Export limit exceeded: 110930 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (110930 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-13142 | 1 Wordpress-extensions | 1 Passwordless Login By Ventraconnect | 2026-11-10 | 8.1 High |
| The Social Login, Passkeys, Magic Link & Email OTP WordPress plugin before 1.4.1 does not enforce rate limiting or a working attempt lockout on its passwordless email one-time-password verification, and stores the short numeric codes in plaintext, allowing an unauthenticated attacker who knows a registered email address to brute-force the code and log in as that user, including an administrator, leading to full site takeover. | ||||
| CVE-2026-9833 | 1 Wordpress-extensions | 1 Tag Groups | 2026-11-10 | 7.1 High |
| The Tag Groups is the Advanced Way to Display Your Taxonomy Terms WordPress plugin before 2.2.0 does not properly escape one of its AJAX parameters before reflecting it in the response body served with an HTML content type, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of a logged-in user with `edit_pages` capability (Editor or higher) who is tricked into following a crafted link. | ||||
| CVE-2026-11767 | 1 Wordpress-extensions | 1 Crt Addons For Elementor | 2026-11-10 | 8.8 High |
| The Free Builder for Elementor WordPress plugin before 1.6.7 does not sanitise submitted contact form field values before storing them and outputting them in the admin dashboard, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute when a logged-in administrator views the form submissions. | ||||
| CVE-2026-8082 | 1 Wordpress-extensions | 1 Bpost Shipping Platform | 2026-11-10 | 7.5 High |
| The bpost-shipping-platform WordPress plugin before 3.2.3 does not properly sanitize a parameter before using it in a SQL query during WooCommerce order submission, allowing unauthenticated attackers to perform time-based blind SQL injection on stores running this bpost-shipping-platform WordPress plugin before 3.2.3. | ||||
| CVE-2026-12968 | 1 Wordpress-extensions | 1 Wowaddons | 2026-11-10 | 8.8 High |
| The Product Addons and Product Options With Custom Fields WordPress plugin before 1.6.15 does not restrict an unauthenticated file-upload endpoint and accepts SVG files that are stored and served inline, allowing an unauthenticated attacker to upload a malicious SVG whose embedded script executes in the session of any user (such as an administrator) who later opens the file. | ||||
| CVE-2026-12421 | 1 Wordpress-extensions | 1 Arforms | 2026-11-10 | 7.2 High |
| The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'password' Field Values in all versions up to, and including, 7.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-11974 | 1 Wordpress-extensions | 1 Media Folder Addon | 2026-11-10 | 8.6 High |
| The wp-media-folder-addon WordPress plugin before 4.1.7 does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions available to unauthenticated users, leading to Arbitrary File Disclosure and Server-Side Request Forgery on sites where a cloud storage connection has been configured. This is an incomplete fix of CVE-2026-9690, whose patch hardened only one of the affected cloud-storage handlers and left the others unpatched. | ||||
| CVE-2026-14333 | 1 Wordpress-extensions | 1 Demi | 2026-11-10 | 7.5 High |
| The Demi WordPress plugin before 0.0.7 stores its full-site backup archives in a publicly accessible location under a predictable filename and without access protection, allowing unauthenticated attackers to download complete backups including the site database and its user password hashes. | ||||
| CVE-2026-14830 | 1 Wordpress-extensions | 1 Flxwoo | 2026-11-10 | 7.5 High |
| The FlxWoo WordPress plugin before 3.1.1 does not verify with the payment processor that a checkout session was actually paid before marking the associated order as paid, allowing unauthenticated attackers to complete WooCommerce orders without paying. | ||||
| CVE-2026-14930 | 1 Wordpress-extensions | 1 Js Help Desk | 2026-11-10 | 7.5 High |
| The JS Help Desk WordPress plugin before 3.1.4 does not perform any authorization, nonce, or ownership check on a front-end request dispatcher, allowing unauthenticated users to upload files (limited to the JS Help Desk WordPress plugin before 3.1.4's inert allowed extensions) and attach them to arbitrary users' support tickets. | ||||
