Vendor CVEs
WordPress
All CVEs
40,071 total · sorted by risk| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-28154 | Hig | 0.46 | 7.1 | 0.00 | Aug 13, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in snstheme Samex - Clean, Minimal Shop WooCommerce WordPress Theme and snstheme M.Anh - Fashion WooCoommerce WordPress Theme allows Reflected XSS. This issue affects Samex -… | ||
| CVE-2026-66700 | Hig | 0.46 | 7.1 | 0.00 | Aug 13, 2026 | Unauthenticated Cross Site Scripting (XSS) in Smart Online Order for Clover <= 1.6.1 versions. | ||
| CVE-2026-66698 | Hig | 0.46 | 7.1 | 0.00 | Aug 13, 2026 | Unauthenticated Cross Site Scripting (XSS) in SureDash <= 1.10.1 versions. | ||
| CVE-2026-66697 | Hig | 0.46 | 7.1 | 0.00 | Aug 13, 2026 | Unauthenticated Cross Site Scripting (XSS) in Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.10.0 versions. | ||
| CVE-2026-66655 | Hig | 0.46 | 7.1 | 0.00 | Aug 13, 2026 | Unauthenticated Cross Site Scripting (XSS) in MultiParcels Shipping For WooCommerce <= 1.30.36 versions. | ||
| CVE-2026-66468 | Hig | 0.46 | 7.1 | 0.00 | Aug 13, 2026 | Unauthenticated Cross Site Scripting (XSS) in Local Delivery Drivers for WooCommerce <= 3.0.0 versions. | ||
| CVE-2026-66449 | Hig | 0.46 | 7.1 | 0.00 | Aug 13, 2026 | Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.18 versions. | ||
| CVE-2026-66429 | Hig | 0.46 | 7.1 | 0.00 | Aug 13, 2026 | Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.10 versions. | ||
| CVE-2026-66426 | Hig | 0.46 | 7.1 | 0.00 | Aug 13, 2026 | Unauthenticated Cross Site Scripting (XSS) in WP-Stats <= 2.56 versions. | ||
| CVE-2026-65580 | Hig | 0.46 | 7.1 | 0.00 | Aug 13, 2026 | Unauthenticated Cross Site Scripting (XSS) in Agrion <= 1.0.0 versions. | ||
| CVE-2026-61974 | Hig | 0.46 | 7.1 | 0.00 | Aug 13, 2026 | Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.3.4 versions. | ||
| CVE-2026-61965 | Hig | 0.46 | 7.1 | 0.00 | Aug 13, 2026 | Unauthenticated Cross Site Scripting (XSS) in GeekyBot <= 1.2.6 versions. | ||
| CVE-2026-61960 | Hig | 0.46 | 7.1 | 0.00 | Aug 13, 2026 | Unauthenticated Cross Site Scripting (XSS) in WP Full Stripe Free <= 8.5.0 versions. | ||
| CVE-2026-28187 | Hig | 0.46 | 7.1 | 0.00 | Aug 13, 2026 | Unauthenticated Cross Site Scripting (XSS) in Knowledge Base for Documentation, FAQs with AI Assistance <= 17.211.0 versions. | ||
| CVE-2026-28175 | Hig | 0.46 | 7.1 | 0.00 | Aug 13, 2026 | Unauthenticated Cross Site Scripting (XSS) in Visitors Traffic Real Time Statistics <= 8.11 versions. | ||
| CVE-2026-28173 | Hig | 0.46 | 7.1 | 0.00 | Aug 13, 2026 | Customer Arbitrary Content Deletion in WP Event SOlution <= 4.1.19 versions. | ||
| CVE-2026-28170 | Hig | 0.46 | 7.1 | 0.00 | Aug 13, 2026 | Unauthenticated Cross Site Scripting (XSS) in Blog Floating Button <= 1.4.20 versions. | ||
| CVE-2026-28158 | Hig | 0.46 | 7.1 | 0.00 | Aug 13, 2026 | Unauthenticated Cross Site Scripting (XSS) in Do Lasso <= 358 versions. | ||
| CVE-2026-28004 | Hig | 0.46 | 7.1 | 0.00 | Aug 13, 2026 | Unauthenticated Cross Site Scripting (XSS) in Business Directory <= 6.4.25 versions. | ||
| CVE-2026-28003 | Hig | 0.46 | 7.1 | 0.00 | Aug 13, 2026 | Unauthenticated Cross Site Scripting (XSS) in Maspik – Spam blacklist <= 2.9.1 versions. | ||
| CVE-2026-27539 | Hig | 0.46 | 7.1 | 0.00 | Aug 13, 2026 | Unauthenticated Cross Site Scripting (XSS) in Welcart e-Commerce <= 2.11.31 versions. | ||
| CVE-2026-27536 | Hig | 0.46 | 7.1 | 0.00 | Aug 13, 2026 | Unauthenticated Cross Site Scripting (XSS) in MailChimp Subscribe Forms <= 4.3.3 versions. | ||
| CVE-2026-27535 | Hig | 0.46 | 7.1 | 0.00 | Aug 13, 2026 | Subscriber Broken Access Control in Solace Extra <= 1.6.0 versions. | ||
| CVE-2026-16294 | Hig | 0.46 | 7.1 | 0.00 | Aug 12, 2026 | The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.1 does not validate one of its Podcast Episode URL settings before performing a server-side request with it, allowing users with a role as low as Contributor to perform Server-Side Request Forgery attacks… | ||
| CVE-2026-18961 | Hig | 0.46 | 8.1 | 0.01 | Aug 12, 2026 | The Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect plugin for WordPress is vulnerable to Authentication Bypass via Unverified Provider Email in all versions up to, and including, 1.4.3. This is due to the plugin trusting the unverified… | ||
