Export limit exceeded: 425066 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425066 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-123668 | 1 Wordpress-extensions | 1 Getpaid | 2026-11-12 | 5.3 Medium |
| The GetPaid WordPress plugin from 2.8.63 to 2.8.64 does not ensure item quantities on its payment forms are whole numbers, allowing unauthenticated users to have an invoice for a priced item marked as paid without being charged. | ||||
| CVE-2026-111579 | 1 Wordpress-extensions | 1 Forminator Forms | 2026-11-12 | 8.1 High |
| The Forminator Forms WordPress plugin before 1.58.4 does not enforce payment on the server side when a form's configured payment gateway is unavailable, allowing unauthenticated visitors to complete a payment-gated User Registration form without paying and be assigned the form's configured role, up to administrator, after the gateway has been connected and later disconnected. | ||||
| CVE-2026-117524 | 1 Wordpress-extensions | 1 Dynific Addons For Elementor | 2026-11-12 | 2.7 Low |
| The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not perform a status or capability check when resolving post identifiers passed to one of its shortcodes, allowing authenticated users with at least the Contributor role to disclose the content of other users' draft, private and password-protected posts. An Author can republish that content to anonymous visitors. | ||||
| CVE-2026-119302 | 1 Wordpress-extensions | 1 Notificationx | 2026-11-12 | 6.5 Medium |
| The NotificationX WordPress plugin before 3.3.7 does not perform any capability, authentication or nonce check on its notification preview path, allowing unauthenticated users to disclose the content of private, draft, pending and password-protected posts and to execute arbitrary registered shortcodes by supplying crafted preview data on any front-end request. | ||||
| CVE-2026-104718 | 2026-11-12 | 6.8 Medium | ||
| The Elementor Website Builder WordPress plugin before 4.3.6 does not validate or escape an element identifier before rendering it into a client-side framework attribute that is evaluated as JavaScript, allowing users with the Contributor role to store scripts that execute in the browser of anyone viewing the affected content, including an administrator reviewing the submission for publication. | ||||
| CVE-2026-109873 | 2026-11-12 | 5.3 Medium | ||
| The User Registration & Membership WordPress plugin before 5.3.2 does not enforce its payment-before-login restriction when a registration is submitted without a membership selection, allowing unauthenticated users to create an account on a payment-gated registration form and log in without completing payment. | ||||
| CVE-2026-115734 | 1 Wordpress-extensions | 1 Pay With A Tweet | 2026-11-12 | 9.6 Critical |
| The Pay with a tweet WordPress plugin through 1.0.5 does not validate a file path before deleting it, nor does it restrict access to the relevant administration screens, allowing users with a role as low as Subscriber to delete arbitrary files on the server, which can lead to a full site compromise. | ||||
| CVE-2026-118439 | 1 Wordpress-extensions | 1 Limit Login Attempts Reloaded | 2026-11-12 | 4.1 Medium |
| The Limit Login Attempts Security WordPress plugin before 3.4.2 does not validate the destination of a server-side request built from a user-supplied setup value, allowing users with administrator privileges to make the site issue requests to arbitrary hosts, including internal ones (SSRF). | ||||
| CVE-2026-119034 | 2026-11-12 | 5.3 Medium | ||
| The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not verify that a post is publicly viewable before returning its approved comments through the review feature, allowing unauthenticated attackers to read approved comments on private, draft and password-protected posts, and to retrieve approved comments site-wide. | ||||
| CVE-2026-119035 | 2026-11-12 | 6.4 Medium | ||
| The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not safely encode its structured data output when the Pretty Print option is enabled, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks when the site maps a schema property to a custom field. | ||||
| CVE-2026-121497 | 1 Wordpress-extensions | 1 Askany | 2026-11-12 | 9.8 Critical |
| The AskAny WordPress plugin before 2.2.0 does not validate the extension or content of files attached to chat messages, trusting the browser-supplied file type instead, which allows unauthenticated users to upload PHP files and execute arbitrary code when visitor attachments are enabled. | ||||
| CVE-2026-119032 | 2026-11-12 | 5.3 Medium | ||
