VYPR
← WordPress

Vendor CVEs

WordPress

All CVEs

40,071 total · sorted by risk
  • CVE-2026-39726HigOct 6, 2026
    WordPress
    Lumise Product Designer
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Lumise Product Designer <= 2.1.1 versions.

  • CVE-2026-39724HigOct 6, 2026
    WordPress
    HTTP Requests Manager
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in HTTP Requests Manager <= 1.3.11 versions.

  • CVE-2026-39722HigOct 6, 2026
    WordPress
    WPLMS
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in WPLMS <= 4.972 versions.

  • CVE-2026-39720HigOct 6, 2026
    WordPress
    Mapster Wp Maps
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Mapster WP Maps <= 2.0.4 versions.

  • CVE-2026-32581HigOct 6, 2026
    WordPress
    Mooberry Book Manager
    risk 0.46cvss 7.1epss 0.00

    Subscriber SQL Injection in Mooberry Book Manager 4.16.2 versions.

  • CVE-2026-32578HigOct 6, 2026
    WordPress
    Ecpay Ecommerce For Woocommerce
    risk 0.46cvss 7.1epss 0.00

    Subscriber Broken Access Control in ECPay Ecommerce for WooCommerce <= 1.1.2606090 versions.

  • CVE-2026-32577HigOct 6, 2026
    WordPress
    Frontend File Manager
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Frontend File Manager <= 23.6 versions.

  • CVE-2026-32575HigOct 6, 2026
    WordPress
    SUMO Affiliates Pro
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in SUMO Affiliates Pro <= 11.7.0 versions.

  • CVE-2026-32574HigOct 6, 2026
    WordPress
    Smart Forms
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EDGARROJAS Smart Forms smart-forms allows DOM-Based XSS.This issue affects Smart Forms: from n/a through 2.6.104.

  • CVE-2026-32572HigOct 6, 2026
    WordPress
    Wp User Frontend
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in WP User Frontend Pro <= 4.2.13 versions.

  • CVE-2026-32570HigOct 6, 2026
    WordPress
    Progressify
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Progressify - Progressive Web App (PWA) <= 1.6.0 versions.

  • CVE-2026-32569HigOct 6, 2026
    WordPress
    Wp Media Folder
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in WP Media folder <= 6.2.2 versions.

  • CVE-2026-25433HigOct 6, 2026
    WordPress
    Wp2leads
    risk 0.46cvss 7.1epss 0.00

    Subscriber Broken Access Control in WP2LEADS <= 3.5.7 versions.

  • CVE-2026-105061HigOct 6, 2026
    WordPress
    Wp Mailster
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in WP Mailster <= 1.9.0.0 versions.

  • CVE-2026-104814HigOct 6, 2026
    WordPress
    Form block
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Form Block <= 1.8.1 versions.

  • CVE-2026-104672HigOct 6, 2026
    WordPress
    Givewp
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions.

  • CVE-2026-104670HigOct 6, 2026
    WordPress
    Learnpress
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in LearnPress <= 4.4.9 versions.

  • CVE-2026-104395HigOct 6, 2026
    WordPress
    Picu
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in picu <= 3.10.1 versions.

  • CVE-2026-104394HigOct 6, 2026
    WordPress
    Charitable
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions.

  • CVE-2026-103346HigOct 6, 2026
    WordPress
    Payflex Payment Gateway
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomlister Payflex Payment Gateway payflex-payment-gateway allows Reflected XSS.This issue affects Payflex Payment Gateway: from n/a through 2.7.1.

  • CVE-2026-39760HigOct 6, 2026
    WordPress
    Real3D Flipbook
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Real 3D FlipBook <= 5.5 versions.

  • CVE-2026-97309HigOct 5, 2026
    WordPress
    Repairbuddy
    risk 0.46cvss —epss 0.00

    Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Retrieve Embedded Sensitive Data.This issue affects RepairBuddy: from n/a through 4.1226.

  • CVE-2026-100515HigOct 5, 2026
    WordPress
    Woocommerce Photo Reviews
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Photo Reviews for WooCommerce woo-photo-reviews allows Reflected XSS.This issue affects Photo Reviews for WooCommerce: from n/a through 1.2.30.

  • CVE-2025-15643HigOct 5, 2026
    WordPress
    Adsensei B30
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jose Fernandez Adsmonetizer adsensei-b30 allows Reflected XSS.This issue affects Adsmonetizer: from n/a through 3.2.4.

