Export limit exceeded: 15789 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (15789 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-84765 | 2 John Havlik, Wordpress | 2 Breadcrumb Navxt, Wordpress | 2026-09-04 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Breadcrumb NavXT <= 7.5.1 versions. | ||||
| CVE-2026-84767 | 2 Nexcess, Wordpress | 2 Bookit, Wordpress | 2026-09-04 | 5.3 Medium |
| Unauthenticated Bypass Vulnerability in BookIt <= 2.6.0.3 versions. | ||||
| CVE-2026-84773 | 2 Wordpress, 作者 | 2 Wordpress, Shane Bishop:ewww Image Optimizer | 2026-09-04 | 7.2 High |
| Unauthenticated Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.6 versions. | ||||
| CVE-2026-84776 | 2 Malcare, Wordpress | 2 Malcare Security, Wordpress | 2026-09-04 | 7.5 High |
| Unauthenticated Denial of Service Attack in MalCare Security <= 6.69 versions. | ||||
| CVE-2026-84778 | 2 Migrateguru, Wordpress | 2 Migrate Guru – Site Migration & Cloning, Wordpress | 2026-09-04 | 7.5 High |
| Unauthenticated Denial of Service Attack in Migrate Guru – Site Migration & Cloning <= 6.65 versions. | ||||
| CVE-2026-84779 | 2 Sheikh Heera, Wordpress | 2 Agentimus – Ai Seo, Llms.txt & Mcp For Ai Agents, Wordpress | 2026-09-04 | 8.1 High |
| Subscriber Broken Access Control in Agentimus – AI SEO, llms.txt & MCP for AI Agents <= 1.51.0 versions. | ||||
| CVE-2026-84836 | 2 Kirillbdev, Wordpress | 2 Wc Ukraine Shipping, Wordpress | 2026-09-04 | 7.1 High |
| Subscriber Insecure Direct Object References (IDOR) in WC Ukraine Shipping <= 1.22.3 versions. | ||||
| CVE-2026-84848 | 2 Brightvesseldev, Wordpress | 2 Quick Event Manager, Wordpress | 2026-09-04 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Quick Event Manager <= 9.17 versions. | ||||
| CVE-2026-85307 | 2 Kevin Pirnie, Wordpress | 2 Kp Agent Ready, Wordpress | 2026-09-04 | 5.3 Medium |
| Insertion of Sensitive Information Into Sent Data vulnerability in Kevin Pirnie KP Agent Ready allows Retrieve Embedded Sensitive Data. This issue affects KP Agent Ready: from n/a before 1.2.08. | ||||
| CVE-2026-11613 | 2 Divi Engine, Wordpress | 2 Divi Ajax Filter, Wordpress | 2026-09-04 | 9.8 Critical |
| The Divi Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.1.2 via the 'custom_loop_template' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. This vulnerability is only exploitable when the loop_templates parameter is set to 'custom-template'. | ||||
| CVE-2026-79632 | 2 Getwpfunnels, Wordpress | 2 Wpfunnels, Wordpress | 2026-09-04 | 5.3 Medium |
| The WPFunnels WordPress plugin before 3.13.0 does not perform any authorisation or nonce check in one of its opt-in submission handlers, and takes the notification recipients and subject from the request, allowing unauthenticated users to make the site send emails to arbitrary recipients with an arbitrary subject. | ||||
| CVE-2026-82194 | 2 Wordpress, Wpvividplugins | 2 Wordpress, Wpvivid — Backup, Migration & Staging | 2026-09-04 | 5.5 Medium |
| The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied path before using it in a file deletion routine, allowing administrators to delete arbitrary files on the server, including files outside the web root. | ||||
| CVE-2026-84146 | 2 Wordpress, Xpro | 2 Wordpress, Xpro Addons — 140+ Widgets For Elementor | 2026-09-04 | 5.3 Medium |
| The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.8 does not perform any capability or post-status check before rendering a WooCommerce product summary from a supplied product identifier, allowing unauthenticated visitors to retrieve the title, price, SKU, description and stock details of products that are not publicly published (draft, pending, private or scheduled status). | ||||
| CVE-2026-85306 | 2 Cascadiawebservices, Wordpress | 2 Mountdev Ai Mcp Connector For Wordpress, Wordpress | 2026-09-04 | 6.5 Medium |
| Missing Authorization vulnerability in Cascadia Web Services MountDev AI MCP Connector for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MountDev AI MCP Connector for WordPress: from n/a through 1.6.5. | ||||
| CVE-2026-84813 | 2 Paolo, Wordpress | 2 Geodirectory, Wordpress | 2026-09-04 | 9.3 Critical |
| Unauthenticated SQL Injection in GeoDirectory <= 2.8.174 versions. | ||||
| CVE-2026-84761 | 2 Litespeed Technologies, Wordpress | 2 Litespeed Cache, Wordpress | 2026-09-04 | 7.2 High |
| Unauthenticated Server Side Request Forgery (SSRF) in LiteSpeed Cache <= 7.9 versions. | ||||
| CVE-2026-81347 | 2 Dynamiapps, Wordpress | 2 Frontend Admin By Dynamiapps, Wordpress | 2026-09-04 | 5.9 Medium |
| The Frontend Admin by DynamiApps WordPress plugin before 3.29.13 does not properly validate a user-controllable directory path before deleting files within it, allowing unauthenticated attackers to delete index.php and .htaccess files outside the intended directory, including the WordPress root, which can render the site inoperable. Successful exploitation requires a non-default form configuration. | ||||
| CVE-2026-80438 | 2 Ninjaforms, Wordpress | 2 Ninja Forms, Wordpress | 2026-09-04 | 5.9 Medium |
| The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a Ninja Forms WordPress plugin before 3.15.2-specific capability as equivalent to full site administration, which allows any user granted that capability to read Ninja Forms WordPress plugin before 3.15.2 settings and stored form submissions, overwrite the Ninja Forms WordPress plugin before 3.15.2's configuration, and create or modify arbitrary posts and pages. The capability belongs to no default WordPress role and the Ninja Forms WordPress plugin before 3.15.2 never grants it, so an administrator must have assigned it, typically when delegating access to the form builder. | ||||
| CVE-2026-27086 | 2 Wordpress, Xtemos | 2 Wordpress, Woodmart | 2026-09-04 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xtemos WoodMart allows DOM-Based XSS. This issue affects WoodMart: from n/a before 8.3.8. | ||||
| CVE-2026-84780 | 2 Wordpress, Wpgmaps | 2 Wordpress, Wp Go Maps | 2026-09-04 | 5.3 Medium |
| Unauthenticated Denial of Service Attack in WP Go Maps <= 10.1.08 versions. | ||||