| The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not check that the importing user may edit the posts named in a settings backup, nor restrict the import to its own post types, allowing users whose role an administrator has granted access to the Schema & Structured Data for WP & AMP WordPress plugin before 1.70's settings to modify, re-author, unpublish or trash any post or page on the site and write arbitrary post meta. | ||||
| CVE-2026-119303 | 1 Wordpress-extensions | 1 Notificationx | 2026-11-12 | 5.3 Medium |
| The NotificationX WordPress plugin before 3.3.7 does not perform any capability or nonce check on one of its REST routes, allowing unauthenticated users to update a NotificationX WordPress plugin before 3.3.7 option and to repeatedly trigger emails sent through the site's own mail server. | ||||
| CVE-2026-123666 | 1 Wordpress-extensions | 1 Photo Engine | 2026-11-12 | 4.9 Medium |
| The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.2 does not check that a user may delete the media in a collection before deleting it along with the collection, allowing users with the Author role and above to permanently delete other users' synced media, including administrators'. | ||||
| CVE-2026-110949 | 2026-11-12 | 3.7 Low | ||
| The Download Manager WordPress plugin before 3.3.73, Download Manager WordPress plugin before 7.6.2 does not verify a package's configured role restriction when validating a package password, allowing an unauthenticated user who knows the password of a role-restricted package to obtain a download key and download the protected file. | ||||
| CVE-2026-117521 | 1 Wordpress-extensions | 1 Dynific Addons For Elementor | 2026-11-12 | 6.8 Medium |
| The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not escape a user-controlled profile value before outputting it in a quoted attribute in one of its Elementor widgets, allowing authenticated users with the Author role to store a payload that executes in the session of anyone, including an administrator, who views a post the attacker authored, resulting in Stored Cross-Site Scripting. | ||||
| CVE-2026-117523 | 1 Wordpress-extensions | 1 Dynific Addons For Elementor | 2026-11-12 | 4.3 Medium |
| The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not perform a capability or nonce check on an AJAX action that saves its module configuration, allowing any authenticated user, including Subscribers, to enable or disable the Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1's modules site-wide. | ||||
| CVE-2026-121472 | 1 Wordpress-extensions | 1 Automatorwp | 2026-11-12 | 5 Medium |
| The AutomatorWP WordPress plugin before 6.0.8 does not bind the requests that complete its Zoom and AWeber integration connections to the administrator who started them, allowing attackers to make a logged-in administrator replace the stored integration credentials with the attacker's own via a CSRF attack, diverting the data the site sends to those services into an account the attacker controls. Exploitation requires the integration to already be connected and knowledge of the site's OAuth client identifier. | ||||
| CVE-2026-57845 | 1 Huggingface | 1 Datasets | 2026-11-12 | 8.8 High |
| Hugging Face Datasets before 5.2.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle file loaded through the deprecated pandas packaged builder. Attackers can supply a pickle-backed dataset that is processed by Pandas._generate_tables via pandas.read_pickle() without validation, so when a victim calls datasets.load_dataset("pandas", data_files=...), the embedded __reduce__ payload executes code with the victim process's privileges. | ||||
| CVE-2026-63980 | 1 Linux | 1 Linux Kernel | 2026-11-12 | 7.5 High |
| In the Linux kernel, the following vulnerability has been resolved: net/handshake: Use spin_lock_bh for hn_lock nvmet_tcp_state_change(), a socket callback that runs in BH context, can reach handshake_req_cancel() via nvmet_tcp_schedule_release_queue() and tls_handshake_cancel(). handshake_req_cancel() acquires hn->hn_lock with plain spin_lock(). If a process-context thread on the same CPU holds hn->hn_lock when a softirq invokes the cancel path, the lock attempt deadlocks. This is the only caller that invokes tls_handshake_cancel() from BH context; every other consumer calls it from process context. Deferring the cancel to process context in the NVMe target is not straightforward: nvmet_tcp_schedule_release_queue() must call tls_handshake_cancel() atomically with its state transition to DISCONNECTING. If the cancel were deferred, the handshake completion callback could fire in the window before the cancel runs, observe the unexpected state, and return without dropping its kref on the queue. Reworking that interlock is considerably more invasive than hardening the handshake lock. Convert all hn->hn_lock acquisitions from spin_lock/spin_unlock to spin_lock_bh/spin_unlock_bh so the lock is never taken with softirqs enabled. | ||||