Export limit exceeded: 424296 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 424296 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (424296 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-18052 | 1 Wordpress-extensions | 1 Managewp Worker | 2026-11-11 | 8.1 High |
| The ManageWP Worker WordPress plugin before 4.9.37 does not bind the account being logged in to the signature which authorises the login, nor prevent an already used login link from being replayed, allowing attackers who obtain such a link to gain a session as any user on the site, including an administrator. | ||||
| CVE-2026-19093 | 1 Wordpress-extensions | 1 Tutor Lms | 2026-11-11 | 6.8 Medium |
| The Tutor LMS WordPress plugin before 4.0.6 does not validate a stored file path before using it to stream media, allowing users with the instructor role to read arbitrary files on the server, including files outside the web root. The readable files include the WordPress configuration file, which exposes the database credentials and the authentication keys and salts, so authentication cookies can be forged. | ||||
| CVE-2026-76789 | 1 Wordpress-extensions | 1 Slider Hero | 2026-11-11 | 8.8 High |
| The Slider Hero with Video Background, Animation WordPress plugin before 9.1.3 does not have authorisation and nonce checks on two of its request handlers, and does not escape a stored setting before outputting it, allowing unauthenticated users to store malicious JavaScript which will be executed in the context of an administrator viewing the Slider Hero with Video Background, Animation WordPress plugin before 9.1.3's admin area, as well as any visitor of a page embedding a slider. | ||||
| CVE-2026-76793 | 1 Wordpress-extensions | 1 Firebase Authentication | 2026-11-11 | 8.1 High |
| The Firebase Authentication WordPress plugin before 1.7.1 does not require the email address in an authentication token to be verified before matching it to a WordPress account and issuing a session, allowing unauthenticated attackers to log in as any user, including administrators. | ||||
| CVE-2026-77000 | 1 Wordpress-extensions | 1 Wp Social Media Login | 2026-11-11 | 9.8 Critical |
| The WP Social Media Login WordPress plugin through 1.0.6 does not verify that a social login was actually completed with the identity provider before authenticating a visitor, allowing unauthenticated attackers to log in as any existing user, including administrators, by supplying that user's email address. | ||||
| CVE-2026-77002 | 1 Wordpress-extensions | 1 Smilepass Selfie Login | 2026-11-11 | 9.8 Critical |
| The SmilePass Selfie Login WordPress plugin through 1.0.2 does not perform any server-side verification of the identity it is asked to authenticate, allowing unauthenticated users to log in as any registered account, including administrators. | ||||
| CVE-2026-13598 | 1 Wordpress-extensions | 1 Restrictmate | 2026-11-11 | 9.8 Critical |
| The RestrictMate WordPress plugin before 1.3.0 does not restrict the user role supplied during account registration, allowing unauthenticated attackers to create a new administrator account and gain a logged-in administrator session, leading to full site takeover. | ||||
| CVE-2026-14853 | 1 Wordpress-extensions | 1 Woocommerce Bookings | 2026-11-11 | 4.3 Medium |
| The WooCommerce Bookings WordPress plugin before 3.9.0 does not perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by omitting the token, allowing users with Subscriber-level access and above to create draft bookable products. | ||||
| CVE-2026-32561 | 2 Liquidthemes, Wordpress-extensions | 2 Booking Hub, Booking Hub | 2026-11-11 | 8.8 High |
| Subscriber Privilege Escalation in Booking Hub <= 1.3.0 versions. | ||||
| CVE-2026-74932 | 1 Wordpress-extensions | 1 Wp Fastest Cache | 2026-11-11 | 7.5 High |
| The WP Fastest Cache WordPress plugin before 1.5.1 does not validate the Host header before using it to build the URLs of the asset files it embeds in the pages it caches, and does not include that header in the cache key, allowing unauthenticated attackers to poison cached pages with references to a server they control and have arbitrary JavaScript run for every subsequent visitor. | ||||
| CVE-2026-13404 | 1 Wordpress-extensions | 1 Royal Elementor Addons | 2026-11-11 | 5.3 Medium |
