Export limit exceeded: 16307 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (16307 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-66646 | 2 Mythemeshop, Wordpress | 2 Wp Tab Widget, Wordpress | 2026-08-21 | 6.5 Medium |
| Contributor Cross Site Scripting (XSS) in WP Tab Widget <= 1.2.11 versions. | ||||
| CVE-2026-73181 | 2 Themecomplete, Wordpress | 2 Extra Product Options & Add-ons For Woocommerce, Wordpress | 2026-08-21 | 7.5 High |
| Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce < 7.6 versions. | ||||
| CVE-2026-73338 | 2 Autopay, Wordpress | 2 Autopay, Wordpress | 2026-08-21 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Autopay <= 5.0.0 versions. | ||||
| CVE-2026-73342 | 2 Magazine3, Wordpress | 2 Wp Multilang, Wordpress | 2026-08-21 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in WP Multilang <= 2.4.31 versions. | ||||
| CVE-2026-73359 | 2 Wordpress, Wp Legal Pages | 2 Wordpress, Wp Cookie Notice For Gdpr, Ccpa & Eprivacy Consent | 2026-08-21 | 6.5 Medium |
| Subscriber Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.3.9 versions. | ||||
| CVE-2026-73375 | 2 Supsystic, Wordpress | 2 Ultimate Maps By Supsystic, Wordpress | 2026-08-21 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic < 1.5.0 versions. | ||||
| CVE-2026-73376 | 2 Supsystic, Wordpress | 2 Ultimate Maps By Supsystic, Wordpress | 2026-08-21 | 9.8 Critical |
| Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic < 1.5.0 versions. | ||||
| CVE-2026-73377 | 2 Supsystic, Wordpress | 2 Ultimate Maps By Supsystic, Wordpress | 2026-08-21 | 7.5 High |
| Unauthenticated Broken Access Control in Ultimate Maps by Supsystic < 1.5.0 versions. | ||||
| CVE-2026-73397 | 2 Wordpress, Youzify | 2 Wordpress, Youzify | 2026-08-21 | 9.8 Critical |
| Unauthenticated Deserialization of untrusted data in Youzify <= 1.3.7 versions. | ||||
| CVE-2026-73399 | 2 Flutterwave, Wordpress | 2 Flutterwave Woocommerce, Wordpress | 2026-08-21 | 6.5 Medium |
| Unauthenticated Broken Authentication in Flutterwave WooCommerce <= 3.3.0 versions. | ||||
| CVE-2026-73994 | 2 Syed Balkhi, Wordpress | 2 Charitable, Wordpress | 2026-08-21 | 7.5 High |
| Unauthenticated Broken Access Control in Charitable <= 1.8.11.3 versions. | ||||
| CVE-2026-73997 | 2 Nexcess, Wordpress | 2 Starter Templates By Kadence Wp, Wordpress | 2026-08-21 | 7.5 High |
| Unauthenticated Denial of Service Attack in Starter Templates by Kadence WP <= 2.3.3 versions. | ||||
| CVE-2026-74015 | 2 Merkulove, Wordpress | 2 Readabler, Wordpress | 2026-08-21 | 9.3 Critical |
| Unauthenticated SQL Injection in Readabler < 2.0.18 versions. | ||||
| CVE-2026-15446 | 2 Nosilver4u, Wordpress | 2 Ewww Image Optimizer, Wordpress | 2026-08-21 | 6.4 Medium |
| The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is achieved by embedding a crafted img element with class='lazyload' and a data-script attribute pointing to an attacker-controlled URL in post content, which the plugin's bundled lazysizes ls.unveilhooks addon then uses to dynamically create and insert a script element into the DOM at page view time. | ||||
| CVE-2026-73394 | 2 Stitchexpress, Wordpress | 2 Stitch Express, Wordpress | 2026-08-21 | 7.5 High |
| Unauthenticated Broken Access Control in Stitch Express <= 1.9.0 versions. | ||||
| CVE-2026-32552 | 2 Wordpress, Yith | 2 Wordpress, Yith Woocommerce Membership Premium | 2026-08-21 | 8.5 High |
| Subscriber SQL Injection in YITH WooCommerce Membership Premium <= 2.33.0 versions. | ||||
| CVE-2026-73182 | 2 Jeff Starr, Wordpress | 2 Bbq Pro, Wordpress | 2026-08-21 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in BBQ Pro <= 3.9 versions. | ||||
| CVE-2026-73183 | 2 Get Maps Marker Pro, Wordpress | 2 Maps Marker Pro, Wordpress | 2026-08-21 | 9.3 Critical |
| Unauthenticated SQL Injection in Maps Marker Pro <= 4.32 versions. | ||||
| CVE-2026-73354 | 2 Reichertbrothers, Wordpress | 2 Simplyrets Real Estate Idx, Wordpress | 2026-08-21 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in SimplyRETS Real Estate IDX <= 3.2.8 versions. | ||||
| CVE-2026-73364 | 2 Wordpress, Wpdesk | 2 Wordpress, Flexible Subscriptions | 2026-08-21 | 9.8 Critical |
| Customer PHP Object Injection in Flexible Subscriptions <= 1.8.1 versions. | ||||