Export limit exceeded: 424296 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 424296 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 424296 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 424296 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 424296 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 424296 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (424296 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-12501 | 1 Wordpress-extensions | 1 Wp Travel Engine | 2026-11-11 | 5.3 Medium |
| The WP Travel Engine WordPress plugin before 6.8.2 does not verify that an incoming PayPal payment notification was sent to the site's configured merchant account, nor that the paid amount matches the order total, before marking a booking as paid, allowing unauthenticated attackers to mark bookings as fully paid using a token payment made to an attacker-controlled account. | ||||
| CVE-2026-12901 | 1 Wordpress-extensions | 1 Getpaid | 2026-11-11 | 5.9 Medium |
| The GetPaid WordPress plugin before 2.8.55 does not verify the authenticity of incoming Worldpay payment notifications, allowing unauthenticated attackers to forge a notification that marks a pending invoice as paid without any payment being made. | ||||
| CVE-2026-14831 | 1 Wordpress-extensions | 1 Easy Booking | 2026-11-11 | 5.3 Medium |
| The Easy Booking WordPress plugin before 3.5.0 does not re-enforce a bookable product's configured minimum booking duration on the server side when adding to cart and calculating the booking price, allowing unauthenticated users to place below-minimum bookings and complete underpriced orders. | ||||
| CVE-2026-10524 | 1 Wordpress-extensions | 1 Cocart | 2026-11-11 | 7.5 High |
| The CoCart WordPress plugin before 4.9.0 does not validate a user-supplied price value against the actual product price when items are added to the cart through one of its public REST API endpoints, allowing unauthenticated users to set arbitrary product prices and complete WooCommerce orders at manipulated totals. | ||||
| CVE-2026-15147 | 1 Wordpress-extensions | 1 Five Star Restaurant Reservations | 2026-11-11 | 5.3 Medium |
| The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not verify the authenticity of incoming payment notifications, failing to validate the payment recipient, amount, and status or to bind the notification to the intended booking, allowing unauthenticated attackers to mark arbitrary pending reservations as paid and confirmed. | ||||
| CVE-2026-13342 | 1 Wordpress-extensions | 1 Security Optimizer | 2026-11-11 | 5.3 Medium |
| The Security Optimizer WordPress plugin from 1.5.8 to 1.6.4 does not correctly validate requests to its optional IP-based login restriction feature, allowing the restriction to be bypassed so that unauthenticated requests from non-allowlisted IP addresses can reach and use the login form, defeating the access control the administrator configured. | ||||
| CVE-2026-17032 | 1 Wordpress-extensions | 3 Google-maps-easy-pro, Supsystic-gallery-pro, Tables-generator-pro | 2026-11-11 | 9.8 Critical |
| Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deploy a second-stage payload that exfiltrates credentials and other sensitive data and grants full control of affected sites. | ||||
| CVE-2026-14943 | 1 Wordpress-extensions | 1 Password Protected | 2026-11-11 | 7.5 High |
| The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin before 2.8.4 does not restrict REST API access to authenticated users when a specific option is enabled, allowing unauthenticated visitors to bypass the sitewide password gate and read otherwise-protected content and account identifiers via the REST API. This re-introduces a previously-fixed issue (CVE-2024-0437), which was patched in 2.6.7 and regressed in 2.6.8. | ||||
| CVE-2026-15032 | 1 Wordpress-extensions | 1 Wpdiscuz | 2026-11-11 | 6.1 Medium |
| The Comments WordPress plugin before 7.6.60 does not properly escape a user-supplied URL before outputting it inside an HTML attribute, allowing unauthenticated users to store a Cross-Site Scripting payload that executes in the browser of any user, including administrators, who views the affected content. | ||||
| CVE-2026-15245 | 1 Wordpress-extensions | 1 Bne Testimonials | 2026-11-11 | 5.4 Medium |
