Vendor CVEs
WordPress
All CVEs
40,071 total · sorted by risk| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-81781 | Hig | 0.46 | 7.1 | 0.00 | Sep 8, 2026 | Missing Authorization vulnerability in Unbounce Unbounce Landing Pages unbounce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unbounce Landing Pages: from n/a through 1.1.4. | ||
| CVE-2026-81404 | Hig | 0.46 | 7.1 | 0.00 | Sep 5, 2026 | The IPGP Visitors Origin WordPress plugin before 1.6 does not sanitise or escape user input before reflecting it back in the HTTP response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who are tricked into submitting a… | ||
| CVE-2026-16281 | Hig | 0.46 | 7.1 | 0.00 | Sep 4, 2026 | The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes or attaches media, allowing any authenticated user, including a subscriber, to permanently delete attachments… | ||
| CVE-2026-84848 | Hig | 0.46 | 7.1 | 0.00 | Sep 3, 2026 | Unauthenticated Cross Site Scripting (XSS) in Quick Event Manager <= 9.17 versions. | ||
| CVE-2026-84836 | Hig | 0.46 | 7.1 | 0.00 | Sep 3, 2026 | Subscriber Insecure Direct Object References (IDOR) in WC Ukraine Shipping <= 1.22.3 versions. | ||
| CVE-2026-84812 | Hig | 0.46 | 7.1 | 0.00 | Sep 3, 2026 | Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.27 versions. | ||
| CVE-2026-84765 | Hig | 0.46 | 7.1 | 0.00 | Sep 3, 2026 | Unauthenticated Cross Site Scripting (XSS) in Breadcrumb NavXT <= 7.5.1 versions. | ||
| CVE-2026-84763 | Hig | 0.46 | 7.1 | 0.00 | Sep 3, 2026 | Unauthenticated Cross Site Scripting (XSS) in RTMKit <= 2.1.5 versions. | ||
| CVE-2026-84756 | Hig | 0.46 | 7.1 | 0.00 | Sep 3, 2026 | Subscriber Privilege Escalation in WCFM Membership <= 2.11.11 versions. | ||
| CVE-2026-81776 | Hig | 0.46 | 7.1 | 0.00 | Sep 3, 2026 | Unauthenticated Cross Site Scripting (XSS) in WP QuickLaTeX <= 3.8.8 versions. | ||
| CVE-2026-81773 | Hig | 0.46 | 7.1 | 0.00 | Sep 3, 2026 | Unauthenticated Cross Site Scripting (XSS) in Ninja Forms File Uploads Extension <= 3.3.26 versions. | ||
| CVE-2026-81300 | Hig | 0.46 | 7.1 | 0.00 | Sep 3, 2026 | Unauthenticated Cross Site Scripting (XSS) in Calculation For Contact Form 7 <= 1.0 versions. | ||
| CVE-2026-81295 | Hig | 0.46 | 7.1 | 0.00 | Sep 3, 2026 | Unauthenticated Cross Site Scripting (XSS) in Under Construction <= 5.82 versions. | ||
| CVE-2026-81292 | Hig | 0.46 | 7.1 | 0.00 | Sep 3, 2026 | Unauthenticated Cross Site Scripting (XSS) in Simple Payment <= 2.5.1 versions. | ||
| CVE-2026-78065 | Hig | 0.46 | — | 0.00 | Sep 3, 2026 | Joomla Extension - j2commerce.com - Guest checkout address disclosure to any authenticated user (IDOR) in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - `editAddress()` redirected non-owners away only when the loaded address row had a **non-empty** `user_id` belonging to… | ||
| CVE-2026-81775 | Hig | 0.46 | 7.1 | 0.00 | Sep 2, 2026 | Unauthenticated Cross Site Scripting (XSS) in Estatik <= 4.3.4 versions. | ||
| CVE-2026-81771 | Hig | 0.46 | 7.1 | 0.00 | Sep 2, 2026 | Unauthenticated Cross Site Scripting (XSS) in TrustedSite <= 1.2.5 versions. | ||
