VYPR

CVEs

408,124 total · page 1582 of 8,163

AllCriticalHighKEV
  • CVE-2026-25455MedMar 25, 2026
    WordPress
    Product Slider For Woocommerce
    risk 0.42cvss 6.5epss 0.00

    Missing Authorization vulnerability in PickPlugins Product Slider for WooCommerce woocommerce-products-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Slider for WooCommerce: from n/a through <= 1.13.61.

  • CVE-2026-25454MedMar 25, 2026
    WordPress
    The League
    risk 0.42cvss 6.5epss 0.00

    Missing Authorization vulnerability in MVPThemes The League the-league allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The League: from n/a through <= 4.4.1.

  • CVE-2026-25452HigMar 25, 2026
    WordPress
    Remoji
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDO Remoji remoji allows Stored XSS.This issue affects Remoji: from n/a through <= 2.2.

  • CVE-2026-25447CriMar 25, 2026
    WordPress
    Widget Wrangler
    risk 0.59cvss 9.1epss 0.00

    Improper Control of Generation of Code ('Code Injection') vulnerability in Jonathan Daggerhart Widget Wrangler widget-wrangler allows Code Injection.This issue affects Widget Wrangler: from n/a through <= 2.3.9.

  • CVE-2026-25437MedMar 25, 2026
    WordPress
    GZSEO
    risk 0.42cvss 6.5epss 0.00

    Missing Authorization vulnerability in سید محمدامین هاشمی GZSEO gzseo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GZSEO: from n/a through <= 2.0.14.

  • CVE-2026-25435HigMar 25, 2026
    WordPress
    Booking Calendar Appointment Booking System
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevart Booking calendar, Appointment Booking System booking-calendar allows Stored XSS.This issue affects Booking calendar, Appointment Booking System: from n/a through <=…

  • CVE-2026-25430MedMar 25, 2026
    WordPress
    Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms
    risk 0.42cvss 6.5epss 0.00

    Missing Authorization vulnerability in CRM Perks Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms cf7-mailchimp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Integration for Mailchimp and Contact Form 7,…

  • CVE-2026-25429CriMar 25, 2026
    WordPress
    Nexa Blocks
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in wpdive Nexa Blocks nexa-blocks allows Object Injection.This issue affects Nexa Blocks: from n/a through <= 1.1.1.

  • CVE-2026-25417MedMar 25, 2026
    Metagauss
    Profilegrid
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Stored XSS.This issue affects ProfileGrid : from n/a through <= 5.9.8.1.

  • CVE-2026-25414HigMar 25, 2026
    WordPress
    WPBookit Pro
    risk 0.57cvss 8.8epss 0.00

    Incorrect Privilege Assignment vulnerability in iqonicdesign WPBookit Pro wpbookit-pro allows Privilege Escalation.This issue affects WPBookit Pro: from n/a through <= 1.6.18.

  • CVE-2026-25413CriMar 25, 2026
    WordPress
    WPBookit Pro
    risk 0.64cvss 9.9epss 0.00

    Unrestricted Upload of File with Dangerous Type vulnerability in iqonicdesign WPBookit Pro wpbookit-pro allows Using Malicious Files.This issue affects WPBookit Pro: from n/a through <= 1.6.18.

  • CVE-2026-25406HigMar 25, 2026
    WordPress
    Tutor LMS Pro
    risk 0.53cvss 8.1epss 0.00

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Themeum Tutor LMS Pro tutor-pro allows Authentication Abuse.This issue affects Tutor LMS Pro: from n/a through <= 3.9.4.

  • CVE-2026-25401HigMar 25, 2026
    WordPress
    WPCargo Track & Trace
    risk 0.49cvss 7.5epss 0.00

    Missing Authorization vulnerability in Arni Cinco WPCargo Track & Trace wpcargo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCargo Track & Trace: from n/a through <= 8.0.2.

  • CVE-2026-25400HigMar 25, 2026
    WordPress
    apicona
    risk 0.57cvss 8.8epss 0.00

    Deserialization of Untrusted Data vulnerability in thememount Apicona apicona allows Object Injection.This issue affects Apicona: from n/a through <= 24.1.0.

  • CVE-2026-25398MedMar 25, 2026
    WordPress
    Vertex Addons for Elementor for Elementor
    risk 0.42cvss 6.5epss 0.00

    Missing Authorization vulnerability in Webilia Inc. Vertex Addons for Elementor addons-for-elementor-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Vertex Addons for Elementor: from n/a through <= 1.6.4.

