Export limit exceeded: 208070 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 208070 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (208070 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-11563 | 1 Wordpress-extensions | 1 Word Count And Social Shares | 2026-11-10 | 9.6 Critical |
| The Word Count and Social Shares WordPress plugin through 1.0 does not validate a user-supplied file path before deletion, nor does it have proper authorization or CSRF checks, allowing any authenticated user, such as a Subscriber, to delete arbitrary files on the server, which can lead to a full site takeover (e.g. by deleting wp-config.php). | ||||
| CVE-2026-12511 | 1 Wordpress-extensions | 1 Ai Engine | 2026-11-10 | 8.1 High |
| The AI Engine WordPress plugin before 3.5.5 does not sanitize a user-supplied filename before using it to write a downloaded file, allowing authenticated users with editor-level access to write attacker-controlled bytes to an arbitrary location on the server via path traversal. | ||||
| CVE-2026-12583 | 1 Wordpress-extensions | 1 Newsletters | 2026-11-10 | 8.1 High |
| The Newsletters WordPress plugin before 4.15 does not prevent deserialization of untrusted input that is stored through a public form, allowing unauthenticated attackers to inject a PHP object and, via a property-oriented gadget chain bundled with the Newsletters WordPress plugin before 4.15, write arbitrary files and execute code on the server. | ||||
| CVE-2026-12988 | 1 Wordpress-extensions | 1 Wp 2fa | 2026-11-10 | 6.4 Medium |
| The WP 2FA WordPress plugin before 3.1.1.2 does not verify that the email address supplied during two-factor authentication setup belongs to the user, allowing an attacker who has obtained a user's credentials to redirect the setup verification code to an attacker-controlled email address and take over the account. | ||||
| CVE-2026-14987 | 2 Stellarwp, Wordpress-extensions | 2 Givewp, Givewp | 2026-11-10 | 6.4 Medium |
| The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'twitter_message' Sequoia Template Setting in all versions up to, and including, 4.16.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with give worker-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected script executes specifically when a donor clicks the Share on Twitter button on the Sequoia donation confirmation view, as that is when the unescaped twitter_message value is evaluated inside the JavaScript template literal. | ||||
| CVE-2026-11371 | 1 Wordpress-extensions | 1 Betterdocs | 2026-11-10 | 6.1 Medium |
| The BetterDocs WordPress plugin before 4.5.5 does not sanitise an AI-generated documentation summary before storing and outputting it, and the feature that generates it is exposed to unauthenticated users, allowing them to store a malicious payload via prompt injection that executes in the browser of any visitor who views the affected page, including administrators. | ||||
| CVE-2026-11866 | 1 Wordpress-extensions | 1 Latepoint | 2026-11-10 | 5.4 Medium |
| The Appointment Booking Plugin WordPress plugin before 5.6.3 does not validate a CSRF nonce on several state-changing actions handled by its central request dispatcher, allowing attackers to perform privileged actions, such as overwriting the booking-form configuration or disconnecting the connected payment gateway, via Cross-Site Request Forgery against a logged-in administrator. | ||||
| CVE-2026-12395 | 1 Wordpress-extensions | 1 Wp Job Portal | 2026-11-10 | 6.5 Medium |
| The WP Job Portal WordPress plugin before 2.5.5 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with a subscriber-level (self-registerable) account to perform SQL injection attacks. | ||||
| CVE-2026-12510 | 1 Wordpress-extensions | 1 Ai Engine | 2026-11-10 | 5.9 Medium |
| The AI Engine WordPress plugin before 3.5.5 does not verify that a user owns the chatbot conversation referenced by a client-supplied identifier, allowing users with subscriber-level access to read other users' private conversations and take over their conversation records when the discussions feature is enabled. | ||||
| CVE-2026-12525 | 1 Wordpress-extensions | 1 Redux Framework | 2026-11-10 | 8.8 High |
| The Redux Framework WordPress plugin before 4.5.13 does not restrict which user meta keys can be written when saving custom profile fields, allowing users with at least the Subscriber role to escalate their privileges to Administrator by submitting a crafted value while updating their own profile, on sites where the Redux Framework WordPress plugin before 4.5.13's user-profile (Users extension) feature is enabled. | ||||
