Export limit exceeded: 424989 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 424989 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (424989 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-2688 | 1 Wordpress-extensions | 1 Cm Hipaa Forms | 2026-11-11 | 6.5 Medium |
| The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authentication bypass via a hardcoded parameter alongside all AJAX requests. The server explicitly checks for this value to skip nonce validation entirely. This allows unauthenticated attackers to access protected AJAX endpoints. | ||||
| CVE-2026-4357 | 1 Wordpress-extensions | 1 Embed Html5 Game | 2026-11-11 | 10 Critical |
| The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who can upload files via the plugin, as well as what can be uploaded, making it possible for unauthenticated attackers to upload PHP backdoors on affected sites. | ||||
| CVE-2026-77009 | 1 Wordpress-extensions | 1 Watchman Site7 | 2026-11-11 | 9.9 Critical |
| The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to its debugging console, which executes user-supplied PHP code, allowing any authenticated user, such as a subscriber, to run arbitrary code on the server. | ||||
| CVE-2026-78153 | 1 Wordpress-extensions | 1 Restrict User Access | 2026-11-11 | 5.3 Medium |
| The Restrict User Access WordPress plugin before 2.8.1 does not normalise the REST API route before checking it against the routes its content protection covers, allowing unauthenticated users to bypass that protection and read restricted content and enumerate users. | ||||
| CVE-2026-83533 | 1 Wordpress-extensions | 1 Wp Express Checkout | 2026-11-11 | 5.3 Medium |
| The WP Express Checkout WordPress plugin before 2.4.9 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying. | ||||
| CVE-2026-83547 | 1 Wordpress-extensions | 1 Xpro Elementor Addons | 2026-11-11 | 6.8 Medium |
| The Xpro Addons WordPress plugin before 1.7.4 does not properly escape some of its widgets' settings before outputting them within HTML attributes, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks. | ||||
| CVE-2023-3360 | 1 Wordpress-extensions | 1 Weaver Show Posts | 2026-11-11 | 3.3 Low |
| The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import a malicious file and a suitable gadget chain is present on the blog. | ||||
| CVE-2024-3773 | 1 Wordpress-extensions | 1 Livejournal Shortcode | 2026-11-11 | 5.9 Medium |
| The LiveJournal Shortcode WordPress plugin through 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks | ||||
| CVE-2025-15481 | 1 Wordpress-extensions | 1 Notification Bar For Wordpress | 2026-11-11 | 5.3 Medium |
| The Notification Bar for WordPress plugin through 1.1.8 exposes an unauthenticated CSV export script that discloses all stored subscriber emails. | ||||
| CVE-2025-15485 | 1 Wordpress-extensions | 1 Auto X Line | 2026-11-11 | 8.2 High |
| The Auto x LINE WordPress plugin through 1.0.0 does not have authorization checks in some of its REST endpoints, allowing unauthenticated users to call them and update the plugin settings, clear logs etc | ||||
| CVE-2025-8945 | 1 Wordpress-extensions | 1 Wp Edit Password Protected | 2026-11-11 | 5.3 Medium |
| The Wp Edit Password Protected WordPress plugin before 1.3.5 allows protecting page content, but this protection can be bypassed by using the REST API. | ||||
| CVE-2025-9314 | 1 Wordpress-extensions | 1 Developer Tools | 2026-11-11 | 9.8 Critical |
| The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in the bundled SWFUpload component | ||||
| CVE-2026-126325 | 2026-11-11 | 9 Critical | ||
| A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. | ||||
| CVE-2026-18666 | 1 Wordpress-extensions | 1 Library Management System | 2026-11-11 | 4.3 Medium |
| The Library Management System WordPress plugin before 3.6.7 does not sanitize and escape a user-supplied parameter before using it in a SQL statement, allowing users with a role as low as Subscriber to perform SQL injection and extract arbitrary data from the database, including user password hashes. | ||||
| CVE-2026-17012 | 1 Wordpress-extensions | 1 Restore Paypal Standard For Woocommerce | 2026-11-11 | 5.3 Medium |
| The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not verify that the PayPal account which received a payment matches the merchant's configured account before marking the order as paid, allowing unauthenticated buyers to complete a WooCommerce order by paying the full amount to their own PayPal account instead of the merchant's. | ||||
| CVE-2026-17016 | 1 Wordpress-extensions | 1 Restore Paypal Standard For Woocommerce | 2026-11-11 | 3.7 Low |
| The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not validate the amount actually paid against the order total in its PayPal Data Transfer return handler, allowing a customer to pay less than the order total and still have the order marked as fully paid when the PayPal Data Transfer feature is enabled. | ||||
| CVE-2026-17010 | 1 Wordpress-extensions | 1 Saitama Addon Pack | 2026-11-11 | 5.4 Medium |
| The Saitama Addon Pack WordPress plugin through 1.0.8 does not sanitise and escape certain post metadata values before outputting them, allowing users with contributor-level access and above to inject stored Cross-Site Scripting payloads that execute in the browser of a higher-privileged user who reviews the content. | ||||
| CVE-2026-17018 | 1 Wordpress-extensions | 1 Cubewp Framework | 2026-11-11 | 4.9 Medium |
| The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of its REST API endpoints, allowing users with the Contributor role and above to read arbitrary post metadata (including that of other users' draft, pending, private, and password-protected posts) and arbitrary user metadata of any user, including administrators. | ||||
| CVE-2026-13600 | 1 Wordpress-extensions | 1 Autonettv Relay | 2026-11-11 | 8.1 High |
| The AutoNetTV Relay WordPress plugin before 3.0.14 does not perform any capability or authentication check before setting a WordPress administrator authentication cookie during its scheduled content-synchronization task. On server configurations where the scheduled task executes before the HTTP response is committed, an unauthenticated attacker who triggers the due task can receive the administrator's session cookie and gain administrator access without credentials. | ||||
| CVE-2026-13701 | 1 Wordpress-extensions | 1 Advanced Excerpt | 2026-11-11 | 4.8 Medium |
| The Advanced Excerpt WordPress plugin before 4.5 does not sanitise and escape one of its settings before outputting it on the front end of the site, which could allow administrators (including those without the unfiltered_html capability, such as on multisite) to perform Stored Cross-Site Scripting attacks that execute in the context of any visitor viewing affected pages. | ||||