  • CVE-2026-104407HigOct 5, 2026
    WordPress
    PowerPress Podcasting plugin
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Cross Site Request Forgery.This issue affects PowerPress Podcasting: from n/a through 11.17.9.

  • CVE-2026-103354HigOct 4, 2026
    WordPress
    Gutenberg Blocks by Kadence Blocks
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.7.11.1.

  • CVE-2026-103062HigOct 4, 2026
    WordPress
    TranslatePress
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allows Stored XSS.This issue affects TranslatePress: from n/a through 3.3.6.

  • CVE-2026-94505HigOct 3, 2026
    WordPress
    Nelio Content
    risk 0.46cvss 8.1epss 0.00

    The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes…

  • CVE-2026-97273HigOct 1, 2026
    WordPress
    Premmerce Woocommerce Wishlist
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions.

  • CVE-2026-97268HigOct 1, 2026
    WordPress
    Premmerce Woocommerce Wishlist
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions.

  • CVE-2026-97260HigOct 1, 2026
    WordPress
    Maxgalleria
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in MaxGalleria <= 6.5.3 versions.

  • CVE-2026-102378HigOct 1, 2026
    WordPress
    Parallax Section block
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Parallax Section block <= 2.0.4 versions.

  • CVE-2026-15983HigOct 1, 2026
    WordPress
    Super Forms
    risk 0.46cvss 8.1epss 0.01

    The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File/Directory Deletion in all versions up to, and including, 6.3.316. This is due to the `super_save_form` AJAX handler performing no capability check — allowing Subscriber-level…

  • CVE-2026-92412HigOct 1, 2026
    WordPress
    Five Star Restaurant Reviews
    risk 0.46cvss 7.1epss 0.00

    The Five Star Restaurant Reviews WordPress plugin before 2.3.14 does not properly escape a user-supplied value before outputting it into an HTML tag, allowing unauthenticated attackers to inject arbitrary web script that runs in the browser of anyone tricked into submitting a…

  • CVE-2026-97290HigSep 30, 2026
    WordPress
    Photonic Gallery & Lightbox for Flickr, SmugMug & Others
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.36 versions.

  • CVE-2026-94171HigSep 30, 2026
    WordPress
    Woo Multi Currency
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme CURCY woo-multi-currency allows DOM-Based XSS.This issue affects CURCY: 2.2.18.

  • CVE-2026-102391HigSep 30, 2026
    WordPress
    Jetformbuilder
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.4 versions.

  • CVE-2026-102376HigSep 30, 2026
    WordPress
    Branda
    risk 0.46cvss 7.1epss 0.00

    Subscriber Cross Site Scripting (XSS) in Branda <= 3.4.32 versions.

  • CVE-2026-100510HigSep 30, 2026
    WordPress
    Post And Page Builder By Boldgrid
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Post and Page Builder by BoldGrid <= 1.27.14 versions.

  • CVE-2026-97289HigSep 30, 2026
    Expresstech
    Quiz And Survey Master
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows DOM-Based XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.6.

  • CVE-2026-97272HigSep 30, 2026
    WordPress
    Premmerce Permalink Manager for WooCommerce
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Premmerce Permalink Manager for WooCommerce <= 2.3.13 versions.

  • CVE-2026-97271HigSep 30, 2026
    WordPress
    Wpfunnels
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.

  • CVE-2026-97253HigSep 30, 2026
    WordPress
    Layerslider
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kreatura LayerSlider allows Reflected XSS. This issue affects LayerSlider: from n/a through 8.4.0.

  • CVE-2026-97250HigSep 30, 2026
    WordPress
    Geo Mashup
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions.

  • CVE-2026-97237HigSep 30, 2026
    WordPress
    Jetengine
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through 3.8.14.3.

  • CVE-2026-97235HigSep 30, 2026
    WordPress
    ThemeREX Addons
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.

  • CVE-2026-97077HigSep 30, 2026
    WordPress
    AD Inserter
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.18 versions.

  • CVE-2026-97065HigSep 30, 2026
    WordPress
    Happyforms
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Happyforms <= 1.26.15 versions.

  • CVE-2026-96836HigSep 30, 2026
    WordPress
    Parsi Date
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Parsi Date <= 6.3 versions.

  • CVE-2026-96830HigSep 30, 2026
    WordPress
    Givewp
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.9 versions.

Page 194 of 802