VYPR
← WordPress

Vendor CVEs

WordPress

All CVEs

40,358 total · sorted by risk
  • CVE-2016-1000146MedOct 10, 2016
    WordPress
    Pondol Formmail
    risk 0.40cvss 6.1epss 0.03

    Reflected XSS in wordpress plugin pondol-formmail v1.1

  • CVE-2016-1000145MedOct 10, 2016
    WordPress
    Pondol Carousel
    risk 0.40cvss 6.1epss 0.02

    Reflected XSS in wordpress plugin pondol-carousel v1.0

  • CVE-2016-1000144MedOct 10, 2016
    WordPress
    Photoxhibit
    risk 0.40cvss 6.1epss 0.02

    Reflected XSS in wordpress plugin photoxhibit v2.1.8

  • CVE-2016-1000143MedOct 10, 2016
    WordPress
    Photoxhibit
    risk 0.40cvss 6.1epss 0.04

    Reflected XSS in wordpress plugin photoxhibit v2.1.8

  • CVE-2016-1000142MedOct 10, 2016
    WordPress
    Parsi Font
    risk 0.40cvss 6.1epss 0.04

    Reflected XSS in wordpress plugin parsi-font v4.2.5

  • CVE-2016-1000141MedOct 10, 2016
    WordPress
    Page Layout Builder
    risk 0.40cvss 6.1epss 0.03

    Reflected XSS in wordpress plugin page-layout-builder v1.9.3

  • CVE-2016-1000140MedOct 10, 2016
    WordPress
    New Year Firework
    risk 0.40cvss 6.1epss 0.03

    Reflected XSS in wordpress plugin new-year-firework v1.1.9

  • CVE-2016-1000139MedOct 10, 2016
    WordPress
    Infusionsoft
    risk 0.40cvss 6.1epss 0.04

    Reflected XSS in wordpress plugin infusionsoft v1.5.11

  • CVE-2016-1000138MedOct 10, 2016
    WordPress
    Indexisto
    risk 0.40cvss 6.1epss 0.03

    Reflected XSS in wordpress plugin indexisto v1.0.5

  • CVE-2016-1000137MedOct 10, 2016
    WordPress
    Hero Maps Pro
    risk 0.40cvss 6.1epss 0.04

    Reflected XSS in wordpress plugin hero-maps-pro v2.1.0

  • CVE-2016-1000136MedOct 10, 2016
    WordPress
    Heat Trackr
    risk 0.40cvss 6.1epss 0.03

    Reflected XSS in wordpress plugin heat-trackr v1.0

  • CVE-2016-1000135MedOct 10, 2016
    WordPress
    Hdw Tube
    risk 0.40cvss 6.1epss 0.05

    Reflected XSS in wordpress plugin hdw-tube v1.2

  • CVE-2016-1000134MedOct 10, 2016
    WordPress
    Hdw Tube
    risk 0.40cvss 6.1epss 0.05

    Reflected XSS in wordpress plugin hdw-tube v1.2

  • CVE-2016-1000133MedOct 10, 2016
    WordPress
    forget-about-shortcode-buttons
    risk 0.40cvss 6.1epss 0.03

    Reflected XSS in wordpress plugin forget-about-shortcode-buttons v1.1.1

  • CVE-2016-1000132MedOct 10, 2016
    WordPress
    Enhanced Tooltipglossary
    risk 0.40cvss 6.1epss 0.04

    Reflected XSS in wordpress plugin enhanced-tooltipglossary v3.2.8

  • CVE-2016-1000131MedOct 10, 2016
    WordPress
    e-search
    risk 0.40cvss 6.1epss 0.05

    Reflected XSS in wordpress plugin e-search v1.0

  • CVE-2016-1000130MedOct 10, 2016
    WordPress
    e-search
    risk 0.40cvss 6.1epss 0.03

    Reflected XSS in wordpress plugin e-search v1.0

  • CVE-2016-1000129MedOct 10, 2016
    WordPress
    defa-online-image-protector
    risk 0.40cvss 6.1epss 0.03

    Reflected XSS in wordpress plugin defa-online-image-protector v3.3

  • CVE-2016-1000128MedOct 10, 2016
    WordPress
    anti-plagiarism
    risk 0.40cvss 6.1epss 0.04

    Reflected XSS in wordpress plugin anti-plagiarism v3.60

  • CVE-2016-1000127MedOct 10, 2016
    WordPress
    ajax-random-post
    risk 0.40cvss 6.1epss 0.04

    Reflected XSS in wordpress plugin ajax-random-post v2.00

  • CVE-2016-1000126MedOct 10, 2016
    WordPress
    admin-font-editor
    risk 0.40cvss 6.1epss 0.04