| CVE-2026-81770 | Hig | 0.46 | 7.1 | 0.00 | Sep 2, 2026 | Unauthenticated Cross Site Scripting (XSS) in Interactive Geo Maps <= 1.6.30 versions. | ||
| CVE-2026-81289 | Hig | 0.46 | 7.1 | 0.00 | Sep 2, 2026 | Unauthenticated Cross Site Scripting (XSS) in MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.13.1 versions. | ||
| CVE-2026-81288 | Hig | 0.46 | 7.1 | 0.00 | Sep 2, 2026 | Unauthenticated Cross Site Scripting (XSS) in Upsell Order Bump Offer for WooCommerce <= 3.1.5 versions. | ||
| CVE-2026-82883 | Hig | 0.46 | 7.1 | 0.00 | Sep 2, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcus Login With Ajax allows Reflected XSS. This issue affects Login With Ajax: from n/a through 4.5.1. | ||
| CVE-2026-19723 | Hig | 0.46 | 7.1 | 0.00 | Sep 2, 2026 | The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not properly escape a value taken from the incoming request before outputting it in an inline JavaScript event handler, leading to Reflected Cross-Site Scripting which is triggered when a… | ||
| CVE-2026-19453 | Hig | 0.46 | 7.1 | 0.00 | Sep 2, 2026 | The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capabilities of the account it preserves across a restore or migration before granting it administrator privileges, allowing a subscriber-level user to gain administrator access after the site owner… | ||
| CVE-2026-12865 | Hig | 0.46 | 7.1 | 0.00 | Sep 2, 2026 | The Photo Gallery by 10Web WordPress plugin before 1.8.44 does not escape two request parameters before reflecting them into input-attribute values on its admin pages (one on the Shortcode page, one on the Galleries/Albums list page), so an unauthenticated attacker can craft a… | ||
| CVE-2026-82229 | Hig | 0.46 | 7.1 | 0.00 | Aug 31, 2026 | Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.2 versions. | ||
| CVE-2026-82224 | Hig | 0.46 | 7.1 | 0.00 | Aug 31, 2026 | Unauthenticated Cross Site Scripting (XSS) in SliceWP <= 1.2.10 versions. | ||
| CVE-2026-82221 | Hig | 0.46 | 7.1 | 0.00 | Aug 31, 2026 | Unauthenticated Cross Site Scripting (XSS) in RegistrationMagic <= 6.0.9.8 versions. | ||
| CVE-2026-81768 | Hig | 0.46 | 7.1 | 0.00 | Aug 31, 2026 | Unauthenticated Cross Site Scripting (XSS) in Super Store Finder <= 7.10 versions. | ||
| CVE-2026-81765 | Hig | 0.46 | 7.1 | 0.00 | Aug 31, 2026 | Unauthenticated Cross Site Scripting (XSS) in Tailored Tools <= 3.0.2 versions. | ||
| CVE-2026-81764 | Hig | 0.46 | 7.1 | 0.00 | Aug 31, 2026 | Unauthenticated Cross Site Scripting (XSS) in Email Essentials <= 6.0.6 versions. | ||
| CVE-2026-81298 | Hig | 0.46 | 7.1 | 0.00 | Aug 31, 2026 | Unauthenticated Cross Site Scripting (XSS) in LeadConnector <= 4.0.5 versions. | ||
| CVE-2026-81291 | Hig | 0.46 | 7.1 | 0.00 | Aug 31, 2026 | Unauthenticated Cross Site Scripting (XSS) in Uncode <= 2.12.7 versions. | ||
| CVE-2026-81290 | Hig | 0.46 | 7.1 | 0.00 | Aug 31, 2026 | Unauthenticated Cross Site Scripting (XSS) in Email Subscribers & Newsletters <= 5.9.33 versions. | ||
