Export limit exceeded: 14642 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (14642 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-14920 | 2 Acymailing, Wordpress | 2 Acymailing, Wordpress | 2026-08-04 | N/A |
| ## Summary | ||||
| CVE-2026-16291 | 2 Profilegrid, Wordpress | 2 Profilegrid, Wordpress | 2026-08-04 | N/A |
| The ProfileGrid WordPress plugin before 5.9.9.8 does not verify that a notification belongs to the requesting user before deleting it, allowing any authenticated user such as a Subscriber to delete other users' notifications by enumerating notification identifiers. | ||||
| CVE-2025-15673 | 2 Carazo, Wordpress | 2 Import And Export Users And Customers, Wordpress | 2026-08-04 | N/A |
| The Import and export users and customers WordPress plugin before 2.4.3 does not restrict the path of a file it reads and displays during a CSV import, allowing high-privileged users to read arbitrary files on the server. | ||||
| CVE-2026-11366 | 2 Monsterinsights, Wordpress | 2 Monsterinsights, Wordpress | 2026-08-04 | N/A |
| The MonsterInsights WordPress plugin before 11.1.0 does not correctly validate the signature on one of its unauthenticated AJAX actions: when the MonsterInsights WordPress plugin before 11.1.0 is not connected to Google Analytics the HMAC signing key is empty, which lets unauthenticated attackers forge a valid signature and overwrite a MonsterInsights WordPress plugin before 11.1.0 configuration value, disrupting the MonsterInsights WordPress plugin before 11.1.0's server-side analytics in Manual GA4 mode. | ||||
| CVE-2026-16056 | 2 Contest-gallery, Wordpress | 2 Contest Gallery, Wordpress | 2026-08-04 | N/A |
| The Contest Gallery WordPress plugin before 30.0.7 does not perform any capability or nonce check in one of its handlers, allowing any authenticated user down to Subscriber to read the site's entire stored OpenAI prompt history. | ||||
| CVE-2026-16068 | 2 Brizy, Wordpress | 2 Brizy, Wordpress | 2026-08-04 | N/A |
| The Brizy WordPress plugin before 2.8.19 does not properly restrict who can modify its site-global design data and does not sanitise part of that data before outputting it, allowing authenticated users with Author-level access and above to store arbitrary JavaScript that is then served unsanitised on the site's front-end pages and executes in the browser of every visitor, including administrators. | ||||
| CVE-2026-16070 | 2 Brizy, Wordpress | 2 Brizy, Wordpress | 2026-08-04 | N/A |
| The Brizy WordPress plugin before 2.8.19 does not properly verify authorization on the object being modified before updating a template's type meta, validating a request parameter that is different from the one used in the write operation, allowing users with Contributor-level access and above to change the template-type assignment of templates owned by other users. | ||||
| CVE-2026-16295 | 2 Clearfy Cache, Wordpress | 2 Clearfy Cache, Wordpress | 2026-08-04 | N/A |
| The Clearfy Cache WordPress plugin before 2.4.3 does not perform a capability check in one of its admin-page dispatch paths, allowing any authenticated user such as a Subscriber to render admin-only settings pages and disclose their contents, including administrative nonces, while the canonical page URL correctly restricts access. | ||||
| CVE-2026-16296 | 2 Clearfy Cache, Wordpress | 2 Clearfy Cache, Wordpress | 2026-08-04 | N/A |
| The Clearfy Cache WordPress plugin before 2.4.3 does not validate the redirect target in its Cyrlitera old-URL redirect handler, passing a decoded request URI to an unsafe redirect function, which allows unauthenticated attackers to redirect visitors to an arbitrary external URL when a non-default option is enabled. | ||||
| CVE-2026-11880 | 2 Fluent Forms, Wordpress | 2 Fluent Forms, Wordpress | 2026-08-04 | 3.1 Low |
| The Fluent Forms WordPress plugin before 6.2.1 does not properly verify ownership before processing a subscription cancellation request, allowing authenticated users with a low-privilege account to cancel subscriptions belonging to other users. | ||||
| CVE-2026-11766 | 2 Ultimatemember, Wordpress | 2 Ultimate Member, Wordpress | 2026-08-04 | 8 High |
