Export limit exceeded: 424998 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (424998 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-119365 | 2 Bplugins, Wordpress-extensions | 2 Media Player Addons For Elementor – Media Player Widget For Wp, Media Player Addons For Elementor – Media Player Widget For Wp | 2026-11-12 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Media Player Addons for Elementor – Media Player widget for WP media-player-addons-for-elementor allows Stored XSS.This issue affects Media Player Addons for Elementor – Media Player widget for WP: from n/a through 1.1.10. | ||||
| CVE-2026-110001 | 2 Foliovision, Wordpress-extensions | 2 Fv Flowplayer Video Player, Fv Flowplayer Video Player | 2026-11-12 | 5.4 Medium |
| The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment (shortcode attribute 'align')' parameter in all versions up to, and including, 7.5.55.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the plugin's 'Parse Vimeo and YouTube links' (parse_comments) setting to be enabled by an administrator, which causes the plugin to register do_shortcode on the comment_text filter, allowing attacker-supplied shortcode attributes stored in comments to be rendered unescaped to all subsequent visitors. | ||||
| CVE-2026-126208 | 2026-11-12 | 4.7 Medium | ||
| Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.3, Loofah's SVG_ALLOW_LOCAL_HREF safelist lists textPath with lowercase spelling that does not match the HTML5 parser's element name and omits mpath, so external href and xlink:href values on those elements survive sanitization. Firefox fetches the attacker-chosen URL when a viewer renders the content, which can disclose the viewer's IP address, user agent, referrer, and access to hosts routable only from the viewer's network. Chrome and WebKit do not fetch these references, and the impact is a network request rather than script execution. The rails-html-sanitizer PermitScrubber reuses the affected safelist when SVG elements are permitted. This issue is fixed in version 2.25.3. | ||||
| CVE-2026-107630 | 2 Saadiqbal, Wordpress-extensions | 2 Email Templates Customizer And Designer For Wordpress And Woocommerce, Email Templates Customizer And Designer For Wordpress And Woocommerce | 2026-11-12 | 7.5 High |
| The Email Templates Customizer and Designer for WordPress and WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to enumerate WooCommerce order IDs via the preview_order parameter and exfiltrate every customer's billing name, address, phone number, and email address. The exploit requires two unauthenticated requests: the first harvests a reusable nonce from the 302 Location header returned by the unguarded admin_init handler, and the second supplies that nonce alongside an arbitrary order ID to the preview endpoint, making full customer PII disclosure trivially achievable without any account or credentials. | ||||
| CVE-2026-118635 | 2 Paoltaia, Wordpress-extensions | 2 Geodirectory, Geodirectory | 2026-11-12 | 6.5 Medium |
| The The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.8.198 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. | ||||
| CVE-2026-96894 | 2 Wedevs, Wordpress-extensions | 2 Erp: Complete Hr, Accounting & Crm Suite Built For Woocommerce, Erp: Complete Hr, Accounting & Crm Suite Built For Woocommerce | 2026-11-12 | 7.2 High |
| The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Inbound Email Body in all versions up to, and including, 1.17.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The inbound email router's only gate is a regex match on the References header for a reply token whose hash is never cryptographically validated, meaning any external party who received or can mimic a CRM outbound email can satisfy the check without a WordPress account. | ||||
| CVE-2026-110533 | 2 Foliovision, Wordpress-extensions | 2 Fv Flowplayer Video Player, Fv Flowplayer Video Player | 2026-11-12 | 6.4 Medium |
| The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fv_player_videos[_fv_player_user_video][]' parameter in all versions up to, and including, 7.5.55.7212 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have enabled the "Allow visitors to upload videos to their profile" (profile_videos_enable_bio) setting before Subscriber-level users can submit profile videos. | ||||
| CVE-2026-104744 | 2 Independent Analytics, Wordpress-extensions | 2 Independent Analytics Pro, Independent Analytics Pro | 2026-11-12 | 7.2 High |