  • CVE-2026-25397HigMar 25, 2026
    WordPress
    File Uploader For Woocommerce
    risk 0.49cvss 7.5epss 0.00

    Path Traversal: '.../...//' vulnerability in Snowray Software File Uploader for WooCommerce file-uploader-for-woocommerce allows Path Traversal.This issue affects File Uploader for WooCommerce: from n/a through <= 1.0.4.

  • CVE-2026-25396HigMar 25, 2026
    WordPress
    Commerce Coinbase For WooCommerce
    risk 0.49cvss 7.5epss 0.00

    Missing Authorization vulnerability in CoderPress Commerce Coinbase For WooCommerce commerce-coinbase-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Commerce Coinbase For WooCommerce: from n/a through <= 1.6.6.

  • CVE-2026-25390MedMar 25, 2026
    WordPress
    New User Approve
    risk 0.42cvss 6.5epss 0.00

    Missing Authorization vulnerability in Saad Iqbal New User Approve new-user-approve allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects New User Approve: from n/a through <= 3.2.3.

  • CVE-2026-25383HigMar 25, 2026
    Iqonic Design
    kivicare-clinic-management-system
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows Reflected XSS.This issue affects KiviCare: from n/a through <= 3.6.16.

  • CVE-2026-25382HigMar 25, 2026
    WordPress
    IdealAuto
    risk 0.53cvss 8.1epss 0.00

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes IdealAuto idealauto allows PHP Local File Inclusion.This issue affects IdealAuto: from n/a through < 3.8.6.

  • CVE-2026-25381HigMar 25, 2026
    WordPress
    LoveDate
    risk 0.53cvss 8.1epss 0.00

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes LoveDate lovedate allows PHP Local File Inclusion.This issue affects LoveDate: from n/a through < 3.8.6.

  • CVE-2026-25380HigMar 25, 2026
    WordPress
    Feedy
    risk 0.53cvss 8.1epss 0.00

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes Feedy feedy allows PHP Local File Inclusion.This issue affects Feedy: from n/a through < 2.1.5.

  • CVE-2026-25379HigMar 25, 2026
    WordPress
    StreamVid
    risk 0.53cvss 8.1epss 0.00

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes StreamVid streamvid allows PHP Local File Inclusion.This issue affects StreamVid: from n/a through < 6.8.6.

  • CVE-2026-25377CriMar 25, 2026
    WordPress
    Addon Jobsearch Chat
    risk 0.60cvss 9.3epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in eyecix Addon Jobsearch Chat addon-jobsearch-chat allows SQL Injection.This issue affects Addon Jobsearch Chat: from n/a through <= 3.0.

  • CVE-2026-25376HigMar 25, 2026
    WordPress
    Addon Jobsearch Chat
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eyecix Addon Jobsearch Chat addon-jobsearch-chat allows Reflected XSS.This issue affects Addon Jobsearch Chat: from n/a through <= 3.0.

  • CVE-2026-25373HigMar 25, 2026
    WordPress
    Vayvo
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ProgressionStudios Vayvo vayvo-progression allows Reflected XSS.This issue affects Vayvo: from n/a through < 6.8.

  • CVE-2026-25371CriMar 25, 2026
    King Theme
    Lumise Product Designer
    risk 0.60cvss 9.3epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in King-Theme Lumise Product Designer lumise allows Blind SQL Injection.This issue affects Lumise Product Designer: from n/a through < 2.0.9.

  • CVE-2026-25366CriMar 25, 2026
    Themeisle
    Woody ad snippets
    risk 0.64cvss 9.9epss 0.00

    Improper Control of Generation of Code ('Code Injection') vulnerability in Themeisle Woody ad snippets insert-php allows Code Injection.This issue affects Woody ad snippets: from n/a through <= 2.7.1.

  • CVE-2026-25365MedMar 25, 2026
    WordPress
    Kargo Takip
    risk 0.42cvss 6.5epss 0.00

    Missing Authorization vulnerability in Özgür KARALAR Kargo Takip kargo-takip-turkiye allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kargo Takip: from n/a through < 0.2.4.

  • CVE-2026-25361HigMar 25, 2026
    WordPress
    Wpevently
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in magepeopleteam WpEvently mage-eventpress allows Reflected XSS.This issue affects WpEvently: from n/a through <= 5.1.4.

  • CVE-2026-25360HigMar 25, 2026
    WordPress
    Vex
    risk 0.57cvss 8.8epss 0.00

    Deserialization of Untrusted Data vulnerability in rascals Vex vex allows Object Injection.This issue affects Vex: from n/a through < 1.2.9.