| The Ultimate Member WordPress plugin before 2.12.0 does not properly sanitise and escape the value of custom textarea profile fields before outputting it on user profiles, allowing authenticated users with Subscriber-level access and above to store JavaScript that executes when any user, including an administrator, views the affected profile. | ||||
| CVE-2026-11962 | 2 Fileorganizer, Wordpress | 2 Fileorganizer, Wordpress | 2026-08-04 | 8.8 High |
| The FileOrganizer WordPress plugin before 1.2.0 does not validate the file type on several of its file-management operations, allowing authenticated users who have been granted file-manager access — which its premium add-on can extend to sub-administrator roles — to upload arbitrary PHP files and achieve remote code execution. This is an incomplete fix of CVE-2024-7985, which only added file-type validation to the upload operation. | ||||
| CVE-2026-12277 | 2 Frontend File Manager Plugin, Wordpress | 2 Frontend File Manager Plugin, Wordpress | 2026-08-04 | 8.7 High |
| The Frontend File Manager Plugin WordPress plugin through 23.6 does not validate a file path derived from user input before deleting the referenced file, allowing unauthenticated users to delete arbitrary files on the server (such as wp-config.php) when guest upload mode is enabled. Deleting wp-config.php forces the site into its setup routine, which can be leveraged toward a full site takeover. | ||||
| CVE-2026-12582 | 2 Library Management System Project, Wordpress | 2 Library Management System, Wordpress | 2026-08-04 | 8.6 High |
| The Library Management System WordPress plugin before 3.5.8 does not sanitize and escape a user-supplied parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection and extract arbitrary data from the database, including user password hashes. | ||||
| CVE-2026-16069 | 2 Brizy, Wordpress | 2 Brizy, Wordpress | 2026-08-04 | N/A |
| The Brizy WordPress plugin before 2.8.19 does not sanitize or escape featured-image focal-point coordinates submitted through one of its AJAX actions before storing them and later echoing them into HTML attributes in the post editor's Featured Image meta box, allowing users with the Contributor role or above to inject arbitrary web scripts that execute in the session of a higher-privileged user who opens the post for review. | ||||
| CVE-2026-13147 | 2 Kirki, Wordpress | 2 Kirki, Wordpress | 2026-08-04 | 9.1 Critical |
| The Kirki WordPress plugin before 6.0.12 does not validate a user-supplied URL before requesting it server-side, allowing unauthenticated attackers to make the site issue HTTP requests to arbitrary hosts (Server-Side Request Forgery). | ||||
| CVE-2026-54768 | 2 Wordpress, Wpgraphql | 2 Wordpress, Wpgraphql | 2026-08-03 | N/A |
| WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class accounts through the sendPasswordResetEmail mutation and obtain public profile fields. This issue is fixed in version 2.15.1. | ||||
| CVE-2026-12231 | 2 Timstrifler, Wordpress | 2 Exclusive Addons For Elementor, Wordpress | 2026-08-03 | 6.4 Medium |
| The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ exad_infobox_image’ parameter in all versions up to, and including, 2.7.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-18344 | 2 Nik00726, Wordpress | 2 Responsive Thumbnail Slider, Wordpress | 2026-08-03 | 6.1 Medium |
| The Wp Responsive Thumbnail Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in versions up to, and excluding, 1.1.53. This is due to insufficient input sanitization and output escaping in the responsive_thumbnail_image_management() function, which echoes $_GET['id'] directly into a double-quoted HTML attribute with no esc_attr() call. The only guard is a loose PHP numeric comparison ($_GET['id']>0) that a string beginning with a numeric prefix trivially satisfies, and the addslashes() applied by wp_magic_quotes() is inert in HTML-attribute context because backslash is not an HTML escape character. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link. | ||||
| CVE-2026-15644 | 2 Codesupplyco, Wordpress | 2 Powerkit, Wordpress | 2026-08-03 | 6.4 Medium |
| The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||