Export limit exceeded: 425500 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425500 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425500 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-119302 | 1 Wordpress-extensions | 1 Notificationx | 2026-11-12 | 6.5 Medium |
| The NotificationX WordPress plugin before 3.3.7 does not perform any capability, authentication or nonce check on its notification preview path, allowing unauthenticated users to disclose the content of private, draft, pending and password-protected posts and to execute arbitrary registered shortcodes by supplying crafted preview data on any front-end request. | ||||
| CVE-2026-119033 | 2026-11-12 | 2.2 Low | ||
| The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not verify that a user may edit a post before letting them change that post's structured data settings, allowing users with the Contributor role and above, when an administrator has granted them access to the Schema & Structured Data for WP & AMP WordPress plugin before 1.70, to disable, alter or reset the structured data of posts they do not own. | ||||
| CVE-2026-115733 | 1 Wordpress-extensions | 1 Printaura Woocommerce Api | 2026-11-12 | 9.1 Critical |
| The Printaura-Woocommerce WordPress plugin through 4.0.2 does not properly restrict access to the WooCommerce REST API, causing every WooCommerce REST route to accept unauthenticated requests, which allows unauthenticated attackers to read and modify store data including customer orders and personal information, store and payment settings, and webhooks. | ||||
| CVE-2026-110016 | 1 Wordpress-extensions | 1 Data Tables Generator By Supsystic | 2026-11-12 | 5.3 Medium |
| The Data Tables Generator by Supsystic WordPress plugin before 1.15.8 does not perform any authorization or ownership check before returning the stored contents of a table, relying only on a nonce that is exposed to every anonymous visitor, allowing unauthenticated users to read the full contents of any table by its identifier, including tables that are never published anywhere on the site. | ||||
| CVE-2026-104718 | 2026-11-12 | 6.8 Medium | ||
| The Elementor Website Builder WordPress plugin before 4.3.6 does not validate or escape an element identifier before rendering it into a client-side framework attribute that is evaluated as JavaScript, allowing users with the Contributor role to store scripts that execute in the browser of anyone viewing the affected content, including an administrator reviewing the submission for publication. | ||||
| CVE-2026-110948 | 2026-11-12 | 3.7 Low | ||
| The Download Manager WordPress plugin before 3.3.73, Download Manager WordPress plugin before 7.6.2 does not verify that a visitor is allowed to access a package before its media-preview renderers issue a download key for it, allowing unauthenticated visitors to download password-locked and role-restricted files by reading the key from a public page. | ||||
| CVE-2026-111597 | 1 Wordpress-extensions | 1 Forminator Forms | 2026-11-12 | 5.3 Medium |
| The Forminator Forms WordPress plugin before 1.58.4 does not verify that a Stripe Checkout payment has completed before returning a pending submission's after-payment response, allowing unauthenticated visitors to obtain the post-payment redirect URL and thank-you message of a payment-gated form without paying. | ||||
| CVE-2026-118041 | 1 Wordpress-extensions | 1 Contest Gallery | 2026-11-12 | 8.8 High |
| The Contest Gallery WordPress plugin before 34.0.3 does not sanitise the name of files uploaded through its e-commerce sale file-replacement feature, allowing authenticated users with Author-level access and above to write files with an arbitrary name and extension to a web-accessible directory and, by overwriting the directory's protection file through the same flow, achieve Remote Code Execution. | ||||
| CVE-2026-119035 | 2026-11-12 | 6.4 Medium | ||
| The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not safely encode its structured data output when the Pretty Print option is enabled, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks when the site maps a schema property to a custom field. | ||||
| CVE-2026-123666 | 1 Wordpress-extensions | 1 Photo Engine | 2026-11-12 | 4.9 Medium |
| The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.2 does not check that a user may delete the media in a collection before deleting it along with the collection, allowing users with the Author role and above to permanently delete other users' synced media, including administrators'. | ||||
| CVE-2025-15711 | 1 Wordpress-extensions | 1 Live Composer | 2026-11-12 | 3.5 Low |
| The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its module settings before outputting them in an href attribute, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (e.g. in multisite setups). | ||||
| CVE-2026-106468 | 1 Wordpress-extensions | 1 Code Snippets | 2026-11-12 | 3.8 Low |
| The Code Snippets WordPress plugin before 4.1.0 does not verify network-level capabilities before honouring a network-scope parameter on its snippet import routes on multisite, allowing an administrator of a single subsite without network-management rights to create, overwrite and deactivate network-wide snippets belonging to the whole network. | ||||
| CVE-2026-111579 | 1 Wordpress-extensions | 1 Forminator Forms | 2026-11-12 | 8.1 High |
| The Forminator Forms WordPress plugin before 1.58.4 does not enforce payment on the server side when a form's configured payment gateway is unavailable, allowing unauthenticated visitors to complete a payment-gated User Registration form without paying and be assigned the form's configured role, up to administrator, after the gateway has been connected and later disconnected. | ||||
| CVE-2026-118439 | 1 Wordpress-extensions | 1 Limit Login Attempts Reloaded | 2026-11-12 | 4.1 Medium |
| The Limit Login Attempts Security WordPress plugin before 3.4.2 does not validate the destination of a server-side request built from a user-supplied setup value, allowing users with administrator privileges to make the site issue requests to arbitrary hosts, including internal ones (SSRF). | ||||
| CVE-2026-119529 | 1 Wordpress-extensions | 1 Gravity Forms | 2026-11-12 | 5.9 Medium |
| The Gravity Forms WordPress plugin before 3.2.2 does not properly restrict the file types that unauthenticated users can upload through its chunked file upload feature, allowing them to read server environment variables and the contents of files within the web root on servers configured to parse Server-Side Include documents, such as Apache with SSI enabled. | ||||
| CVE-2026-121497 | 1 Wordpress-extensions | 1 Askany | 2026-11-12 | 9.8 Critical |
| The AskAny WordPress plugin before 2.2.0 does not validate the extension or content of files attached to chat messages, trusting the browser-supplied file type instead, which allows unauthenticated users to upload PHP files and execute arbitrary code when visitor attachments are enabled. | ||||
| CVE-2026-109870 | 2026-11-12 | 8.1 High | ||
| The User Registration & Membership WordPress plugin before 5.3.2 does not verify that a discount coupon applied to a paid membership plan is actually valid for that plan before treating a fully discounted order as paid, allowing unauthenticated users to be granted the role mapped to a paid plan without paying for it, which can lead to privilege escalation up to administrator where a plan is mapped to a privileged role. | ||||
| CVE-2026-115734 | 1 Wordpress-extensions | 1 Pay With A Tweet | 2026-11-12 | 9.6 Critical |
| The Pay with a tweet WordPress plugin through 1.0.5 does not validate a file path before deleting it, nor does it restrict access to the relevant administration screens, allowing users with a role as low as Subscriber to delete arbitrary files on the server, which can lead to a full site compromise. | ||||
| CVE-2026-115735 | 1 Wordpress-extensions | 1 Somatic Framework | 2026-11-12 | 9.6 Critical |
| The Somatic Framework WordPress plugin through 1.8.14 does not perform an authorization check or validate a user-supplied file path before deleting it, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the server, which can lead to a full site takeover. | ||||
| CVE-2026-117521 | 1 Wordpress-extensions | 1 Dynific Addons For Elementor | 2026-11-12 | 6.8 Medium |
| The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not escape a user-controlled profile value before outputting it in a quoted attribute in one of its Elementor widgets, allowing authenticated users with the Author role to store a payload that executes in the session of anyone, including an administrator, who views a post the attacker authored, resulting in Stored Cross-Site Scripting. | ||||