Export limit exceeded: 14365 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (14365 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-48868 | 2 Mra13 / Team Tips And Tricks Hq, Wordpress | 2 Simple Shopping Cart, Wordpress | 2026-06-23 | 7.5 High |
| Unauthenticated Insecure Direct Object References (IDOR) in Simple Shopping Cart <= 5.2.9 versions. | ||||
| CVE-2026-48871 | 2 Takashi Kitajima, Wordpress | 2 Mw Wp Form, Wordpress | 2026-06-23 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in MW WP Form <= 5.1.3 versions. | ||||
| CVE-2026-48876 | 2 Web Guy, Wordpress | 2 Stop Spammers, Wordpress | 2026-06-23 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Stop Spammers <= 2026.3 versions. | ||||
| CVE-2026-48886 | 2 Ahmad, Wordpress | 2 Js Help Desk, Wordpress | 2026-06-23 | 9.3 Critical |
| Unauthenticated SQL Injection in JS Help Desk <= 3.0.9 versions. | ||||
| CVE-2026-48887 | 2 Ahmad, Wordpress | 2 Js Help Desk, Wordpress | 2026-06-23 | 6.5 Medium |
| Unauthenticated Broken Access Control in JS Help Desk <= 3.0.9 versions. | ||||
| CVE-2026-48889 | 2 Tms, Wordpress | 2 Amelia, Wordpress | 2026-06-23 | 8.8 High |
| Subscriber Privilege Escalation in Amelia <= 2.3 versions. | ||||
| CVE-2026-48966 | 2 Funnelkit, Wordpress | 2 Funnel Builder By Funnelkit, Wordpress | 2026-06-23 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Funnel Builder by FunnelKit <= 3.15.0.2 versions. | ||||
| CVE-2026-49063 | 2 Webilia Inc., Wordpress | 2 Listdom, Wordpress | 2026-06-23 | 7.3 High |
| Unauthenticated Privilege Escalation in Listdom <= 5.5.0 versions. | ||||
| CVE-2026-49066 | 2 Conekta Group, Wordpress | 2 Conekta Payment Gateway, Wordpress | 2026-06-23 | 7.5 High |
| Unauthenticated Sensitive Data Exposure in Conekta Payment Gateway <= 6.0.0 versions. | ||||
| CVE-2026-49067 | 2 Wordpress, Yydevelopment | 2 Wordpress, Advanced 301 And 302 Redirect | 2026-06-23 | 9.3 Critical |
| Unauthenticated SQL Injection in Advanced 301 and 302 Redirect <= 1.6.9 versions. | ||||
| CVE-2026-49070 | 2 Knit Pay, Wordpress | 2 Knit Pay, Wordpress | 2026-06-23 | 7.5 High |
| Unauthenticated Broken Access Control in Knit Pay <= 9.4.0.0 versions. | ||||
| CVE-2026-49082 | 2 Chatway Live Chat, Wordpress | 2 Chatway Live Chat – Ai Chatbot, Customer Support, Faq & Helpdesk Customer Service & Chat Buttons, Wordpress | 2026-06-23 | 7.4 High |
| Subscriber Sensitive Data Exposure in Chatway Live Chat – AI Chatbot, Customer Support, FAQ & Helpdesk Customer Service & Chat Buttons <= 1.4.8 versions. | ||||
| CVE-2026-49780 | 2 Dokan, Inc., Wordpress | 2 Dokan, Wordpress | 2026-06-23 | 8.8 High |
| Customer Privilege Escalation in Dokan <= 5.0.2 versions. | ||||
| CVE-2026-52692 | 2 Wordpress, Wp.insider | 2 Wordpress, Affiliates Manager | 2026-06-23 | 7.5 High |
| Unauthenticated Sensitive Data Exposure in Affiliates Manager <= 2.9.50 versions. | ||||
| CVE-2026-52694 | 2 Wordpress, Wp E-signature | 2 Wordpress, Signature Add-on For Woocommerce | 2026-06-23 | 7.5 High |
| Unauthenticated Sensitive Data Exposure in Signature Add-On for WooCommerce <= 2.0 versions. | ||||
| CVE-2026-52695 | 2 Al Monsor, Wordpress | 2 Abc Crypto Checkout, Wordpress | 2026-06-23 | 7.5 High |
| Unauthenticated Sensitive Data Exposure in ABC Crypto Checkout <= 1.8.2 versions. | ||||
| CVE-2026-52700 | 2 Wcmultishipping – Mondial Relay & Chronopost For Wooommerce, Wordpress | 2 Wcmultishipping, Wordpress | 2026-06-23 | 8.5 High |
| Subscriber SQL Injection in WCMultiShipping <= 3.0.2 versions. | ||||
| CVE-2026-52702 | 2 Wordpress, Wp-buy | 2 Wordpress, Seo Redirection | 2026-06-23 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in SEO Redirection <= 9.17 versions. | ||||
| CVE-2026-10780 | 2 Mohammadtanzilurrahman, Wordpress | 2 Static Block, Wordpress | 2026-06-23 | 4.3 Medium |
| The Static Block plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2. This is due to the static_block_content() shortcode handler retrieving a post via get_post() using an attacker-supplied 'id' attribute and outputting its post_content without verifying the post's status (private, draft, pending) or the requesting user's capability to view it. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary posts, including private and draft static blocks (and any other post type) created by administrators, by embedding the [static_block_content id="X"] shortcode in their own content and previewing it. | ||||
| CVE-2026-8443 | 2 Wordpress, Wpreviewslider | 2 Wordpress, Wp Review Slider Pro | 2026-06-23 | 8.8 High |
| The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'stypes' and 'slocations' parameters of the wppro_get_overall_chart_data AJAX action in versions up to, and including, 12.6.8. This is due to the use of stripslashes() on user-supplied JSON strings prior to json_decode(), which removes the escaping applied by WordPress's wp_magic_quotes; the resulting decoded array values are then concatenated directly into SQL WHERE clauses without parameterization, and the constructed query is executed via $wpdb->get_results() without $wpdb->prepare(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The handler also returns the executed SQL string in its JSON response, which simplifies oracle construction for blind exploitation. | ||||