| CVE-2026-15048 | 1 Wordpress-extensions | 1 Geekybot | 2026-11-10 | 7.5 High |
| The Geeky Bot WordPress plugin before 1.2.8 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to retrieve chat-history session metadata including WordPress usernames, user IDs, and timestamps. | ||||
| CVE-2026-15258 | 1 Wordpress-extensions | 1 Product Feed Manager For Woocommerce | 2026-11-10 | 8.1 High |
| The Product Feed Manager For WooCommerce WordPress plugin before 7.6.1 does not properly sanitise and escape product-feed custom filter rules before using them in a SQL query, allowing users with the Contributor role and above to perform SQL injection attacks. | ||||
| CVE-2026-12720 | 1 Wordpress-extensions | 1 Kirki | 2026-11-10 | 7.5 High |
| The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when it deserialises data that unauthenticated users can store, leading to PHP Object Injection that is triggered when an administrator later reviews the stored data. With a suitable gadget chain present on the site (via another installed Kirki WordPress plugin before 6.0.13, , or an outdated WordPress version), this could be leveraged to perform a variety of attacks, such as remote code execution. | ||||
| CVE-2026-12721 | 1 Wordpress-extensions | 1 Kirki | 2026-11-10 | 8.6 High |
| The Kirki WordPress plugin before 6.0.13 does not properly sanitise and escape a value taken from the request before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks. | ||||
| CVE-2026-13392 | 1 Wordpress-extensions | 1 Elementskit Lite | 2026-11-10 | 7.2 High |
| The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not prevent a custom-widget definition saved by a user with administrative capabilities from being written verbatim into a generated PHP file that the ElementsKit Elementor Addons WordPress plugin before 3.10.01 subsequently executes, allowing arbitrary PHP code to run on the server; on a multisite network this lets a non-super subsite Administrator, who is otherwise denied code/file editing, reach host-level code execution beyond the privileges the network grants them. | ||||
| CVE-2026-12695 | 1 Wordpress-extensions | 1 Miniorange 2fa | 2026-11-10 | 8.1 High |
| The miniOrange 2FA WordPress plugin before 6.2.6 does not validate the submitted one-time password against the targeted user's stored secret, instead verifying it against an attacker-supplied value, allowing an unauthenticated attacker who knows a victim's password to bypass two-factor authentication and gain access to the victim's account, including administrators. | ||||
| CVE-2026-13609 | 1 Wordpress-extensions | 1 Frontend Admin By Dynamiapps | 2026-11-10 | 8.8 High |
| The Frontend Admin by DynamiApps WordPress plugin before 3.29.9 decodes HTML entities in a submitted form field value after sanitizing it, which restores HTML tags that the sanitizer had neutralized. A double-encoded payload submitted by an unauthenticated visitor is therefore stored as a live tag and later output without escaping on the Frontend Admin by DynamiApps WordPress plugin before 3.29.9's front-end display surfaces, resulting in stored cross-site scripting that executes in the browser of any user, including an administrator, who views a page displaying the submitted value. | ||||
| CVE-2026-14309 | 1 Wordpress-extensions | 1 Chat On Desk | 2026-11-10 | 8.1 High |
| The Chat On Desk Order Notifications WordPress plugin before 1.0.9 does not verify that the one-time password has been validated before processing a password-reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, and take over their accounts when SMS one-time-password password reset is enabled. | ||||
| CVE-2026-103303 | 1 Wordpress-extensions | 1 Turisbook Booking System | 2026-11-10 | 8.8 High |
| The Turisbook Booking System WordPress plugin through 1.3.8 does not have authorisation and CSRF checks when saving its settings, and does not sanitise and escape one of them before outputting it in an admin page, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators. | ||||
| CVE-2026-106015 | 1 Wordpress-extensions | 1 Ecommerce Affiliate | 2026-11-10 | 8.1 High |
| The Ecommerce Affiliate WordPress plugin through 1.0.0 does not restrict one-time password issuance and verification to the legitimate account owner, nor limit verification attempts, allowing unauthenticated attackers to take over any account, including administrators. | ||||