Export limit exceeded: 387000 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 15794 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (15794 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-5510 | 2 Givew, Wordpress | 2 Donation Plugin And Fundraising Platform, Wordpress | 2026-09-01 | 6.4 Medium |
| The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'give_form' shortcode in all versions up to, and including, 4.14.4. This is due to insufficient input sanitization and output escaping on the continue_button_title and display_style shortcode attributes, which are passed through sanitize_text_field() but not properly escaped when output in HTML data attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-75980 | 2 Wordpress, Wpdevteam | 2 Wordpress, Betterdocs – Ai Documentation, Knowledge Base, Docs, Wikis, Faq With Chatbot | 2026-09-01 | 6.4 Medium |
| The BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content in all versions up to, and including, 4.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit survives wp_kses_post because entity-encoded quotes in a heading id attribute are treated as a single legitimate attribute value at save time; the dangerous payload only materialises after process_content_for_toc() calls html_entity_decode() on the stored content and the broken id is extracted by a lazy regex before being echoed unescaped into the Table of Contents output. | ||||
| CVE-2026-5096 | 2 Wordpress, Wpeverest | 2 Wordpress, Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder | 2026-09-01 | 5.3 Medium |
| The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.4.4. This is due to the `load_previous_field_value()` method in `class-evf-form-task.php` accepting arbitrary URL values from `$_POST` data for upload fields without domain restriction, which are then passed to `wp_remote_head()` in the `get_local_file_size()` method of `class-evf-form-fields-upload.php`. This makes it possible for unauthenticated attackers to force the WordPress server to make outbound HTTP HEAD requests to arbitrary URLs by submitting a form with an upload field containing a malicious URL while leaving a required field empty to trigger form re-rendering. | ||||
| CVE-2026-81759 | 2 Magepeopleteam, Wordpress | 2 Wpevently, Wordpress | 2026-09-01 | 5.4 Medium |
| Contributor Broken Access Control in WpEvently <= 5.5.0 versions. | ||||
| CVE-2026-81761 | 2 Magepeopleteam, Wordpress | 2 Wpevently, Wordpress | 2026-09-01 | 4.3 Medium |
| Subscriber Broken Access Control in WpEvently <= 5.5.0 versions. | ||||
| CVE-2026-82220 | 2 Wordpress, Wpmudev | 2 Wordpress, Forminator Forms | 2026-09-01 | 5.3 Medium |
| Unauthenticated Other Vulnerability Type in Forminator <= 1.57.1 versions. | ||||
| CVE-2026-18233 | 2 Mstore, Wordpress | 2 Mstore Api, Wordpress | 2026-09-01 | 6.5 Medium |
| The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery endpoints belongs to the requester, allowing any authenticated user, including Subscribers, to mark arbitrary orders as completed and paid without any payment being made. | ||||
| CVE-2026-18234 | 2 Mstore, Wordpress | 2 Mstore Api, Wordpress | 2026-09-01 | 6.5 Medium |
| The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling belongs to the requester, and does not deduct the wallet balance for most payment methods, allowing any authenticated user, including Subscribers, to mark arbitrary orders as paid without any payment being taken. | ||||
| CVE-2026-77007 | 2 Higheredlab, Wordpress | 2 Hel Online Classroom: Ai-powered Online Classrooms, Wordpress | 2026-09-01 | 7.5 High |
| The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform any authorisation check on one of its REST API routes, allowing unauthenticated users to retrieve its stored settings, including the shared secret used to sign API requests to the connected BigBlueButton server. | ||||
| CVE-2026-77008 | 2 Higheredlab, Wordpress | 2 Hel Online Classroom: Ai-powered Online Classrooms, Wordpress | 2026-09-01 | 6.5 Medium |
| The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not have any authorisation or authentication check when saving its settings, allowing unauthenticated users to overwrite them and repoint every online classroom, along with the shared secret those sessions are signed with, at infrastructure of their choosing. | ||||
