Export limit exceeded: 228210 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (228210 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-120683 | 2 Shapedplugin, Wordpress-extensions | 2 Real Testimonials, Real Testimonials | 2026-11-12 | 5.4 Medium |
| The Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tpro_client_testimonial' parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires an administrator to approve the pending testimonial through standard moderation and the target page to load the WordPress Interactivity runtime (e.g. a theme or block that enqueues @wordpress/interactivity). | ||||
| CVE-2026-119075 | 2 Themegrill, Wordpress-extensions | 2 Registration Form For Woocommerce, Registration Form For Woocommerce | 2026-11-12 | 9.8 Critical |
| The Registration Form for WooCommerce plugin for WordPress is vulnerable to privilege escalation due to a missing allow-list check in the FormHandler::validate_checkout_fields() function in versions up to, and including, 1.1.4 The My Account registration path (validate_fields()) validates a submitted 'tgwcfb/user-roles' value against the form's configured allowed roles, but the checkout registration path (validate_checkout_fields(), hooked to woocommerce_after_checkout_validation) stores the raw $_POST['user_roles'] value in $this->valid_data without any allow-list enforcement, and add_user_data() then injects that value into woocommerce_new_customer_data as the new account's role. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator by supplying a user_roles=administrator parameter when creating an account during checkout, resulting in full site takeover. | ||||
| CVE-2026-120685 | 2 Shapedplugin, Wordpress-extensions | 2 Real Testimonials, Real Testimonials | 2026-11-12 | 5.4 Medium |
| The Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tpro_client_image (JPEG IPTC caption) + tpro_client_testimonial ([gallery] shortcode)' parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have the display block configured with the Strip All HTML Tags option disabled, which is the plugin's native setting for rendering formatted testimonial content, and to have approved the submitted testimonials. | ||||
| CVE-2026-105702 | 1 Ibm | 2 Agentics, Db2 Genius Hub | 2026-11-12 | 4.3 Medium |
| IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to obtain sensitive information due to exposure of error messages containing internal implementation details. | ||||
| CVE-2026-121976 | 2 Wordpress-extensions, Wpchill | 2 Modula Image Gallery, Modula Image Gallery | 2026-11-12 | 6.4 Medium |
| The Modula plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'items' parameter in versions up to, and including, 3.0.17 This is due to insufficient input sanitization of the per-image 'link' field in the save_merged_items() REST handler and Images\Adapter::normalize_item_row(), which preserves unknown keys verbatim, combined with output escaping in Modula_Helper::generate_attributes() that applies only esc_attr() to the resulting anchor href and does not strip the 'javascript:' URL scheme. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page and clicks the gallery tile. | ||||
| CVE-2026-123418 | 2 Andymoyle, Wordpress-extensions | 2 Church Admin, Church Admin | 2026-11-12 | 7.2 High |
| The Church Admin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lat' parameter in all versions up to, and including, 5.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when a Google Maps API key has been configured in Church Admin settings, as the vulnerable sink is only reached when that option is present. | ||||
| CVE-2026-118050 | 2 Antoineh, Wordpress-extensions | 2 Football Pool, Football Pool | 2026-11-12 | 6.4 Medium |
| The Football Pool plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shouttext' parameter in all versions up to, and including, 2.13.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected script only fires in the admin Edit view for a shout; the public Shoutbox widget and the admin list view both encode output via Football_Pool_Utils::xssafe(), making the admin Edit view the sole unescaped sink. | ||||
| CVE-2026-104014 | 2 Naimurrahmannahid, Wordpress-extensions | 2 Naimur Email Otp Verification For Woocommerce, Naimur Email Otp Verification For Woocommerce | 2026-11-12 | 9.8 Critical |
| The Naimur Email OTP Verification for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.1.0. This is due to the plugin's password-reset finalization endpoint (the wp_ajax_nopriv_ceovw_update_new_password action handled by CEOVW_AJAX::update_new_password()) authorizing the reset solely by the presence of a database row marking an email as 'VERIFIED', with no timestamp check, no session binding, and no per-reset token — combined with mark_otp_as_verified_for_reset() leaving the row in that state after a user enters their code (abandoning the flow leaves the row behind), and a scheduled 'ceovw_cleanup_expired_otps_event' cron that has no add_action() handler anywhere in the plugin so cleanup never runs. This makes it possible for unauthenticated attackers to take over any account whose owner previously requested and verified a password-reset code and did not immediately finish choosing a new password — the attacker needs only the victim's email address and a nonce that the plugin itself localizes publicly into the CEOVW_APP global on the WooCommerce account page for logged-out visitors, after which they call the endpoint, overwrite the victim's password, and are returned a live wordpress_logged_in_ session cookie for that user (full site takeover if the account is an administrator). | ||||
| CVE-2026-120509 | 2 Shapedplugin, Wordpress-extensions | 2 Real Testimonials, Real Testimonials | 2026-11-12 | 4.7 Medium |
