Export limit exceeded: 424998 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 424998 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (424998 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-118080 | 2 Social Snap, Wordpress-extensions | 2 Social Snap, Social Snap | 2026-11-12 | 8.8 High |
| Contributor PHP Object Injection in Social Snap <= 1.5.4 versions. | ||||
| CVE-2026-118083 | 2 Themeum, Wordpress-extensions | 2 Wp Crowdfunding, Wp Crowdfunding | 2026-11-12 | 7.5 High |
| Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions. | ||||
| CVE-2026-104368 | 2 Webtoffee, Wordpress-extensions | 2 Export And Import Users And Customers, Export And Import Users And Customers | 2026-11-12 | 8.8 High |
| The Export and Import Users and Customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.7.5 via the plugin's own export and re-import workflow. The vulnerability exists because of a CSV escape-character mismatch between the exporter and the importer: class-csvwriter.php writes cells with fputcsv() using PHP's default backslash (\) escape character, while class-csvreader.php parses the same file with fgetcsv() using a double-quote (") as the escape character. As a result, a crafted value stored in a Subscriber's Biographical Info field — containing a backslash-quote sequence followed by a newline — is written as a single quoted CSV field but parsed back as two separate rows on import. The injected second row is then processed by hf_create_customer() as a new user record whose user_login, user_pass, user_email, and role are entirely attacker-controlled, allowing the creation of an arbitrary Administrator account. This makes it possible for authenticated attackers with Subscriber-level access and above to escalate their privileges to Administrator. | ||||
| CVE-2026-118194 | 2 Cyberlord92, Wordpress-extensions | 2 Page And Post Restriction, Page And Post Restriction | 2026-11-12 | 6.5 Medium |
| The Page and Post Restriction plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.1 This is due to the `papr_restrict_page_post_rest_api()` function, hooked on `rest_pre_dispatch`, re-authenticating the current user from the `wordpress_logged_in` cookie via `wp_set_current_user()` for any GET or HEAD REST request where the current user is 0, without verifying a REST nonce — silently undoing the nonce-zeroing that WordPress core's `rest_cookie_check_errors()` performs on cookie-authenticated requests that lack an `X-WP-Nonce` header or `_wpnonce` parameter. Combined with WordPress's permissive REST CORS behavior — which echoes the request `Origin` and sets `Access-Control-Allow-Credentials: true` — this allows an unauthenticated attacker to read REST API GET responses as a logged-in victim, exposing role-restricted and private post/page content, victim user profile data via `/wp-json/wp/v2/users/me`, and comments the victim is authorized to see. This requires the attacker to lure a logged-in user into visiting an attacker-controlled page that issues credentialed cross-origin `fetch` requests against the target site's REST API; no nonce or further victim interaction beyond the page visit is needed. | ||||
| CVE-2026-118698 | 2 Beardev, Wordpress-extensions | 3 Joomsport, Joomsport – For Sports: Team & League, Football, Hockey & More, Joomsport | 2026-11-12 | 6.5 Medium |
| The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL Injection via the 'pgroup' parameter in all versions up to, and including, 5.7.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. A Contributor-level user can trigger the vulnerable code path by authoring a post containing the [jsMatchPlayerList] shortcode with a malicious pgroup value and previewing it, as WordPress allows shortcode execution during post preview for the post's author. | ||||
| CVE-2026-118634 | 2 Liedekef, Wordpress-extensions | 2 Events Made Easy, Events Made Easy | 2026-11-12 | 6.4 Medium |
| The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all versions up to, and including, 3.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-119059 | 2 Keywordrush, Wordpress-extensions | 2 Content Egg, Content Egg | 2026-11-12 | 4.3 Medium |
| The Content Egg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing per-post capability check on the ajaxUpdateProducts() function in versions up to, and including, 12.0.0. The handler verifies a static nonce ('contentegg_metabox') and the generic 'edit_posts' capability, but trusts the attacker-supplied $_POST['post_id'] verbatim and never calls current_user_can('edit_post', $post_id) — the per-object check that its sibling save_post handler saveMeta() correctly performs. This makes it possible for authenticated attackers, with contributor-level access and above, to modify Content Egg product data (_cegg_data_*) and update-timestamp post meta on arbitrary posts, including those owned by administrators. | ||||
| CVE-2026-119087 | 2 Keywordrush, Wordpress-extensions | 2 Content Egg, Content Egg | 2026-11-12 | 4.3 Medium |
| The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 12.0.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and above, to create posts attributed to another user's account — typically an administrator — by supplying an admin-owned preset_id, causing wp_insert_post to record the administrator as post_author. This includes the ability to create published posts when the attacker already holds publish_posts capability for the preset's post type, resulting in administrator-attributed published content created by a lower-privileged user. | ||||