| CVE-2026-19091 | Hig | 0.46 | 8.1 | 0.01 | Aug 11, 2026 | The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_revision function in all versions up to, and including, 2.8.169. This makes it… | ||
| CVE-2026-66711 | Hig | 0.46 | 7.1 | 0.00 | Aug 6, 2026 | Subscriber Cross Site Scripting (XSS) in WooCommerce Multilingual & Multicurrency <= 5.5.6 versions. | ||
| CVE-2026-66702 | Hig | 0.46 | 7.1 | 0.00 | Aug 6, 2026 | Unauthenticated Cross Site Scripting (XSS) in Rank Math SEO <= 1.0.274.1 versions. | ||
| CVE-2026-66694 | Hig | 0.46 | 7.1 | 0.00 | Aug 6, 2026 | Unauthenticated Cross Site Scripting (XSS) in Thrive Architect <= 10.9.3.1 versions. | ||
| CVE-2026-66690 | Hig | 0.46 | 7.1 | 0.00 | Aug 6, 2026 | Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.5 versions. | ||
| CVE-2026-66664 | Hig | 0.46 | 7.1 | 0.00 | Aug 6, 2026 | Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.0 versions. | ||
| CVE-2026-66663 | Hig | 0.46 | 7.1 | 0.00 | Aug 6, 2026 | Unauthenticated Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions. | ||
| CVE-2026-66470 | Hig | 0.46 | 7.1 | 0.00 | Aug 6, 2026 | Subscriber Broken Access Control in Frontend Admin by DynamiApps <= 3.29.10 versions. | ||
| CVE-2026-66457 | Hig | 0.46 | 7.1 | 0.00 | Aug 6, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-manager allows Reflected XSS.This issue affects Events Manager: from n/a through 7.4.2. | ||
| CVE-2026-66440 | Hig | 0.46 | 7.1 | 0.00 | Aug 6, 2026 | Unauthenticated Cross Site Scripting (XSS) in WPIDE – File Manager & Code Editor <= 3.5.7 versions. | ||
| CVE-2026-66439 | Hig | 0.46 | 7.1 | 0.00 | Aug 6, 2026 | Unauthenticated Cross Site Scripting (XSS) in Advanced AJAX Product Filters <= 3.2.0.3 versions. | ||
| CVE-2026-65565 | Hig | 0.46 | 7.1 | 0.00 | Aug 6, 2026 | Unauthenticated Cross Site Scripting (XSS) in Survey Maker <= 5.2.3.3 versions. | ||
| CVE-2026-65560 | Hig | 0.46 | 7.1 | 0.00 | Aug 6, 2026 | Unauthenticated Cross Site Scripting (XSS) in Houzez Property Feed <= 2.5.48 versions. | ||
| CVE-2026-65554 | Hig | 0.46 | 7.1 | 0.00 | Aug 6, 2026 | Subscriber Broken Access Control in AnsPress – Question and answer 4.4.4 versions. | ||
| CVE-2026-65545 | Hig | 0.46 | 7.1 | 0.00 | Aug 6, 2026 | Unauthenticated Cross Site Scripting (XSS) in AI Engine <= 3.6.8 versions. | ||
| CVE-2026-65544 | Hig | 0.46 | 7.1 | 0.00 | Aug 6, 2026 | Unauthenticated Cross Site Scripting (XSS) in Super Socializer <= 7.14.5 versions. | ||
| CVE-2026-65517 | Hig | 0.46 | 7.1 | 0.00 | Aug 6, 2026 | Unauthenticated Cross Site Scripting (XSS) in Easy PayPal Buy Now Button <= 2.0.4 versions. | ||
| CVE-2026-65515 | Hig | 0.46 | 7.1 | 0.00 | Aug 6, 2026 | Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.35.0 versions. | ||
| CVE-2026-65513 | Hig | 0.46 | 7.1 | 0.00 | Aug 6, 2026 | Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.10 versions. | ||
| CVE-2026-65509 | Hig | 0.46 | 7.1 | 0.00 | Aug 6, 2026 | Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 7.5.1 versions. | ||
| CVE-2026-61982 | Hig | 0.46 | 7.1 | 0.00 | Aug 6, 2026 | Unauthenticated Cross Site Scripting (XSS) in SiteGuard WP Plugin <= 1.8.6 versions. | ||
| CVE-2026-61964 | Hig | 0.46 | 7.1 | 0.00 | Aug 6, 2026 | Unauthenticated Cross Site Scripting (XSS) in Ninja Tables <= 5.2.9 versions. | ||
| CVE-2026-61963 | Hig | 0.46 | 7.1 | 0.00 | Aug 6, 2026 | Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.38 versions. | ||
| CVE-2026-61961 | Hig | 0.46 | 7.1 | 0.00 | Aug 6, 2026 | Unauthenticated Cross Site Scripting (XSS) in EmbedPress <= 4.5.6 versions. | ||
| CVE-2026-28177 | Hig | 0.46 | 7.1 | 0.00 | Aug 6, 2026 | Unauthenticated Cross Site Scripting (XSS) in Popup Maker <= 1.23.0 versions. |
- risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in snstheme Samex - Clean, Minimal Shop WooCommerce WordPress Theme and snstheme M.Anh - Fashion WooCoommerce WordPress Theme allows Reflected XSS. This issue affects Samex -…
