VYPR
← WordPress

Vendor CVEs

WordPress

All CVEs

40,071 total · sorted by risk
  • CVE-2026-28172HigAug 6, 2026
    WordPress
    Tracking Code Manager
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Request Forgery (CSRF) in Tracking Code Manager <= 2.6.0 versions.

  • CVE-2026-28143HigAug 6, 2026
    WordPress
    Forminator
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.56.0 versions.

  • CVE-2026-28141HigAug 6, 2026
    WordPress
    Nextgen Gallery
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in NextGEN Gallery <= 4.2.3 versions.

  • CVE-2026-28082HigAug 6, 2026
    WordPress
    Jetengine
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.13.1 versions.

  • CVE-2026-13725HigAug 1, 2026
    WordPress
    Dynamic Pricing and Discount Rules for WooCommerce
    risk 0.46cvss 7.1epss 0.00

    The Dynamic Pricing With Discount Rules for WooCommerce WordPress plugin before 5.0.0 does not validate a nonce or user capabilities on one of its AJAX actions and reflects unsanitised user input in the response, allowing unauthenticated attackers to perform Reflected Cross-Site…

  • CVE-2026-65492HigJul 23, 2026
    WordPress
    Dokan Pro
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Dokan Pro allows Reflected XSS. This issue affects Dokan Pro: from n/a before 5.0.7.

  • CVE-2026-65488HigJul 23, 2026
    WordPress
    LA-Studio Element Kit for Elementor
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Stored XSS.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.6.2.

  • CVE-2026-27408HigJul 2, 2026
    WordPress
    NativeChurch
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in imithemes NativeChurch nativechurch allows Reflected XSS.This issue affects NativeChurch: from n/a before 4.9.5.

  • CVE-2025-69156HigJul 2, 2026
    WordPress
    Kids Zone - Children WordPress Theme
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Kids Zone - Children WordPress Theme <= 5.4 versions.

  • CVE-2025-69155HigJul 2, 2026
    WordPress
    Fitness Zone
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Fitness Zone WordPress Theme <= 5.7 versions.

  • CVE-2025-69154HigJul 2, 2026
    WordPress
    SpaLab | Beauty Salon WordPress Theme
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in SpaLab | Beauty Salon WordPress Theme <= 6.7 versions.

  • CVE-2025-69153HigJul 2, 2026
    WordPress
    Trendy Travel
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Trendy Travel <= 6.7 versions.

  • CVE-2025-69152HigJul 2, 2026
    WordPress
    Artale | Wedding Photography
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Artale | Wedding Photography WordPress <= 2.2.2 versions.

  • CVE-2026-57322HigJun 26, 2026
    WordPress
    Wemail
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs weMail wemail allows Reflected XSS.This issue affects weMail: from n/a through 2.1.2.

  • CVE-2026-56014HigJun 25, 2026
    WordPress
    Master Slider
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Averta Master Slider master-slider allows Reflected XSS.This issue affects Master Slider: from n/a through 3.11.5.

  • CVE-2026-56005HigJun 25, 2026
    Melapress
    Wp Activity Log
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log wp-security-audit-log allows Stored XSS.This issue affects WP Activity Log: from n/a through 5.6.3.1.

  • CVE-2026-8172HigJun 23, 2026
    WordPress
    Simple Basic Contact Form
    risk 0.46cvss 7.1epss 0.00

    The Simple Basic Contact Form WordPress plugin through 20250114 does not escape user-supplied input before reflecting it into the contact form output on validation errors, leading to a Reflected Cross-Site Scripting vulnerability that unauthenticated attackers can exploit…

  • CVE-2026-6858HigJun 22, 2026
    WordPress
    Transbank Webpay
    risk 0.46cvss 7.1epss 0.00

    The Transbank Webpay WordPress plugin before 1.14.0 does not sanitize and escape logs to be displayed, allowing unauthenticated users to perform Stored XSS attacks against logged in administrator

  • CVE-2026-4259HigJun 22, 2026
    WordPress
    Ultimate Woocommerce Auction Pro
    risk 0.46cvss 7.1epss 0.00

    The ultimate-woocommerce-auction-pro WordPress plugin through 2.4.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

  • CVE-2026-9843HigJun 20, 2026
    WordPress
    Database For Contact Form 7\, Wpforms\, Elementor Forms
    risk 0.46cvss 8.1epss 0.01

    The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the view_page function in all versions up to, and including, 1.5.1. This makes it possible for unauthenticated…

  • CVE-2019-25759HigJun 19, 2026
    Joomla
    vBizz
    risk 0.46cvss 7.1epss 0.00

    Joomla! Component vBizz 1.0.7 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the payid parameter. Attackers can submit POST requests to the employee management interface with…

  • CVE-2025-69140HigJun 17, 2026
    WordPress
    sweetdate-core
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in SweetDate Core < 1.1.5 versions.

