Export limit exceeded: 223965 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (223965 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-14216 | 1 Wordpress-extensions | 1 Amelia | 2026-11-11 | 6.5 Medium |
| The Booking for Appointments and Events Calendar WordPress plugin before 2.4.7 does not require authentication before processing its pending notification queue, allowing an unauthenticated user to force the dispatch of queued notifications and integration callbacks. | ||||
| CVE-2026-14550 | 1 Wordpress-extensions | 1 Wpcafe | 2026-11-11 | 5.3 Medium |
| The WPCafe WordPress plugin before 3.0.18 does not perform an authorization check when creating a reservation through its REST API, verifying only a publicly available nonce, allowing unauthenticated users to submit reservations with an arbitrary approval status and bypass the administrator moderation workflow. | ||||
| CVE-2026-16984 | 1 Wordpress-extensions | 1 Wp Legal Pages | 2026-11-11 | 6.5 Medium |
| The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1 does not include an authorization check on a REST route that returns stored account data, allowing unauthenticated visitors to retrieve the connected service's API secret and account details, which can then be used to disconnect the Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1's integration. | ||||
| CVE-2026-16986 | 1 Wordpress-extensions | 1 Booking Package | 2026-11-11 | 5.3 Medium |
| The Booking Package WordPress plugin before 1.7.25 does not validate the payment amount server-side against the stored service price, deriving the expected charge from attacker-supplied request values instead, so an unauthenticated attacker can pay an arbitrary fraction of a service's real price. | ||||
| CVE-2026-19094 | 1 Wordpress-extensions | 1 Tutor Lms | 2026-11-11 | 5.3 Medium |
| The Tutor LMS WordPress plugin before 4.0.6 does not validate values used to build a database query, and does not restrict which template file a request may load, allowing unauthenticated users to inject SQL and to read question and answer content belonging to courses that are not publicly available. The injected text reaches the query as grammar rather than as data, and on the database engines tested it does not yield extraction of arbitrary data, so the confidentiality impact is the disclosed course content rather than the database at large. | ||||
| CVE-2026-19226 | 1 Wordpress-extensions | 1 Royal Elementor Addons | 2026-11-11 | 6.8 Medium |
| The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not validate some widget settings before outputting them inside an HTML attribute, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks. | ||||
| CVE-2026-19718 | 1 Wordpress-extensions | 3 Blogvault, Malcare, Wp Remote | 2026-11-11 | 8.1 High |
| The BlogVault Backup & Staging WordPress plugin before 6.65, MalCare WordPress Security Plugin WordPress plugin before 6.65, The WP Remote WordPress Plugin WordPress plugin before 6.65 do not prevent unauthenticated users from obtaining data derived from the secret that binds a site to its remote management service, and generate that secret with a weak pseudo-random number generator, allowing attackers to recover it and gain administrative access to the site. | ||||
| CVE-2026-74851 | 1 Wordpress-extensions | 1 Pods | 2026-11-11 | 7.2 High |
| The Pods WordPress plugin before 3.3.9.1 does not correctly compare a display callback against its list of blocked functions, allowing users with the author role and above to execute arbitrary code on the server. Only sites using the restricted display-callback mode are affected, which is the automatic default on installations whose first Pods version predates 3.1. | ||||
| CVE-2026-74928 | 1 Wordpress-extensions | 1 Project Manager | 2026-11-11 | 7.5 High |
| The Project Manager WordPress plugin before 4.0.7 does not have any authorisation check on its import routes, allowing unauthenticated users to create WordPress accounts with a password the attacker already knows, bypassing the site's own registration setting. | ||||
| CVE-2026-74929 | 1 Wordpress-extensions | 1 Project Manager | 2026-11-11 | 5.4 Medium |
| The Project Manager WordPress plugin before 4.0.7 does not restrict several of its REST API routes to the projects a user belongs to, allowing any authenticated user, such as a subscriber, to read other projects' task content and user email addresses and to modify other projects' task boards. | ||||
