VYPR

CVEs

408,124 total · page 1583 of 8,163

AllCriticalHighKEV
  • CVE-2026-25334HigMar 25, 2026
    WordPress
    Salon Booking System Pro
    risk 0.53cvss 8.1epss 0.00

    Incorrect Privilege Assignment vulnerability in wordpresschef Salon Booking System Pro salon-booking-plugin-pro allows Privilege Escalation.This issue affects Salon Booking System Pro: from n/a through < 10.30.12.

  • CVE-2026-25328MedMar 25, 2026
    WordPress
    Product File Upload for WooCommerce
    risk 0.44cvss 6.8epss 0.00

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in add-ons.org Product File Upload for WooCommerce products-file-upload-for-woocommerce allows Path Traversal.This issue affects Product File Upload for WooCommerce: from n/a through <=…

  • CVE-2026-25327MedMar 25, 2026
    Rustaurius
    Five Star Restaurant Reservations
    risk 0.42cvss 6.5epss 0.00

    Missing Authorization vulnerability in Rustaurius Five Star Restaurant Reservations restaurant-reservations allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Five Star Restaurant Reservations: from n/a through <= 2.7.9.

  • CVE-2026-25317HigMar 25, 2026
    WordPress
    Print Invoice & Delivery Notes for WooCommerce
    risk 0.49cvss 7.5epss 0.00

    Missing Authorization vulnerability in tychesoftwares Print Invoice & Delivery Notes for WooCommerce woocommerce-delivery-notes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Print Invoice & Delivery Notes for WooCommerce: from n/a…

  • CVE-2026-25309HigMar 25, 2026
    WordPress
    Publishpress Authors
    risk 0.49cvss 7.5epss 0.00

    Missing Authorization vulnerability in PublishPress PublishPress Authors publishpress-authors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PublishPress Authors: from n/a through <= 4.10.1.

  • CVE-2026-25306HigMar 25, 2026
    WordPress
    Xstore Core
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore Core et-core-plugin allows Reflected XSS.This issue affects XStore Core: from n/a through <= 5.6.4.

  • CVE-2026-25304HigMar 25, 2026
    WordPress
    Jaroti
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Jaroti jaroti allows Reflected XSS.This issue affects Jaroti: from n/a through < 1.4.8.

  • CVE-2026-25035CriMar 25, 2026
    WordPress
    Contest Gallery
    risk 0.64cvss 9.8epss 0.00

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Authentication Abuse.This issue affects Contest Gallery: from n/a through <= 28.1.2.2.

  • CVE-2026-25034MedMar 25, 2026
    Iqonic Design
    kivicare-clinic-management-system
    risk 0.42cvss 6.5epss 0.00

    Missing Authorization vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects KiviCare: from n/a through <= 3.6.16.

  • CVE-2026-25033HigMar 25, 2026
    WordPress
    Motta Addons
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uixthemes Motta Addons motta-addons allows Reflected XSS.This issue affects Motta Addons: from n/a through < 1.6.1.

  • CVE-2026-25032CriMar 25, 2026
    WordPress
    Ricky
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in park_of_ideas Ricky ricky allows Object Injection.This issue affects Ricky: from n/a through < 2.31.

  • CVE-2026-25031CriMar 25, 2026
    WordPress
    Tasty Daily
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in park_of_ideas Tasty Daily tastydaily allows Object Injection.This issue affects Tasty Daily: from n/a through < 1.27.

  • CVE-2026-25030CriMar 25, 2026
    WordPress
    Goldish
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in park_of_ideas Goldish goldish allows Object Injection.This issue affects Goldish: from n/a through < 3.47.

  • CVE-2026-25029CriMar 25, 2026
    WordPress
    KIDZ
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in park_of_ideas KIDZ kidz allows Object Injection.This issue affects KIDZ: from n/a through <= 5.24.

  • CVE-2026-25026HigMar 25, 2026
    WordPress
    tlp-team
    risk 0.49cvss 7.5epss 0.00

    Missing Authorization vulnerability in RadiusTheme Team tlp-team allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Team: from n/a through <= 5.0.11.

  • CVE-2026-25025HigMar 25, 2026
    WordPress
    Vikrestaurants
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRestaurants vikrestaurants allows Reflected XSS.This issue affects VikRestaurants: from n/a through <= 1.5.2.

  • CVE-2026-25018HigMar 25, 2026
    WordPress
    NaturaLife Extensions
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in stmcan NaturaLife Extensions naturalife-extensions allows Reflected XSS.This issue affects NaturaLife Extensions: from n/a through <= 2.1.