| CVE-2026-14307 | Hig | 0.46 | 7.1 | 0.00 | Aug 30, 2026 | The geotargetingwp WordPress plugin before 3.5.6.2 does not sanitise or escape several parameters before reflecting them back in AJAX responses that are served with an HTML content type, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a… | ||
| CVE-2026-81760 | Hig | 0.46 | 7.1 | 0.00 | Aug 28, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine allows Reflected XSS. This issue affects JetEngine: from n/a through 3.8.14.2. | ||
| CVE-2026-19423 | Hig | 0.46 | 8.1 | 0.00 | Aug 28, 2026 | The Ultimate Member WordPress plugin before 2.13.0 does not validate a submitted role selection when it cannot resolve the set of roles a profile form permits, and screens the value against the site's registered role names rather than against the form's own allow-list, allowing… | ||
| CVE-2026-78293 | Hig | 0.46 | 7.1 | 0.00 | Aug 27, 2026 | Unauthenticated Cross Site Scripting (XSS) in WP w3all phpBB <= 3.0.6 versions. | ||
| CVE-2026-78289 | Hig | 0.46 | 7.1 | 0.00 | Aug 27, 2026 | Unauthenticated Cross Site Scripting (XSS) in CozyStay <= 1.10.0 versions. | ||
| CVE-2026-78283 | Hig | 0.46 | 7.1 | 0.00 | Aug 27, 2026 | Unauthenticated Cross Site Scripting (XSS) in Music Player for WooCommerce <= 1.8.9 versions. | ||
| CVE-2026-78281 | Hig | 0.46 | 7.1 | 0.00 | Aug 27, 2026 | Unauthenticated Cross Site Scripting (XSS) in CP Media Player <= 1.3.0 versions. | ||
| CVE-2026-78261 | Hig | 0.46 | 7.1 | 0.00 | Aug 27, 2026 | Unauthenticated Cross Site Scripting (XSS) in Realtyna Organic IDX plugin <= 5.4.1 versions. | ||
| CVE-2026-78282 | Hig | 0.46 | 7.1 | 0.00 | Aug 24, 2026 | Unauthenticated Cross Site Scripting (XSS) in Stripe Payments <= 2.1.2 versions. | ||
| CVE-2026-78264 | Hig | 0.46 | 7.1 | 0.00 | Aug 24, 2026 | Unauthenticated Cross Site Scripting (XSS) in Toolset Blocks <= 1.6.26 versions. | ||
| CVE-2026-78263 | Hig | 0.46 | 7.1 | 0.00 | Aug 24, 2026 | Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.2.1 versions. | ||
| CVE-2026-32556 | Hig | 0.46 | 7.1 | 0.00 | Aug 24, 2026 | Unauthenticated Cross Site Scripting (XSS) in Boost <= 2.0.4 versions. | ||
| CVE-2026-66623 | Hig | 0.46 | 7.1 | 0.00 | Aug 24, 2026 | Unauthenticated Cross Site Scripting (XSS) in Social Media & Share Icons <= 2.9.9 versions. | ||
| CVE-2026-66610 | Hig | 0.46 | 7.1 | 0.00 | Aug 24, 2026 | Unauthenticated Cross Site Scripting (XSS) in Urna <= 2.6.2 versions. | ||
| CVE-2026-66599 | Hig | 0.46 | 7.1 | 0.00 | Aug 24, 2026 | Unauthenticated Cross Site Scripting (XSS) in WPComplete <= 2.9.5.6 versions. | ||
| CVE-2026-66584 | Hig | 0.46 | 7.1 | 0.00 | Aug 24, 2026 | Unauthenticated Cross Site Scripting (XSS) in 12 Step Meeting List <= 3.19.16 versions. | ||
| CVE-2026-32476 | Hig | 0.46 | 7.1 | 0.00 | Aug 24, 2026 | Unauthenticated Cross Site Scripting (XSS) in Brave Conversion Engine (PRO) <= 0.8.6 versions. |
- risk 0.46cvss 7.1epss 0.00
Missing Authorization vulnerability in Unbounce Unbounce Landing Pages unbounce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unbounce Landing Pages: from n/a through 1.1.4.