| CVE-2026-74930 | 1 Wordpress-extensions | 1 Wp Project Manager | 2026-11-11 | 4.3 Medium |
| The Project Manager WordPress plugin before 4.0.7 does not check that the user whose activity is being requested is the one making the request in one of its REST API routes, allowing any authenticated user, such as a subscriber, to read any other user's activity history along with their email address and the details of projects they have no access to. | ||||
| CVE-2026-77693 | 1 Wordpress-extensions | 1 Order Tip For Woocommerce | 2026-11-11 | 8.7 High |
| The Order Tip for WooCommerce WordPress plugin before 1.6.0 does not check the capability of the user requesting a file deletion, nor does it restrict which path may be deleted, allowing users with the Shop Manager role and above to delete arbitrary files on the server, which could lead to the site being taken over. | ||||
| CVE-2026-77695 | 1 Wordpress-extensions | 1 Woo Refund And Exchange Lite | 2026-11-11 | 6.5 Medium |
| The Return Refund and Exchange For WooCommerce WordPress plugin before 4.6.4 does not correctly verify the ownership of guest orders in some of the AJAX actions it exposes to unauthenticated users, allowing them to read private order messages, post messages and attachments in the customer's name, and cancel return requests on any guest order. | ||||
| CVE-2026-77757 | 1 Wordpress-extensions | 1 Directorist | 2026-11-11 | 5.4 Medium |
| The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.3 does not sanitize a user-supplied image reference before using it as the source of a file move, allowing users with a subscriber-level account to relocate arbitrary server-readable image files into a publicly accessible directory, and to delete them from their original location. | ||||
| CVE-2026-78146 | 1 Wordpress-extensions | 1 Noptin | 2026-11-11 | 6.5 Medium |
| The Simple Newsletter Plugin WordPress plugin before 4.3.3 does not verify that the requester is the subscriber named in a public request before rendering that subscriber's stored details, allowing unauthenticated users to disclose a subscriber's personal data along with the key that authorises changes to their record. | ||||
| CVE-2026-13414 | 1 Wordpress-extensions | 1 Cmp | 2026-11-11 | 4.8 Medium |
| The CMP WordPress plugin before 4.1.18 does not perform authorization checks on one of its AJAX actions and relies on a nonce that is skipped for certain (and exposed to anonymous visitors on others), allowing unauthenticated attackers to disable the site's maintenance/coming-soon mode under a non-default countdown configuration. | ||||
| CVE-2026-13415 | 1 Wordpress-extensions | 1 Cmp | 2026-11-11 | 7.2 High |
| The CMP WordPress plugin before 4.1.18 does not enforce an option-name allow-list when importing settings via one of its AJAX actions, allowing users with the Editor role (when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls) to update arbitrary WordPress options, including options that lead to privilege escalation to Administrator. | ||||
| CVE-2026-13416 | 1 Wordpress-extensions | 1 Cmp | 2026-11-11 | 3.5 Low |
| The CMP WordPress plugin before 4.1.18 does not sanitise and escape a settings value before outputting it on the coming-soon page, allowing users with the Editor role (when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls) to inject arbitrary web scripts that execute when a visitor views the page. | ||||
| CVE-2026-16567 | 1 Wordpress-extensions | 1 Document Embedder | 2026-11-11 | 5.3 Medium |
| The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token and streaming the file, allowing unauthenticated attackers to download arbitrary Document Embedder WordPress plugin before 2.3.1 documents, including private and draft ones, by enumerating IDs. | ||||
| CVE-2026-16568 | 1 Wordpress-extensions | 1 Shopapper | 2026-11-11 | 4.3 Medium |
| The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not verify that the requesting user owns the customer profile being queried through one of its REST endpoints, allowing any authenticated user (e.g. a customer/subscriber) to retrieve other users' personal data, including their email address, name, and roles. | ||||