  • CVE-2026-25359HigMar 25, 2026
    WordPress
    Pendulum
    risk 0.57cvss 8.8epss 0.00

    Deserialization of Untrusted Data vulnerability in rascals Pendulum pendulum allows Object Injection.This issue affects Pendulum: from n/a through < 3.1.5.

  • CVE-2026-25358HigMar 25, 2026
    WordPress
    Meloo
    risk 0.57cvss 8.8epss 0.00

    Deserialization of Untrusted Data vulnerability in rascals Meloo meloo allows Object Injection.This issue affects Meloo: from n/a through < 2.8.2.

  • CVE-2026-25357HigMar 25, 2026
    WordPress
    Ultimate Membership Pro
    risk 0.53cvss 8.1epss 0.00

    Authentication Bypass Using an Alternate Path or Channel vulnerability in azzaroco Ultimate Membership Pro indeed-membership-pro allows Authentication Abuse.This issue affects Ultimate Membership Pro: from n/a through <= 13.7.

  • CVE-2026-25356HigMar 25, 2026
    WordPress
    Yobazar
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Yobazar yobazar allows Reflected XSS.This issue affects Yobazar: from n/a through < 1.6.7.

  • CVE-2026-25355MedMar 25, 2026
    WordPress
    Sanzo
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Sanzo sanzo allows Stored XSS.This issue affects Sanzo: from n/a through < 2.4.3.

  • CVE-2026-25354HigMar 25, 2026
    WordPress
    Reebox
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Reebox reebox allows Reflected XSS.This issue affects Reebox: from n/a through < 1.4.8.

  • CVE-2026-25353HigMar 25, 2026
    WordPress
    Nooni
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Nooni nooni allows Reflected XSS.This issue affects Nooni: from n/a through < 1.5.1.

  • CVE-2026-25352HigMar 25, 2026
    WordPress
    MyDecor
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup MyDecor mydecor allows Reflected XSS.This issue affects MyDecor: from n/a through < 1.5.9.

  • CVE-2026-25351HigMar 25, 2026
    WordPress
    MyMedi
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup MyMedi mymedi allows Reflected XSS.This issue affects MyMedi: from n/a through < 1.7.7.

  • CVE-2026-25350HigMar 25, 2026
    WordPress
    Miti
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Miti miti allows Reflected XSS.This issue affects Miti: from n/a through < 1.5.3.

  • CVE-2026-25349HigMar 25, 2026
    WordPress
    Loobek
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Loobek loobek allows Reflected XSS.This issue affects Loobek: from n/a through < 1.5.2.

  • CVE-2026-25347HigMar 25, 2026
    WordPress
    WP REST Cache
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Acato WP REST Cache wp-rest-cache allows Stored XSS.This issue affects WP REST Cache: from n/a through <= 2026.1.0.

  • CVE-2026-25346HigMar 25, 2026
    WordPress
    Faq Builder Ays
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro FAQ Builder AYS faq-builder-ays allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FAQ Builder AYS: from n/a through <= 1.8.2.

  • CVE-2026-25345CriMar 25, 2026
    WordPress
    Simply Gallery Block
    risk 0.64cvss 9.9epss 0.00

    Improper Validation of Specified Quantity in Input vulnerability in GalleryCreator SimpLy Gallery simply-gallery-block allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects SimpLy Gallery: from n/a through <= 3.3.2.

  • CVE-2026-25344MedMar 25, 2026
    WordPress
    Review Schema
    risk 0.42cvss 6.5epss 0.00

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in RadiusTheme Review Schema review-schema allows Retrieve Embedded Sensitive Data.This issue affects Review Schema: from n/a through <= 2.2.6.

  • CVE-2026-25342HigMar 25, 2026
    WordPress
    Kute Boutique
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kutethemes Boutique kute-boutique allows Reflected XSS.This issue affects Boutique: from n/a through < 2.4.6.

  • CVE-2026-25341HigMar 25, 2026
    WordPress
    Rsfirewall
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RSJoomla! RSFirewall! rsfirewall allows Stored XSS.This issue affects RSFirewall!: from n/a through <= 1.1.45.

  • CVE-2026-25340CriMar 25, 2026
    WordPress
    Noo Jobmonster
    risk 0.60cvss 9.3epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NooTheme Jobmonster noo-jobmonster allows Blind SQL Injection.This issue affects Jobmonster: from n/a through < 4.8.4.

  • CVE-2026-25339MedMar 25, 2026
    WordPress
    WPForms Contact Form
    risk 0.42cvss 6.5epss 0.00

    Insertion of Sensitive Information Into Sent Data vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Retrieve Embedded Sensitive Data.This issue affects Contact Form by WPForms: from n/a through <= 1.9.8.7.