Export limit exceeded: 16307 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (16307 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-81784 | 2 Marcin, Wordpress | 2 Wise Chat, Wordpress | 2026-10-06 | 8.1 High |
| Deserialization of Untrusted Data vulnerability in Marcin Wise Chat wise-chat allows Object Injection.This issue affects Wise Chat: from n/a through 3.4.2. | ||||
| CVE-2025-53999 | 2 Themegoods, Wordpress | 2 Altair, Wordpress | 2026-10-05 | 6.5 Medium |
| Unauthenticated Broken Access Control in Altair <= 5.2.2 versions. | ||||
| CVE-2025-15637 | 2 Edge Themes, Wordpress | 2 Shuffle, Wordpress | 2026-10-05 | 8.1 High |
| Unauthenticated Local File Inclusion in Shuffle <= 1.8 versions. | ||||
| CVE-2025-15689 | 2 Themegoods, Wordpress | 2 Capella, Wordpress | 2026-10-05 | 9.8 Critical |
| Unauthenticated Privilege Escalation in Capella <= 2.5.5 versions. | ||||
| CVE-2025-58222 | 1 Wordpress | 1 Wordpress | 2026-10-05 | 5.3 Medium |
| Missing Authorization vulnerability in Dynamic Web Lab Team Manager wp-team-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Team Manager: from n/a through 2.6.8. | ||||
| CVE-2025-53345 | 2 Thimpress, Wordpress | 2 Thim Core, Wordpress | 2026-10-05 | 8.8 High |
| Missing Authorization vulnerability in ThimPress Thim Core thim-core.This issue affects Thim Core: from n/a through 2.3.3. | ||||
| CVE-2026-66621 | 2 Ultimate Dashboard Project, Wordpress | 2 Ultimate Dashboard, Wordpress | 2026-10-05 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ultimate Dashboard Ultimate Dashboard Pro ultimate-dashboard-pro allows DOM-Based XSS.This issue affects Ultimate Dashboard Pro: from n/a through 3.11.2. | ||||
| CVE-2026-81793 | 2 Dimitri Grassi, Wordpress | 2 Salon Booking System, Wordpress | 2026-10-05 | 6.5 Medium |
| Missing Authorization vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salon booking system: from n/a through 10.31.9. | ||||
| CVE-2026-56005 | 2 Melapress, Wordpress | 2 Wp Activity Log, Wordpress | 2026-10-02 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log wp-security-audit-log allows Stored XSS.This issue affects WP Activity Log: from n/a through 5.6.3.1. | ||||
| CVE-2026-73382 | 2 Geminilabs, Wordpress | 2 Site Reviews, Wordpress | 2026-10-02 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gemini Labs Site Reviews site-reviews allows Stored XSS.This issue affects Site Reviews: from n/a through 8.2.0. | ||||
| CVE-2024-31435 | 2 Inisev, Wordpress | 2 Social Media & Share Icons, Wordpress | 2026-10-02 | 4.3 Medium |
| : Missing Authorization vulnerability in Inisev Social Media & Share Icons allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Social Media & Share Icons: from n/a through 2.8.6. | ||||
| CVE-2024-33909 | 2 Avirtum, Wordpress | 2 Ipages Flipbook, Wordpress | 2026-10-02 | 5.3 Medium |
| Missing Authorization vulnerability in Avirtum iPages Flipbook allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects iPages Flipbook: from n/a through 1.5.1. | ||||
| CVE-2024-35690 | 2 Marketingfire, Wordpress | 2 Widget-options, Wordpress | 2026-10-02 | 6.5 Medium |
| Insertion of sensitive information into sent data vulnerability in MarketingFire Widget Options allows Retrieve Embedded Sensitive Data. This issue affects Widget Options: from n/a through 4.0.1. | ||||
| CVE-2026-65640 | 1 Wordpress | 1 Wordpress | 2026-10-01 | N/A |
| WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Prerequisites: * Imagick and Ghostscript in use on the server * A malicious user with the `upload_files` capability This issue affects all versions of WordPress. Version 7.0.4 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7. | ||||
| CVE-2026-12227 | 2 Visualcomposer, Wordpress | 2 Visual Composer Website Builder, Wordpress | 2026-10-01 | 9.8 Critical |
| The Visual Composer Website Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 45.16.0 via the `vcv-template` parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. | ||||
| CVE-2026-12256 | 2 Theme-fusion, Wordpress | 2 Avada, Wordpress | 2026-10-01 | 8.8 High |
| Deserialization of Untrusted Data vulnerability in ThemeFusion Fusion Builder fusion-builder allows Object Injection.This issue affects Fusion Builder: from n/a through 3.15.3. | ||||
| CVE-2026-93339 | 2 Metaphorcreations, Wordpress | 2 Ditty, Wordpress | 2026-10-01 | 5.4 Medium |
| Metaphor Creations Ditty (ditty-news-ticker) before 3.1.70 contains a stored cross-site scripting vulnerability that allows authenticated users with Author-level privileges or higher to inject arbitrary HTML elements by supplying malicious wrapper attribute values in layout tags. The ditty_layout_render_tag_wrapper() function inserts caller-supplied wrapper attribute values directly as HTML element names without allowlist validation, bypassing wp_kses_post() sanitization because KSES runs at save time before layout tag attributes are resolved at render time, causing the payload to execute in the browser of any visitor viewing posts or pages embedding the affected Ditty item. | ||||
| CVE-2026-89031 | 2 Adenion, Wordpress | 2 Blog2social, Wordpress | 2026-10-01 | 5.4 Medium |
| Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to modify the scheduled post records of other users. The b2s_calendar_move_post AJAX handler in includes/Ajax/Post.php issues an UPDATE against the b2s_posts table using only the attacker-supplied b2s_id primary key with no blog_user_id ownership constraint, allowing any user with the edit_posts capability to reschedule, suppress, or alter the publication state of any other user's scheduled social media post. | ||||
| CVE-2026-89030 | 2 Adenion, Wordpress | 2 Blog2social, Wordpress | 2026-10-01 | 4.3 Medium |
| Adenion Blog2Social plugin for WordPress before 9.1.0 exposes the email addresses of all registered WordPress users to low-privileged accounts. The b2s_search_user AJAX handler in includes/Ajax/Get.php invokes B2S_Tools::searchUser() in includes/Tools.php, which returns the email address of every matching user without restricting access to callers holding the list_users capability, allowing any user with the edit_posts capability to retrieve user email addresses including those of administrators. | ||||
| CVE-2026-89029 | 2 Adenion, Wordpress | 2 Blog2social, Wordpress | 2026-10-01 | 4.3 Medium |
| Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to enumerate WordPress user accounts. The b2s_get_select_mandant_user AJAX handler in includes/Ajax/Get.php resolves arbitrary user IDs supplied in the owner parameter to display names without verifying that the caller is authorized to read user account data, allowing any user with the edit_posts capability to map WordPress user IDs to display names and confirm account existence for arbitrary IDs. | ||||