  • CVE-2026-25017HigMar 25, 2026
    WordPress
    NaturaLife Extensions
    risk 0.53cvss 8.1epss 0.00

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in stmcan NaturaLife Extensions naturalife-extensions allows PHP Local File Inclusion.This issue affects NaturaLife Extensions: from n/a through <= 2.1.

  • CVE-2026-25013HigMar 25, 2026
    WordPress
    Phox Hosting
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WHMCSdes Phox Hosting phox-host allows Reflected XSS.This issue affects Phox Hosting: from n/a through <= 2.0.8.

  • CVE-2026-25009MedMar 25, 2026
    WordPress
    Education Zone
    risk 0.42cvss 6.5epss 0.00

    Missing Authorization vulnerability in raratheme Education Zone education-zone allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Education Zone: from n/a through <= 1.3.8.

  • CVE-2026-25007HigMar 25, 2026
    WordPress
    Elementinvader Addons For Elementor
    risk 0.55cvss 8.5epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows Blind SQL Injection.This issue affects ElementInvader Addons for Elementor: from…

  • CVE-2026-25002HigMar 25, 2026
    WordPress
    LearnPress – Sepay Payment
    risk 0.49cvss 7.5epss 0.00

    Authentication Bypass Using an Alternate Path or Channel vulnerability in ThimPress LearnPress – Sepay Payment learnpress-sepay-payment allows Authentication Abuse.This issue affects LearnPress – Sepay Payment: from n/a through <= 4.0.0.

  • CVE-2026-25001HigMar 25, 2026
    WordPress
    Post Snippets
    risk 0.55cvss 8.5epss 0.00

    Improper Control of Generation of Code ('Code Injection') vulnerability in Saad Iqbal Post Snippets post-snippets allows Remote Code Inclusion.This issue affects Post Snippets: from n/a through <= 4.0.12.

  • CVE-2026-24993CriMar 25, 2026
    WordPress
    Advanced WooCommerce Product Sales Reporting
    risk 0.60cvss 9.3epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Advanced WooCommerce Product Sales Reporting webd-woocommerce-advanced-reporting-statistics allows Blind SQL Injection.This issue affects Advanced WooCommerce Product…

  • CVE-2026-24989CriMar 25, 2026
    WordPress
    SUMO Affiliates Pro
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in FantasticPlugins SUMO Affiliates Pro affs allows Object Injection.This issue affects SUMO Affiliates Pro: from n/a through < 11.4.0.

  • CVE-2026-24987MedMar 25, 2026
    WordPress
    WP System Log
    risk 0.42cvss 6.5epss 0.00

    Missing Authorization vulnerability in activity-log.com WP System Log winterlock allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP System Log: from n/a through <= 1.2.7.

  • CVE-2026-24983HigMar 25, 2026
    Upsolution
    UpSolution Core
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UpSolution UpSolution Core us-core allows Reflected XSS.This issue affects UpSolution Core: from n/a through <= 8.41.

  • CVE-2026-24981HigMar 25, 2026
    WordPress
    Visionary Core
    risk 0.57cvss 8.8epss 0.00

    Deserialization of Untrusted Data vulnerability in NooTheme Visionary Core noo-visionary-core allows Object Injection.This issue affects Visionary Core: from n/a through <= 1.4.9.

  • CVE-2026-24980HigMar 25, 2026
    WordPress
    Visionary Core
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Visionary Core noo-visionary-core allows Reflected XSS.This issue affects Visionary Core: from n/a through <= 1.4.9.

  • CVE-2026-24979HigMar 25, 2026
    WordPress
    Jobica Core
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Jobica Core jobica-core allows Reflected XSS.This issue affects Jobica Core: from n/a through <= 1.4.1.

  • CVE-2026-24978HigMar 25, 2026
    WordPress
    Jobica Core
    risk 0.57cvss 8.8epss 0.00

    Deserialization of Untrusted Data vulnerability in NooTheme Jobica Core jobica-core allows Object Injection.This issue affects Jobica Core: from n/a through <= 1.4.1.

  • CVE-2026-24977HigMar 25, 2026
    WordPress
    Organici Library
    risk 0.55cvss 8.5epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NooTheme Organici Library noo-organici-library allows Blind SQL Injection.This issue affects Organici Library: from n/a through <= 2.1.2.

  • CVE-2026-24976HigMar 25, 2026
    WordPress
    Organici Library
    risk 0.57cvss 8.8epss 0.00

    Deserialization of Untrusted Data vulnerability in NooTheme Organici Library noo-organici-library allows Object Injection.This issue affects Organici Library: from n/a through <= 2.1.2.