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Smart Online Order for Clover <= 1.6.1 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in SureDash <= 1.10.1 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.10.0 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in MultiParcels Shipping For WooCommerce <= 1.30.36 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Local Delivery Drivers for WooCommerce <= 3.0.0 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.18 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.10 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in WP-Stats <= 2.56 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Agrion <= 1.0.0 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.3.4 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in GeekyBot <= 1.2.6 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in WP Full Stripe Free <= 8.5.0 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Knowledge Base for Documentation, FAQs with AI Assistance <= 17.211.0 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Visitors Traffic Real Time Statistics <= 8.11 versions.
- risk 0.46cvss 7.1epss 0.00
Customer Arbitrary Content Deletion in WP Event SOlution <= 4.1.19 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Blog Floating Button <= 1.4.20 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Do Lasso <= 358 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Business Directory <= 6.4.25 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Maspik – Spam blacklist <= 2.9.1 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Welcart e-Commerce <= 2.11.31 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in MailChimp Subscribe Forms <= 4.3.3 versions.
- risk 0.46cvss 7.1epss 0.00
Subscriber Broken Access Control in Solace Extra <= 1.6.0 versions.
- risk 0.46cvss 7.1epss 0.00
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.1 does not validate one of its Podcast Episode URL settings before performing a server-side request with it, allowing users with a role as low as Contributor to perform Server-Side Request Forgery attacks…
- risk 0.46cvss 8.1epss 0.01
The Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect plugin for WordPress is vulnerable to Authentication Bypass via Unverified Provider Email in all versions up to, and including, 1.4.3. This is due to the plugin trusting the unverified…
- risk 0.46cvss 8.1epss 0.01
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_revision function in all versions up to, and including, 2.8.169. This makes it…
- risk 0.46cvss 7.1epss 0.00
Subscriber Cross Site Scripting (XSS) in WooCommerce Multilingual & Multicurrency <= 5.5.6 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Rank Math SEO <= 1.0.274.1 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Thrive Architect <= 10.9.3.1 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.5 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.0 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions.
- risk 0.46cvss 7.1epss 0.00
Subscriber Broken Access Control in Frontend Admin by DynamiApps <= 3.29.10 versions.
- risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-manager allows Reflected XSS.This issue affects Events Manager: from n/a through 7.4.2.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in WPIDE – File Manager & Code Editor <= 3.5.7 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Advanced AJAX Product Filters <= 3.2.0.3 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Survey Maker <= 5.2.3.3 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Houzez Property Feed <= 2.5.48 versions.
- risk 0.46cvss 7.1epss 0.00
Subscriber Broken Access Control in AnsPress – Question and answer 4.4.4 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in AI Engine <= 3.6.8 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Super Socializer <= 7.14.5 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Easy PayPal Buy Now Button <= 2.0.4 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.35.0 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.10 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 7.5.1 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in SiteGuard WP Plugin <= 1.8.6 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Ninja Tables <= 5.2.9 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.38 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in EmbedPress <= 4.5.6 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Popup Maker <= 1.23.0 versions.
Page 198 of 802