| CVE-2026-114443 | 1 Wordpress-extensions | 1 Security By Cleantalk | 2026-11-12 | 7.5 High |
| The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not verify the account password before accepting an authenticator-app two-factor code at login, allowing anyone who holds a user's current authenticator code to log in as that user, including an administrator, without the password. | ||||
| CVE-2026-114444 | 1 Wordpress-extensions | 1 Security By Cleantalk | 2026-11-12 | 4.4 Medium |
| The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its File System Watcher file viewer to Super Admins or to the files it legitimately tracks, allowing a non-super-admin administrator, including a subsite administrator on WordPress multisite, to read the contents of sensitive tracked files such as the main configuration file and disclose the site's authentication keys, salts and, on a standard install, database credentials. | ||||
| CVE-2026-115277 | 1 Wordpress-extensions | 1 User Frontend | 2026-11-12 | 4.7 Medium |
| The User Frontend WordPress plugin before 4.3.14 does not sanitise and escape some user-supplied values before reflecting them into HTML attributes in a publicly reachable AJAX response, leading to Reflected Cross-Site Scripting. The affected action is gated by an anonymous nonce that only validates for logged-out requests, so the payload executes against logged-out visitors rather than authenticated users. | ||||
| CVE-2026-118071 | 1 Wordpress-extensions | 1 Joinchat | 2026-11-12 | 6.8 Medium |
| The Joinchat WordPress plugin before 6.4.2 does not escape the message of its button block before outputting it in an HTML attribute on the front end, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor of the post, including administrators. | ||||
| CVE-2026-118100 | 1 Wordpress-extensions | 1 Buddyforms | 2026-11-12 | 5.3 Medium |
| The BuddyForms WordPress plugin before 2.10.3 does not check that the requester is allowed to manage a form before exporting its configuration, allowing unauthenticated users to download any form's stored settings, including notification recipient email addresses and reCAPTCHA secret keys that are not shown on the public form. | ||||
| CVE-2026-118101 | 1 Wordpress-extensions | 1 Buddyforms | 2026-11-12 | 5.3 Medium |
| The BuddyForms WordPress plugin before 2.10.1 does not verify that a user editing an existing entry is the author of the target post, allowing users who have been granted edit access to a form, as low as Subscriber, to overwrite the title, content and status of any other user's posts or pages, including those of administrators. | ||||
| CVE-2026-118165 | 1 Wordpress-extensions | 1 Firelight Lightbox | 2026-11-12 | 6.8 Medium |
| The Firelight Lightbox WordPress plugin before 2.3.23 does not escape the URL of links it opens in its Classic lightbox before inserting it into the page as HTML, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against users who click a crafted link. | ||||
| CVE-2026-89435 | 2 Strategy11, Wordpress-extensions | 2 Formidable Forms, Formidable Forms | 2026-11-12 | 8.8 High |
| The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Arbitrary Plugin Installation in all versions up to, and including, 6.35 via the 'file_url' parameter parameter. This is due to insufficient URL prefix validation in validate_url_is_in_s3_bucket() and a permission callback that relies solely on a shared token obtainable by any user with the delegable frm_view_forms capability, without checking install_plugins or activate_plugins capabilities. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins on the server. Exploitation additionally requires that the site is free-only (Formidable Pro is NOT installed). | ||||
| CVE-2026-116622 | 2 Wordpress-extensions, Wpscripts | 2 Food Store, Food Store – Online Food Delivery & Pickup | 2026-11-12 | 7.2 High |
| The Food Store – Online Food Delivery & Pickup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'service_time' parameter in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the site to have the 'Enable Checkout Service Fields' option turned off, which is a non-default configuration, while 'Enable Pickup/Delivery Service' remains enabled. | ||||
| CVE-2026-65444 | 2 Creativethemes, Wordpress-extensions | 2 Blocksy Companion, Blocksy Companion | 2026-11-12 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Creative Themes Blocksy Companion blocksy-companion allows Stored XSS.This issue affects Blocksy Companion: from n/a through 2.1.60. | ||||
| CVE-2026-116860 | 2 Arraytics, Wordpress-extensions | 2 Timetics, Timetics | 2026-11-12 | 5.3 Medium |
| Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through 1.0.65. | ||||
| CVE-2026-119714 | 2 Joedolson, Wordpress-extensions | 3 My-calendar, My Calendar, My Calendar | 2026-11-12 | 6.5 Medium |
| My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection vulnerability that allows unauthenticated attackers to execute registered shortcodes via the mcs search parameter. The mcs value reaches mc_search_results() in src/my-calendar-search.php without bracket encoding before do_shortcode runs, so a GET request triggers shortcodes on any page or post, enabling content injection and spoofing. | ||||