Export limit exceeded: 47991 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 14854 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (14854 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-66703 | 2 Properfraction, Wordpress | 2 Mailoptin, Wordpress | 2026-08-06 | 6.5 Medium |
| Contributor Cross Site Scripting (XSS) in MailOptin <= 1.2.78.0 versions. | ||||
| CVE-2026-6235 | 2 Sendmachine, Wordpress | 2 Sendmachine For Wordpress, Wordpress | 2026-08-06 | 9.8 Critical |
| The Sendmachine for WordPress plugin for WordPress is vulnerable to authorization bypass via the 'manage_admin_requests' function in all versions up to, and including, 1.0.20. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the plugin's SMTP configuration, which can be leveraged to intercept all outbound emails from the site (including password reset emails). | ||||
| CVE-2025-14843 | 3 Wizit, Woocommerce, Wordpress | 3 Gateway For Woocommerce, Woocommerce, Wordpress | 2026-08-06 | 5.3 Medium |
| The Wizit Gateway for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Arbitrary Order Cancellation in all versions up to, and including, 1.3.1. This is due to a lack of authentication and authorization checks in the 'handle_checkout_redirecturl_response' function. This makes it possible for unauthenticated attackers to cancel arbitrary WooCommerce orders by sending a crafted request with a valid order ID. | ||||
| CVE-2026-65559 | 2 Tychesoftwares, Wordpress | 2 Order Delivery Date For Woocommerce, Wordpress | 2026-08-06 | 7.2 High |
| Shop manager Privilege Escalation in Order Delivery Date for WooCommerce <= 4.6.0 versions. | ||||
| CVE-2026-65513 | 2 Nsquared, Wordpress | 2 Simply Schedule Appointments, Wordpress | 2026-08-06 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.10 versions. | ||||
| CVE-2026-65515 | 2 Affiliatewp, Wordpress | 2 Affiliatewp, Wordpress | 2026-08-06 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.35.0 versions. | ||||
| CVE-2026-65520 | 2 Miniorange, Wordpress | 2 Wp Oauth Server, Wordpress | 2026-08-06 | 9.3 Critical |
| Unauthenticated SQL Injection in WP OAuth Server <= 6.2.0 versions. | ||||
| CVE-2026-65547 | 2 Constantcontact, Wordpress | 2 Creative Mail, Wordpress | 2026-08-06 | 8.5 High |
| Subscriber SQL Injection in Creative Mail <= 1.6.9 versions. | ||||
| CVE-2026-65552 | 2 Qlstudio, Wordpress | 2 Export User Data, Wordpress | 2026-08-06 | 9.8 Critical |
| Subscriber PHP Object Injection in Export User Data <= 2.2.6 versions. | ||||
| CVE-2026-65508 | 2 Nsquared, Wordpress | 2 Simply Schedule Appointments, Wordpress | 2026-08-06 | 9.3 Critical |
| Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.12.10 versions. | ||||
| CVE-2026-65565 | 2 Ays-pro, Wordpress | 2 Survey Maker, Wordpress | 2026-08-06 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Survey Maker <= 5.2.3.3 versions. | ||||
| CVE-2026-65569 | 2 Wordpress, Wpjobportal | 2 Wordpress, Wp Job Portal | 2026-08-06 | 8.5 High |
| Subscriber SQL Injection in WP Job Portal <= 2.5.6 versions. | ||||
| CVE-2026-61964 | 2 Wordpress, Wpmanageninja | 2 Wordpress, Ninja Tables | 2026-08-06 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Ninja Tables <= 5.2.9 versions. | ||||
| CVE-2026-18510 | 2 Cozmoslabs, Wordpress | 2 Translatepress – Translate Multilingual Sites With Ai Translation, Wordpress | 2026-08-06 | 7.2 High |
| The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content (URL-encoded gettext markers) in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Comment moderation may delay exploitation for first-time commenters, but does not prevent it, as the payload uses only WordPress-permitted tags and attributes with percent-encoded characters that pass wp_kses URL validation unmodified. | ||||
| CVE-2026-28169 | 2 Wordpress, Yithemes | 2 Wordpress, Yith Woocommerce Zoom Magnifier | 2026-08-06 | 5.3 Medium |
| Unauthenticated Sensitive Data Exposure in YITH WooCommerce Zoom Magnifier <= 2.52.0 versions. | ||||
| CVE-2026-11983 | 2 Spacetime, Wordpress | 2 Ad Inserter – Ad Manager & Adsense Ads, Wordpress | 2026-08-06 | 5.3 Medium |
| The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.16 due to a missing capability check in the `ai_ajax` function. This makes it possible for unauthenticated attackers to view the contents of ad blocks that an administrator has restricted to administrator-only visibility. | ||||
| CVE-2026-65551 | 2 Soflyy, Wordpress | 2 Breakdance, Wordpress | 2026-08-06 | 7.5 High |
| Missing Authorization vulnerability in Soflyy Breakdance allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Breakdance: from n/a before 2.7. | ||||
| CVE-2025-15028 | 2 Wordpress, Wpwax | 2 Wordpress, Formgent – Next-gen Ai Form Builder For Wordpress With Multi-step, Quizzes, Payments & More | 2026-08-06 | 7.2 High |
| The FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission fields in all versions up to, and including, 1.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-65458 | 2 Chouby, Wordpress | 2 Polylang, Wordpress | 2026-08-06 | 4.3 Medium |
| Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Chouby Polylang and Chouby Polylang Pro allows Retrieve Embedded Sensitive Data. This issue affects Polylang: through 3.8.5; Polylang Pro: through 3.8.5. | ||||
| CVE-2026-24552 | 2 Mischiefmarmot, Wordpress | 2 Create By Mediavine, Wordpress | 2026-08-06 | 8.5 High |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in John-Michael L'Allier Create allows Blind SQL Injection. This issue affects Create: from n/a through 2.5.3. | ||||