| The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or ownership check (relying only on a publicly-scrapeable nonce) before writing like-count and visitor-tracking post meta keyed on an arbitrary post ID, allowing unauthenticated users to modify that metadata on any post, including private and draft posts. | ||||
| CVE-2026-13406 | 1 Wordpress-extensions | 1 Royal Elementor Addons | 2026-11-11 | 5.3 Medium |
| The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or nonce check before returning taxonomy term data for an arbitrary, caller-supplied taxonomy, allowing unauthenticated users to disclose the names and IDs of terms belonging to non-public taxonomies. | ||||
| CVE-2026-14212 | 1 Wordpress-extensions | 1 Amelia Pro | 2026-11-11 | 4.7 Medium |
| The Booking for Appointments and Events Calendar WordPress plugin before 9.8 does not verify that an authenticated employee (provider) owns the provider account being updated, allowing any employee with an Employee Panel login to overwrite another employee's cabinet password and take over their account. | ||||
| CVE-2026-14216 | 1 Wordpress-extensions | 1 Amelia | 2026-11-11 | 6.5 Medium |
| The Booking for Appointments and Events Calendar WordPress plugin before 2.4.7 does not require authentication before processing its pending notification queue, allowing an unauthenticated user to force the dispatch of queued notifications and integration callbacks. | ||||
| CVE-2026-14550 | 1 Wordpress-extensions | 1 Wpcafe | 2026-11-11 | 5.3 Medium |
| The WPCafe WordPress plugin before 3.0.18 does not perform an authorization check when creating a reservation through its REST API, verifying only a publicly available nonce, allowing unauthenticated users to submit reservations with an arbitrary approval status and bypass the administrator moderation workflow. | ||||
| CVE-2026-16984 | 1 Wordpress-extensions | 1 Wp Legal Pages | 2026-11-11 | 6.5 Medium |
| The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1 does not include an authorization check on a REST route that returns stored account data, allowing unauthenticated visitors to retrieve the connected service's API secret and account details, which can then be used to disconnect the Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1's integration. | ||||
| CVE-2026-16986 | 1 Wordpress-extensions | 1 Booking Package | 2026-11-11 | 5.3 Medium |
| The Booking Package WordPress plugin before 1.7.25 does not validate the payment amount server-side against the stored service price, deriving the expected charge from attacker-supplied request values instead, so an unauthenticated attacker can pay an arbitrary fraction of a service's real price. | ||||
| CVE-2026-19094 | 1 Wordpress-extensions | 1 Tutor Lms | 2026-11-11 | 5.3 Medium |
| The Tutor LMS WordPress plugin before 4.0.6 does not validate values used to build a database query, and does not restrict which template file a request may load, allowing unauthenticated users to inject SQL and to read question and answer content belonging to courses that are not publicly available. The injected text reaches the query as grammar rather than as data, and on the database engines tested it does not yield extraction of arbitrary data, so the confidentiality impact is the disclosed course content rather than the database at large. | ||||
| CVE-2026-19226 | 1 Wordpress-extensions | 1 Royal Elementor Addons | 2026-11-11 | 6.8 Medium |
| The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not validate some widget settings before outputting them inside an HTML attribute, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks. | ||||
| CVE-2026-19718 | 1 Wordpress-extensions | 3 Blogvault, Malcare, Wp Remote | 2026-11-11 | 8.1 High |
| The BlogVault Backup & Staging WordPress plugin before 6.65, MalCare WordPress Security Plugin WordPress plugin before 6.65, The WP Remote WordPress Plugin WordPress plugin before 6.65 do not prevent unauthenticated users from obtaining data derived from the secret that binds a site to its remote management service, and generate that secret with a weak pseudo-random number generator, allowing attackers to recover it and gain administrative access to the site. | ||||