  • CVE-2025-68524HigJun 17, 2026
    WordPress
    Avante
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Avante < 3.0.5 versions.

  • CVE-2026-9570HigJun 17, 2026
    WordPress
    Taskbuilder
    risk 0.46cvss 7.1epss 0.00

    The Taskbuilder WordPress plugin before 5.0.8 does not properly sanitise a URL parameter before echoing it into inline JavaScript on a frontend page containing one of its shortcodes, leading to a Reflected Cross-Site Scripting vulnerability that can be triggered against any…

  • CVE-2026-8089HigJun 17, 2026
    WordPress
    Wemail
    risk 0.46cvss 7.1epss 0.01

    The weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce WordPress plugin before 2.1.3 does not properly escape a user-supplied parameter before reflecting it into an HTML attribute on a non-nonce-protected AJAX response, allowing…

  • CVE-2026-54195HigJun 17, 2026
    WordPress
    Jetformbuilder
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.0.1 versions.

  • CVE-2026-54192HigJun 17, 2026
    WordPress
    Popup Box
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Popup box <= 6.2.9 versions.

  • CVE-2026-54189HigJun 17, 2026
    WordPress
    Jetengine
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions.

  • CVE-2026-54188HigJun 17, 2026
    WordPress
    Jetengine
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions.

  • CVE-2026-49778HigJun 17, 2026
    WordPress
    WPFunnels Pro
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in WPFunnels Pro <= 2.9.4 versions.

  • CVE-2026-49074HigJun 17, 2026
    WordPress
    Jetengine
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.9.1 versions.

  • CVE-2026-48869HigJun 17, 2026
    WordPress
    Enfold
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Enfold <= 7.1.4 versions.

  • CVE-2026-42385HigJun 17, 2026
    WordPress
    Profile Builder Pro
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Profile Builder Pro <= 3.15.0 versions.

  • CVE-2026-41557HigJun 17, 2026
    WordPress
    Kapee
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Kapee < 1.7.1 versions.

  • CVE-2026-40765HigJun 17, 2026
    WordPress
    Collectchat
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in collectchat <= 2.4.9 versions.

  • CVE-2026-39548HigJun 17, 2026
    WordPress
    MagOne
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in MagOne <= 9.0 versions.

  • CVE-2026-22339HigJun 17, 2026
    WordPress
    WPJobster
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in WPJobster <= 6.3.5 versions.

  • CVE-2026-22329HigJun 17, 2026
    WordPress
    Skillate
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Skillate <= 1.2.10 versions.

  • CVE-2026-22328HigJun 17, 2026
    WordPress
    Auto Repair
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Auto Repair <= 22.6 versions.

  • CVE-2025-69151HigJun 17, 2026
    WordPress
    Grand Car Rental
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Grand Car Rental <= 3.7 versions.

  • CVE-2025-69104HigJun 17, 2026
    WordPress
    Qreatix
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Qreatix <= 1.9.4 versions.

  • CVE-2025-59560HigJun 17, 2026
    WordPress
    Sonaar
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Sonaar <= 4.27.4 versions.

  • CVE-2025-31013HigJun 17, 2026
    WordPress
    Folo
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themify Folo allows Reflected XSS. This issue affects Themify Folo: from n/a through 1.9.6.

  • CVE-2024-49269HigJun 17, 2026
    WordPress
    My Flatonica
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in my flatonica <= 0.0.8 versions.

  • CVE-2026-54198HigJun 16, 2026
    WordPress
    Media Library Assistant
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.35 versions.

  • CVE-2026-54191HigJun 16, 2026
    WordPress
    Pods
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Pods <= 3.3.8 versions.

  • CVE-2026-39437HigJun 16, 2026
    WordPress
    Min Max Step Quantity Limits Manager for WooCommerce
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Min Max Step Quantity Limits Manager for WooCommerce <= 5.2.2 versions.

  • CVE-2026-52702HigJun 15, 2026
    WordPress
    Seo Redirection
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in SEO Redirection <= 9.17 versions.

  • CVE-2026-49055HigJun 15, 2026
    WordPress
    Drag And Drop Multiple File Upload Contact Form 7
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.9.7 versions.

  • CVE-2026-48966HigJun 15, 2026
    WordPress
    Funnel Builder
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Funnel Builder by FunnelKit <= 3.15.0.2 versions.

Page 199 of 802