  • CVE-2026-24975HigMar 25, 2026
    WordPress
    Organici Library
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Organici Library noo-organici-library allows Reflected XSS.This issue affects Organici Library: from n/a through <= 2.1.2.

  • CVE-2026-24974HigMar 25, 2026
    WordPress
    noo-citilights
    risk 0.57cvss 8.8epss 0.00

    Deserialization of Untrusted Data vulnerability in NooTheme CitiLights noo-citilights allows Object Injection.This issue affects CitiLights: from n/a through <= 3.7.1.

  • CVE-2026-24973HigMar 25, 2026
    WordPress
    CitiLights
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme CitiLights noo-citilights allows Reflected XSS.This issue affects CitiLights: from n/a through <= 3.7.1.

  • CVE-2026-24972MedMar 25, 2026
    WordPress
    Elated Listing
    risk 0.42cvss 6.5epss 0.00

    Missing Authorization vulnerability in Elated-Themes Elated Listing eltd-listing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elated Listing: from n/a through <= 1.4.

  • CVE-2026-24971CriMar 25, 2026
    WordPress
    Search & Go
    risk 0.64cvss 9.8epss 0.00

    Incorrect Privilege Assignment vulnerability in Elated-Themes Search & Go searchgo allows Privilege Escalation.This issue affects Search & Go: from n/a through <= 2.8.

  • CVE-2026-24970HigMar 25, 2026
    WordPress
    Energox
    risk 0.50cvss 7.7epss 0.00

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in designingmedia Energox energox allows Path Traversal.This issue affects Energox: from n/a through <= 1.2.

  • CVE-2026-24969HigMar 25, 2026
    WordPress
    Instant VA
    risk 0.50cvss 7.7epss 0.00

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in designingmedia Instant VA instantva allows Path Traversal.This issue affects Instant VA: from n/a through <= 1.0.1.

  • CVE-2026-24968CriMar 25, 2026
    WordPress
    Xagio Seo
    risk 0.64cvss 9.8epss 0.00

    Incorrect Privilege Assignment vulnerability in Xagio SEO Xagio SEO xagio-seo allows Privilege Escalation.This issue affects Xagio SEO: from n/a through <= 7.1.0.30.

  • CVE-2026-24964MedMar 25, 2026
    WordPress
    Contest Gallery
    risk 0.42cvss 6.4epss 0.00

    Server-Side Request Forgery (SSRF) vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Server Side Request Forgery.This issue affects Contest Gallery: from n/a through <= 28.1.2.1.

  • CVE-2026-24391HigMar 25, 2026
    WordPress
    Cardealer
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeMakers Car Dealer cardealer allows Reflected XSS.This issue affects Car Dealer: from n/a through <= 1.6.7.

  • CVE-2026-24382HigMar 25, 2026
    WordPress
    News Magazine X
    risk 0.49cvss 7.5epss 0.00

    Missing Authorization vulnerability in wproyal News Magazine X news-magazine-x allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects News Magazine X: from n/a through <= 1.2.50.

  • CVE-2026-24378CriMar 25, 2026
    WordPress
    Eventprime
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Object Injection.This issue affects EventPrime: from n/a through <= 4.2.8.0.

  • CVE-2026-24376MedMar 25, 2026
    WordPress
    WPVulnerability
    risk 0.42cvss 6.5epss 0.00

    Missing Authorization vulnerability in Javier Casares WPVulnerability wpvulnerability allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPVulnerability: from n/a through <= 4.2.1.

  • CVE-2026-24373HigMar 25, 2026
    WordPress
    Registrationmagic
    risk 0.53cvss 8.1epss 0.00

    Incorrect Privilege Assignment vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-submission-manager allows Privilege Escalation.This issue affects RegistrationMagic: from n/a through <= 6.0.7.1.

  • CVE-2026-24372HigMar 25, 2026
    WordPress
    Woocommerce Subscriptions
    risk 0.49cvss 7.5epss 0.00

    Authentication Bypass by Spoofing vulnerability in WP Swings Subscriptions for WooCommerce subscriptions-for-woocommerce allows Input Data Manipulation.This issue affects Subscriptions for WooCommerce: from n/a through <= 1.8.10.

  • CVE-2026-24370MedMar 25, 2026
    WordPress
    The Grid
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeOne The Grid allows Stored XSS. This issue affects The Grid: from n/a through 2.8.0.

  • CVE-2026-24369HigMar 25, 2026
    WordPress
    The Grid
    risk 0.46cvss 7.1epss 0.00

    Missing Authorization vulnerability in Theme-one The Grid the-grid allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Grid: from n/a through < 2.8.0.