| The Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tpro_client_name' parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires an administrator to publish the submitted testimonial, trigger the Show Preview AJAX handler, and save an Update, which canonicalizes and persists the attacker-controlled payload as the Manage View title — matching the plugin's standard moderation workflow. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own. | ||||
| CVE-2026-109973 | 2 Oxilab, Wordpress-extensions | 2 Flipbox, Flipbox | 2026-11-12 | 6.4 Medium |
| The Image Hover Effects Ultimate Visual Composer (Flipbox - Awesomes Flip Boxes Image Overlay) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'flip-box-image-upload-url-01-alt' parameter in versions up to, and including, 3.1.1. This is due to the plugin saving the image-alt field through sanitize_text_field() in Inc/Style22::register_child() (and Inc/Style18, 19, 20, 25, 29) — which preserves the double-quote character — and then concatenating the stored value into a double-quoted HTML attribute in Public_Render/Style22::default_render() (and the corresponding Style18/19/20/25/29 renderers) with no esc_attr() escaping. This makes it possible for authenticated attackers, with contributor-level access and above (when an administrator has delegated the plugin's 'Who can edit' capability via the plugin Settings page, or on multisite installations where even administrators lack unfiltered_html), to inject arbitrary web scripts in pages that will execute whenever a user accesses any page containing an affected [oxilab_flip_box] shortcode or block. | ||||
| CVE-2026-123462 | 2 Mycred, Wordpress-extensions | 2 Mycred, Mycred | 2026-11-12 | 5.3 Medium |
| Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2. | ||||
| CVE-2026-122660 | 2 Bakkbone Australia, Wordpress-extensions | 2 Floristpress, Floristpress | 2026-11-12 | 4.3 Medium |
| Missing Authorization vulnerability in BAKKBONE Australia FloristPress bakkbone-florist-companion allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FloristPress: from n/a through 7.8.5. | ||||
| CVE-2026-121777 | 2 Cool Plugins, Wordpress-extensions | 2 Cool Formkit Lite, Cool Formkit Lite | 2026-11-12 | 5.3 Medium |
| Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Cool Plugins Cool Formkit Lite extensions-for-elementor-form allows Code Injection.This issue affects Cool Formkit Lite: from n/a through 2.7.10. | ||||
| CVE-2026-120531 | 2 Wedevs, Wordpress-extensions | 2 Subscribe2, Subscribe2 | 2026-11-12 | 7.2 High |
| The Subscribe2 – Form, Email Subscribers & Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data[ip]’ parameter in all versions up to, and including, 10.47 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-121576 | 2 Atlasaidev, Wordpress-extensions | 2 Mcp Server For Wordpress, Mcp Server For Wordpress | 2026-11-12 | 8.8 High |
| Incorrect Privilege Assignment vulnerability in AtlasAiDev MCP Server for WordPress ai-workflow-automation-ai-agent-hub allows Privilege Escalation.This issue affects MCP Server for WordPress: from n/a through 2.0.1. | ||||
| CVE-2026-19706 | 1 Redhat | 6 Assisted Installer, Assisted Installer For Red Hat Openshift Container Platform, Multicluster Engine and 3 more | 2026-11-12 | 8.3 High |
| During ABI bootstrap, the bootstrap node's approve-csr.service approves and signs every CSR without identity validation. An attacker on the install network can retrieve the unauthenticated Ignition file (ports 22623/22624), extract a limited kubeconfig, submit a CSR for CN=system:admin, receive the signed certificate, and gain full cluster-admin access. Exploitable only during the narrow bootstrap window. | ||||
| CVE-2026-121573 | 2 Melapress, Wordpress-extensions | 2 Wp Activity Log, Wp Activity Log | 2026-11-12 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log wp-security-audit-log allows Stored XSS.This issue affects WP Activity Log: from n/a through 5.6.7. | ||||
| CVE-2026-124077 | 1 Apache | 1 Commons Codec | 2026-11-12 | N/A |
| The GitIdentifiers class in Apache Commons Codec did not reject NUL bytes in tree entry names. Because Git uses a NUL byte to mark the end of each entry name in a tree object, a crafted name could make one tree serialize to the same bytes as a different tree. Two different directory trees could then receive the same Git tree identifier or SWHID. The impact is limited: common file systems do not allow NUL bytes in file names, so trees built by walking a file system are not affected. Only applications that build trees from names supplied by other sources, such as entries of archive formats that permit NUL bytes in names (e.g. ZIP) or names passed directly to the API, are exposed. This issue affects Apache Commons Codec: from 1.22.0 before 1.23.0. Users are recommended to upgrade to version 1.23.0, which fixes the issue. | ||||
| CVE-2026-123806 | 1 Theupdateframework | 1 Python-tuf | 2026-11-12 | 4 Medium |
| python-tuf is a Python reference implementation of The Update Framework (TUF). Prior to 7.0.0, DelegatedRole._is_target_in_pathpattern in tuf/api/_payload.py uses fnmatch.fnmatch, which applies os.path.normcase before matching and makes delegation path authorization case-insensitive on Windows. When a TUF repository has path-based delegations that differ only by case and an attacker-controlled role is visited before the legitimate role, ngclient can accept an attacker-provided target from the wrong delegation for a requested path. Linux and macOS clients are not affected because their path normalization does not change case. This issue is fixed in 7.0.0. | ||||
| CVE-2026-125367 | 1 Picosh | 1 Pico | 2026-11-12 | 5.4 Medium |
| Pico through 4.1.2 contains a server-side request forgery vulnerability in the feeds service that allows signed-up users to make the server fetch arbitrary URLs via the run SSH command. Attackers can upload a feeds digest post listing internal URLs and trigger immediate fetching through Fetcher.ParseURL to reach loopback, RFC1918, and cloud metadata endpoints. | ||||