| CVE-2026-12585 | 1 Wordpress-extensions | 1 Abandoned Cart Lite For Woocommerce | 2026-11-10 | 8.1 High |
| The Abandoned Cart Lite for WooCommerce WordPress plugin before 6.8.2 does not protect the integrity of its cart-recovery tokens or bind them to the requesting account, allowing unauthenticated attackers to forge a recovery link that logs them in as another user when the automatic-login option is enabled. | ||||
| CVE-2026-12684 | 1 Wordpress-extensions | 1 Customer Reviews For Woocommerce | 2026-11-10 | 6.5 Medium |
| The Customer Reviews for WooCommerce WordPress plugin before 5.113.0 does not perform authentication, capability, or nonce checks on one of its media upload AJAX actions when the review media attachment feature is enabled, allowing unauthenticated users to upload media files (bounded to an image and video allowlist) to the Media Library and create attachment posts, leading to media library pollution and disk space exhaustion. | ||||
| CVE-2026-12869 | 1 Wordpress-extensions | 1 Header Footer Builder For Elementor | 2026-11-10 | 6.1 Medium |
| The Header Footer Builder for Elementor WordPress plugin before 1.2.1 does not require an administrative capability for its dashboard template-import action (it allows any edit_posts user), so a Contributor can import a template containing an Elementor HTML widget configured to display site-wide, injecting JavaScript that executes in the session of any visitor or administrator who loads the site. | ||||
| CVE-2026-12906 | 1 Wordpress-extensions | 1 Rtmkit | 2026-11-10 | 2.7 Low |
| The RTMKit WordPress plugin before 2.0.9 does not perform a capability check in one of its AJAX actions and resolves a request-supplied post identifier directly, allowing users with at least the Contributor role to read the titles of other users' private, draft, pending, scheduled and trashed posts. | ||||
| CVE-2026-12907 | 1 Wordpress-extensions | 1 Rtmkit | 2026-11-10 | 2.7 Low |
| The RTMKit WordPress plugin before 2.0.9 does not perform a proper capability check on one of its -builder AJAX actions, allowing users with at least the Author role to create and activate a site-wide template that overrides the header, footer or other global areas displayed to all visitors, which is normally restricted to administrators. | ||||
| CVE-2026-10525 | 1 Wordpress-extensions | 1 Nex-forms | 2026-11-10 | 6.1 Medium |
| The NEX-Forms WordPress plugin before 9.2.3 does not sanitise and escape some submitted form data before storing it and outputting it back in the admin dashboard, leading to a Stored Cross-Site Scripting vulnerability which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks against high privilege users such as administrators when they view the submitted entries. | ||||
| CVE-2026-12393 | 1 Wordpress-extensions | 1 Wps Bookings For Woocommerce | 2026-11-10 | 5.4 Medium |
| The WPS Bookings for WooCommerce WordPress plugin before 3.11.7 does not verify that a booking order belongs to the requesting user before cancelling it, allowing any authenticated user, such as a Subscriber or Customer, to cancel and void other customers' booking orders. | ||||
| CVE-2026-13402 | 1 Wordpress-extensions | 1 Royal Elementor Addons | 2026-11-10 | 5.3 Medium |
| The Royal Addons for Elementor WordPress plugin before 1.7.1063 does not check the post status of menu items or the templates they reference in one of its REST endpoints, allowing unauthenticated users to retrieve the rendered HTML content of private or draft Elementor templates linked from non-public navigation menu items. | ||||
| CVE-2026-9810 | 1 Wordpress-extensions | 1 Ai Copilot | 2026-11-10 | 9.8 Critical |
| The AI Copilot WordPress plugin before 1.5.4 does not bind OAuth access tokens to a WordPress user, and accepts any valid token as an administrator session, allowing unauthenticated attackers who complete the public OAuth flow to execute privileged MCP tools as an administrator, including arbitrary user creation and role escalation. | ||||
| CVE-2026-10081 | 1 Wordpress-extensions | 1 Unlimited Elements For Elementor | 2026-11-10 | 8.8 High |
| The Unlimited Elements For Elementor WordPress plugin before 2.0.11 does not sanitize or escape Google review content fetched from the Serp API before rendering it in the Google Reviews widget output, allowing unauthenticated attackers who submit a malicious review on the targeted business's Google listing to deliver Stored XSS to any visitor (including administrators) of any WP page displaying that Place ID's reviews. | ||||