| The BNE Testimonials WordPress plugin before 2.0.8.2 does not properly escape a shortcode attribute for a JavaScript context before echoing it into an inline script, allowing users with the contributor role and above to inject arbitrary JavaScript that executes in the browser of anyone viewing the affected content. | ||||
| CVE-2026-15386 | 1 Wordpress-extensions | 1 Meow Gallery | 2026-11-11 | 5.4 Medium |
| The Meow Gallery WordPress plugin before 5.5.2 does not escape an attachment's alt text before outputting it into an attribute of the link it builds for linked galleries, allowing users with the Author role or above to store a JavaScript payload that executes in the browser of any visitor (including administrators) who views a post containing such a gallery. | ||||
| CVE-2026-16258 | 1 Wordpress-extensions | 1 Ajax Search Lite | 2026-11-11 | 9.8 Critical |
| The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to perform PHP Object Injection. When a suitable POP chain is present via another installed Ajax Search Lite WordPress plugin before 4.14.5 or , this can be leveraged to achieve Remote Code Execution. | ||||
| CVE-2026-16262 | 1 Wordpress-extensions | 1 Estatik | 2026-11-11 | 7.5 High |
| The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating user session, allowing an unauthenticated attacker to log a victim into an attacker-controlled account (login CSRF), so that the victim's subsequent activity is stored under and readable by the attacker. | ||||
| CVE-2026-16267 | 1 Wordpress-extensions | 1 Newsletters | 2026-11-11 | 8.1 High |
| The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialising a value taken from a public form submission, allowing unauthenticated attackers to inject arbitrary PHP objects. | ||||
| CVE-2026-16269 | 1 Wordpress-extensions | 1 Newsletters | 2026-11-11 | 4.8 Medium |
| The Newsletters WordPress plugin before 4.16 does not strictly compare its API authentication key, allowing unauthenticated attackers to bypass the API authentication via type juggling and perform privileged actions such as modifying subscriber records and sending emails, when the optional API has been enabled. | ||||
| CVE-2026-16282 | 1 Wordpress-extensions | 1 Appointment Hour Booking | 2026-11-11 | 5.3 Medium |
| The Appointment Hour Booking WordPress plugin before 1.5.88 does not validate a client-supplied booking price against the server-side configured service price, allowing unauthenticated users to submit an arbitrary final price (including zero or negative) that is stored as the authoritative booking price, corrupting booking and payment records. | ||||
| CVE-2026-16578 | 1 Wordpress-extensions | 1 Admin Safety Guard | 2026-11-11 | 7.5 High |
| The Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection WordPress plugin before 1.4.0 does not perform any capability check on one of its REST API endpoints, allowing unauthenticated attackers to retrieve the full list of registered users including their usernames, email addresses, roles, and two-factor authentication enrollment status. | ||||
| CVE-2026-16957 | 1 Wordpress-extensions | 1 Slim Seo | 2026-11-11 | 2.7 Low |
| The Slim SEO WordPress plugin before 4.9.11 does not restrict a post-meta preview feature to posts the user is allowed to edit, verifying only read access, allowing users with the Contributor role to read arbitrary post meta, including protected and private keys, of published posts they do not own, including password-protected posts and posts of non-public post types. | ||||
| CVE-2026-16965 | 1 Wordpress-extensions | 1 Solace Extra | 2026-11-11 | 4.3 Medium |
| The Solace Extra WordPress plugin before 1.6.1 does not perform capability or nonce checks in one of its AJAX actions, allowing any authenticated user such as a subscriber (and, via CSRF, any logged-in user) to update post meta on arbitrary posts and to deactivate the site's active templates. | ||||
| CVE-2026-16988 | 1 Wordpress-extensions | 1 Geodirectory | 2026-11-11 | 7.5 High |
| The GeoDirectory WordPress plugin before 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing, allowing unauthenticated users to disclose the title and exact geographic coordinates of non-public (pending or draft) listings. | ||||