosen account, allowing any authenticated user, such as a subscriber, to generate a working login link for an administrator and log in as them. | ||||
| CVE-2026-124013 | 2026-11-12 | 8.8 High | ||
| XWEB EVO 5.6.2 through 5.8.8 contains an authenticated OS command injection vulnerability in the api.lua import_preconfiguration and restore actions, where server_url and related server credential fields are concatenated unescaped into a root curl command executed via io.popen. Attackers can inject malicious shell commands through these unfiltered parameters to achieve arbitrary command execution with root privileges on the underlying system. This product line reached it's end of service date in March 2026. | ||||
| CVE-2026-121866 | 1 Wordpress-extensions | 1 Exsile Sms Gateway | 2026-11-12 | 8.8 High |
| The iLeads SMS Gateway by Exsile WordPress plugin before 2.0.0 does not check capabilities or nonces in several AJAX actions that update a site option chosen by the request, allowing any authenticated user, such as a subscriber, to change arbitrary WordPress options and escalate to administrator, for example by enabling registration with administrator as the default role. | ||||
| CVE-2026-122001 | 1 Wordpress-extensions | 1 Komfortkasse For Woocommerce | 2026-11-12 | 8.8 High |
| The Komfortkasse for WooCommerce WordPress plugin before 1.4.9 does not properly validate the authenticity of REST API requests, overriding WordPress's own nonce verification so that a request forged in a logged-in administrator's browser is accepted, which can be used to create a new administrator account and fully take over the site. | ||||
| CVE-2026-122265 | 2 Vanquish83, Wordpress-extensions | 2 Vanquish Upload Files For Woocommerce, Vanquish Upload Files For Woocommerce | 2026-11-12 | 5.9 Medium |
| The Vanquish Upload Files for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.7.13 via the 'vanupfi_file_name' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The authorization bypass is achieved by supplying a non-existent order ID (e.g., '.pdf'), which causes wc_get_order() to return false and short-circuits the vanupfi_user_can_access_order_files() check, while the is_pdf() branch selector's loose strpos() substring match allows a traversal payload such as '../.pdf/../../../../wp-config.php' to satisfy the PDF branch and be streamed verbatim via readfile(). | ||||
| CVE-2026-118801 | 2 Kodezen, Wordpress-extensions | 2 Ablocks, Ablocks | 2026-11-12 | 4.3 Medium |
| The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.18.0 via the 'id' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the full rendered body content of any password-protected post of any post type by embedding the shortcode with the target post's ID. Author-level attackers and above can additionally publish a post embedding the shortcode, exposing the password-protected content to unauthenticated visitors. | ||||
| CVE-2026-124012 | 2026-11-12 | 8.1 High | ||
| XWEB EVO 5.6.2 through 5.8.8 contains a hardcoded credential vulnerability where the Administrator web account is configured to use password_mode daily_password with no stored password, as the Users.authenticate function in lualib_users.lua synthesizes the Administrator configuration without validating any stored secret. Attackers who can derive the MAC-based daily password can authenticate as Administrator to obtain a full admin session on the device. This product line reached it's end of service date in March 2026. | ||||
| CVE-2026-118800 | 2 Kodezen, Wordpress-extensions | 2 Ablocks, Ablocks | 2026-11-12 | 6.4 Medium |
| The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'headingTag' parameter in all versions up to, and including, 2.18.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-104738 | 2 Nasirahmed, Wordpress-extensions | 2 Advanced Form Integration, Advanced Form Integration | 2026-11-12 | 8.1 High |
| The Advanced Form Integration — Connect Forms to 300+ Apps plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.10.2 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. Exploitation requires that an administrator has previously configured at least one active NexForms integration (status=1) in the plugin's database table; in the free tier, only POST parameter keys containing the substrings 'name', 'email', 'first', or 'last' are routed to the vulnerable normalizer. | ||||
| CVE-2026-39733 | 2 Properfraction, Wordpress-extensions | 2 Profilepress, Profilepress | 2026-11-12 | 5.3 Medium |
| Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in properfraction ProfilePress wp-user-avatar allows Code Injection.This issue affects ProfilePress: from n/a through 4.17.7. | ||||
| CVE-2026-121778 | 2 Wordpress-extensions, Wp Lab | 2 Wp-lister Lite For Amazon, Wp Lister Lite For Amazon | 2026-11-12 | 5.3 Medium |
| Missing Authorization vulnerability in WP Lab WP-Lister Lite for Amazon wp-lister-for-amazon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-Lister Lite for Amazon: from n/a through 2.9.2. | ||||
| CVE-2026-121767 | 2 Wedevs, Wordpress-extensions | 2 Wedocs, Wedocs | 2026-11-12 | 5.3 Medium |
| Missing Authorization vulnerability in weDevs weDocs wedocs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects weDocs: from n/a through 2.6.1. | ||||
| CVE-2026-124011 | 2026-11-12 | 5.3 Medium | ||
| XWEB EVO 5.6.2 through 5.8.8 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the device's eth0 MAC address and system clock by accessing sysinfo.lua, which also feeds the pre-login page. Attackers can use the disclosed MAC address and system clock values to offline derive the MAC-based daily password, enabling unauthorized authentication to the device. This product line reached it's end of service date in March 2026. | ||||
| CVE-2026-122675 | 2 Wordpress-extensions, Wpmet | 2 Wp Social, Wp Social | 2026-11-12 | 5.4 Medium |
| Cross-Site Request Forgery (CSRF) vulnerability in Wpmet Wp Social wp-social allows Cross Site Request Forgery.This issue affects Wp Social: from n/a through 3.2.3. | ||||
| CVE-2026-124274 | 2 Mycred, Wordpress-extensions | 2 Mycred, Mycred | 2026-11-12 | 5.3 Medium |
| Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2. | ||||
| CVE-2026-120848 | 2 Wclovers, Wordpress-extensions | 2 Wcfm Marketplace, Wcfm Marketplace | 2026-11-12 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketplace allows Stored XSS.This issue affects WCFM Marketplace: from n/a through 3.8.3. | ||||
| CVE-2026-120849 | 2 Wclovers, Wordpress-extensions | 2 Wcfm Marketplace, Wcfm Marketplace | 2026-11-12 | 4.3 Medium |
| Missing Authorization vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketplace allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Marketplace: from n/a through 3.8.3. | ||||