- risk 0.46cvss 7.1epss 0.00
The IPGP Visitors Origin WordPress plugin before 1.6 does not sanitise or escape user input before reflecting it back in the HTTP response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who are tricked into submitting a…
- risk 0.46cvss 7.1epss 0.00
The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes or attaches media, allowing any authenticated user, including a subscriber, to permanently delete attachments…
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Quick Event Manager <= 9.17 versions.
- risk 0.46cvss 7.1epss 0.00
Subscriber Insecure Direct Object References (IDOR) in WC Ukraine Shipping <= 1.22.3 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.27 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Breadcrumb NavXT <= 7.5.1 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in RTMKit <= 2.1.5 versions.
- risk 0.46cvss 7.1epss 0.00
Subscriber Privilege Escalation in WCFM Membership <= 2.11.11 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in WP QuickLaTeX <= 3.8.8 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Ninja Forms File Uploads Extension <= 3.3.26 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Calculation For Contact Form 7 <= 1.0 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Under Construction <= 5.82 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Simple Payment <= 2.5.1 versions.
- risk 0.46cvss —epss 0.00
Joomla Extension - j2commerce.com - Guest checkout address disclosure to any authenticated user (IDOR) in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - `editAddress()` redirected non-owners away only when the loaded address row had a **non-empty** `user_id` belonging to…
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Estatik <= 4.3.4 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in TrustedSite <= 1.2.5 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Interactive Geo Maps <= 1.6.30 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.13.1 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Upsell Order Bump Offer for WooCommerce <= 3.1.5 versions.
- risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcus Login With Ajax allows Reflected XSS. This issue affects Login With Ajax: from n/a through 4.5.1.
- risk 0.46cvss 7.1epss 0.00
The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not properly escape a value taken from the incoming request before outputting it in an inline JavaScript event handler, leading to Reflected Cross-Site Scripting which is triggered when a…
- risk 0.46cvss 7.1epss 0.00
The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capabilities of the account it preserves across a restore or migration before granting it administrator privileges, allowing a subscriber-level user to gain administrator access after the site owner…
- risk 0.46cvss 7.1epss 0.00
The Photo Gallery by 10Web WordPress plugin before 1.8.44 does not escape two request parameters before reflecting them into input-attribute values on its admin pages (one on the Shortcode page, one on the Galleries/Albums list page), so an unauthenticated attacker can craft a…
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.2 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in SliceWP <= 1.2.10 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in RegistrationMagic <= 6.0.9.8 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Super Store Finder <= 7.10 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Tailored Tools <= 3.0.2 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Email Essentials <= 6.0.6 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in LeadConnector <= 4.0.5 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Uncode <= 2.12.7 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Email Subscribers & Newsletters <= 5.9.33 versions.
- risk 0.46cvss 7.1epss 0.00
The geotargetingwp WordPress plugin before 3.5.6.2 does not sanitise or escape several parameters before reflecting them back in AJAX responses that are served with an HTML content type, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a…
- risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine allows Reflected XSS. This issue affects JetEngine: from n/a through 3.8.14.2.
- risk 0.46cvss 8.1epss 0.00
The Ultimate Member WordPress plugin before 2.13.0 does not validate a submitted role selection when it cannot resolve the set of roles a profile form permits, and screens the value against the site's registered role names rather than against the form's own allow-list, allowing…
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in WP w3all phpBB <= 3.0.6 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in CozyStay <= 1.10.0 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Music Player for WooCommerce <= 1.8.9 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in CP Media Player <= 1.3.0 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Realtyna Organic IDX plugin <= 5.4.1 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Stripe Payments <= 2.1.2 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Toolset Blocks <= 1.6.26 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.2.1 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Boost <= 2.0.4 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Social Media & Share Icons <= 2.9.9 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Urna <= 2.6.2 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in WPComplete <= 2.9.5.6 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in 12 Step Meeting List <= 3.19.16 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Brave Conversion Engine (PRO) <= 0.8.6 versions.
Page 196 of 802