| The Independent Analytics Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utm_campaign' parameter in all versions up to, and including, 2.15.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Independent Analytics Pro build to be active, as the free build nulls campaign parameters; additionally, the attacker must first visit a frontend page to obtain a server-signed payload that can be replayed with a crafted utm_campaign value against the unauthenticated /iawp/search REST endpoint, since the signature check does not cover utm_* fields. | ||||
| CVE-2026-109984 | 2 Foliovision, Wordpress-extensions | 2 Fv Flowplayer Video Player, Fv Flowplayer Video Player | 2026-11-12 | 5.4 Medium |
| The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 7.5.55.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the 'Parse Vimeo and YouTube links' option to be enabled and a site administrator to approve the comment containing the malicious shortcode; execution is then triggered for any visitor who interacts with the video player on that page. | ||||
| CVE-2026-105894 | 2 Akbilisim, Wordpress-extensions | 2 Ak Framework, Ak Framework | 2026-11-12 | 8.8 High |
| The Ak Framework plugin for WordPress, included in the Newsy - Viral News & Magazine WordPress Theme, is vulnerable to Privilege Escalation in all versions up to, and including, 2.9.8. This is due to missing capability checks in the ajax_refresh_nonce and ak_admin_ajax handlers before passing attacker-controlled option names and values to update_option(). This makes it possible for unauthenticated attackers to update arbitrary WordPress options including users_can_register and default_role to escalate privileges to administrator by enabling user registration with administrator as the default role. | ||||
| CVE-2026-119113 | 2 Paoltaia, Wordpress-extensions | 2 Geodirectory, Geodirectory | 2026-11-12 | 6.4 Medium |
| The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the listing description (post_content) in versions up to, and including, 2.8.199 This is due to insufficient input sanitization on save (the bundled geodir_kses_safe_embed_attributes() helper only neutralises data-embed-url, data-src and data-embed, while WordPress core wp_kses_post permits data-* attributes on standard HTML tags) combined with the AyeCode UI library initializing every [data-bs-toggle="popover-html"] element with { html: true, sanitize: false }, which inserts the attacker-controlled data-bs-content value into the popover body as HTML at render time. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-62057 | 2 Fahim Reza, Wordpress-extensions | 2 Divi Contact Form 7, Divi Contact Form 7 | 2026-11-12 | 5.3 Medium |
| Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Fahim Reza Divi Contact Form 7 cf7-styler-for-divi allows Code Injection.This issue affects Divi Contact Form 7: from n/a through 4.1.0. | ||||
| CVE-2026-54854 | 2 Cozmoslabs, Wordpress-extensions | 2 Profile Builder, Profile Builder | 2026-11-12 | 6.3 Medium |
| Contributor Privilege Escalation in Profile Builder <= 4.0.5 versions. | ||||
| CVE-2026-54855 | 2 Cozmoslabs, Wordpress-extensions | 2 Profile Builder, Profile Builder | 2026-11-12 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Profile Builder <= 4.0.5 versions. | ||||
| CVE-2026-78527 | 2 Gsplugins, Wordpress-extensions | 2 Gs Testimonial Slider, Gs Testimonial Slider | 2026-11-12 | 8.8 High |
| Contributor PHP Object Injection in GS Testimonial Slider <= 3.3.10 versions. | ||||
| CVE-2026-90888 | 2 Leadsnap, Wordpress-extensions | 2 Leadsnap, Leadsnap | 2026-11-12 | 9.8 Critical |
| Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions. | ||||
| CVE-2026-94175 | 2 Saad Iqbal, Wordpress-extensions | 2 All In One Login, All In One Login | 2026-11-12 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in All In One Login <= 2.4.1 versions. | ||||
| CVE-2026-107868 | 2 Wordpress-extensions, Yithemes | 2 Yith Woocommerce Product Add Ons, Yith Woocommerce Product Add-ons | 2026-11-12 | 5.3 Medium |
| Unauthenticated Bypass Vulnerability in YITH WooCommerce Product Add-Ons <= 4.34.0 versions. | ||||
| CVE-2026-115947 | 2 Realmag777, Wordpress-extensions | 2 Husky, Husky | 2026-11-12 | 6.5 Medium |
| Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions. | ||||
| CVE-2026-116401 | 2 Realmag777, Wordpress-extensions | 2 Husky, Husky | 2026-11-12 | 7.5 High |
| Unauthenticated Broken Access Control in HUSKY <= 1.4.6 versions. | ||||