| CVE-2026-77010 | 2 Higheredlab, Wordpress | 2 Hel Online Classroom: Ai-powered Online Classrooms, Wordpress | 2026-09-01 | 6.5 Medium |
| The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform authorisation checks on its REST API routes and does not consistently enforce the per-class access code, allowing unauthenticated users to obtain a signed meeting join link for any classroom, including one protected by an access code, and to join it with moderator privileges. | ||||
| CVE-2026-77704 | 2 Ameliabooking, Wordpress | 2 Booking For Appointments And Events Calendar, Wordpress | 2026-09-01 | 2.7 Low |
| The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not check that a user holds the required capability before letting them change an appointment's status, allowing customers to set arbitrary statuses on appointments they are booked on, including approving their own bookings that were left awaiting approval and overwriting another customer's booking status on a shared appointment. | ||||
| CVE-2026-81026 | 2 Stylemix, Wordpress | 2 Masterstudy Lms Wordpress Plugin, Wordpress | 2026-09-01 | 4.8 Medium |
| The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.40 does not verify the amount, receiver, currency or status of a payment notification before marking the corresponding order completed, allowing unauthenticated users to complete full-price orders and gain access to paid content by paying only a token amount. | ||||
| CVE-2026-81200 | 2 Stylemix, Wordpress | 2 Masterstudy Lms Wordpress Plugin, Wordpress | 2026-09-01 | 2.7 Low |
| The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.42 does not correctly restrict access to order information, allowing any user with the instructor role to read other users' order billing details, including name, email address, phone number and postal address, by enumerating order IDs. | ||||
| CVE-2026-81342 | 2 Stylemix, Wordpress | 2 Masterstudy Lms Wordpress Plugin, Wordpress | 2026-09-01 | 4.7 Medium |
| The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.43 does not validate a redirect parameter supplied during user registration before using it, allowing unauthenticated attackers to redirect users to arbitrary external URLs. | ||||
| CVE-2026-78364 | 2 Mw Wp Form Project, Wordpress | 2 Mw Wp Form, Wordpress | 2026-09-01 | 3.5 Low |
| The MW WP Form WordPress plugin before 5.1.6 does not sanitise and escape some of its form settings before outputting them back in an admin dashboard page, which could allow users with a role as low as Editor to perform Stored Cross-Site Scripting attacks against high privilege users such as admin. | ||||
| CVE-2026-81756 | 2 E-goi, Wordpress | 2 Smart Marketing Sms And Newsletters Forms, Wordpress | 2026-09-01 | 9.3 Critical |
| Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms <= 5.1.24 versions. | ||||
| CVE-2026-15369 | 2 Addify, Wordpress | 2 Custom User Registration Fields For Woocommerce, Wordpress | 2026-09-01 | 9.8 Critical |
| The Custom User Registration Fields for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.3. This is due to the plugin accepting an attacker-controlled afreg_select_user_role value from the unauthenticated WooCommerce Store API /wc/store/v1/checkout request in the af_reg_checkout_data_to_order_meta_data_block() function, persisting it in order meta, and then passing it directly to WP_User::add_role() in the af_reg_custom_order_processing_function() function (hooked to woocommerce_thankyou) without validating against the plugin's admin-configured allowed role list. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator by creating an account during checkout with a modified JSON body specifying administrator (or any other role slug) as the desired role. Note: The exploit requires the "User Role Selection" setting to be enabled. | ||||
| CVE-2026-81291 | 2 Uncode, Wordpress | 2 Uncode, Wordpress | 2026-09-01 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Uncode <= 2.12.7 versions. | ||||
| CVE-2026-82852 | 2 Mapsvg, Wordpress | 2 Mapsvg, Wordpress | 2026-08-31 | 5.4 Medium |
| Unauthenticated Server Side Request Forgery (SSRF) in MapSVG <= 8.15.0 versions. | ||||