    Reflected XSS in wordpress plugin admin-font-editor v1.8

  • CVE-2015-1000004MedOct 6, 2016
    WordPress
    filedownload
    risk 0.40cvss 6.1epss 0.01

    XSS in filedownload v1.4 wordpress plugin

  • CVE-2016-6634MedAug 7, 2016
    WordPress
    WordPress
    risk 0.40cvss 6.1epss 0.03

    Cross-site scripting (XSS) vulnerability in the network settings page in WordPress before 4.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2016-4833MedAug 3, 2016
    WordPress
    Nofollow Links
    risk 0.40cvss 6.1epss 0.02

    Cross-site scripting (XSS) vulnerability in the Nofollow Links plugin before 1.0.11 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2016-4827MedJun 25, 2016
    Welcart
    E Commerce
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting (XSS) vulnerability in the Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2016-4826.

  • CVE-2016-4826MedJun 25, 2016
    Welcart
    E Commerce
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting (XSS) vulnerability in the Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2016-4827.

  • CVE-2016-4812MedJun 4, 2016
    WordPress
    Markdown on Save Improved
    risk 0.40cvss 6.1epss 0.02

    Cross-site scripting (XSS) vulnerability in the Markdown on Save Improved plugin before 2.5.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2016-0832MedMar 12, 2016
    Google
    Android
    risk 0.40cvss 6.1epss 0.00

    Setup Wizard in Android 5.1.x before LMY49H and 6.x before 2016-03-01 allows physically proximate attackers to bypass the Factory Reset Protection protection mechanism and delete data via unspecified vectors, aka internal bug 25955042.

  • CVE-2015-5471MedJan 12, 2016
    WordPress
    Swim Team
    risk 0.40cvss 5.3epss 0.32

    Absolute path traversal vulnerability in include/user/download.php in the Swim Team plugin 1.44.10777 for WordPress allows remote attackers to read arbitrary files via a full pathname in the file parameter.

  • CVE-2014-7151MedJan 8, 2016
    WordPress
    Nex Forms Lite
    risk 0.40cvss 6.1epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the NEX-Forms Lite plugin 2.1.0 for WordPress allow remote attackers to inject arbitrary web script or HTML via the form_fields parameter in a (1) do_edit or (2) do_insert action to wp-admin/admin-ajax.php.

  • CVE-2026-111978MedOct 25, 2026
    WordPress
    Givewp
    risk 0.39cvss 6.0epss 0.00

    The GiveWP WordPress plugin before 4.19.0.1 does not properly validate a user-supplied filename before reading it from disk, allowing users with a high-privilege custom role to perform path traversal, disclose the contents of JSON-parseable files anywhere on the server, and…

  • CVE-2026-115807HigOct 24, 2026
    WordPress
    Profile Builder
    risk 0.39cvss 7.1epss 0.00

    The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 4.0.3. This is due to the Gutenberg Register block passing the…

  • CVE-2026-110382HigOct 18, 2026
    WordPress
    Simply Schedule Appointments
    risk 0.39cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Stored XSS.This issue affects Simply Schedule Appointments: from n/a through 1.6.12.35.

  • CVE-2026-108695HigOct 11, 2026
    Multivendorx
    Multivendorx
    risk 0.39cvss 7.1epss 0.00

    MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings via the settings REST endpoint. Attackers with the store_owner role can send POST requests to…

  • CVE-2026-42699HigOct 10, 2026
    WordPress
    FV Player
    risk 0.39cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in FV Player 8 <= 8.1.8 versions.

  • CVE-2026-97264HigOct 10, 2026
    WordPress
    Wpadverts
    risk 0.39cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts wpadverts allows Reflected XSS.This issue affects WPAdverts: from n/a through 2.3.4.

  • CVE-2026-97263HigOct 10, 2026
    WordPress
    Wpadverts
    risk 0.39cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts wpadverts allows Stored XSS.This issue affects WPAdverts: from n/a through 2.3.4.

  • CVE-2026-94641HigOct 9, 2026
    WordPress
    Userswp
    risk 0.39cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan UsersWP userswp allows Reflected XSS.This issue affects UsersWP: from n/a through 1.2.73.

  • CVE-2026-94632HigOct 9, 2026
    WordPress
    Blockstrap Page Builder Blocks
    risk 0.39cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan BlockStrap Page Builder - Bootstrap Blocks blockstrap-page-builder-blocks allows Reflected XSS.This issue affects BlockStrap Page Builder - Bootstrap Blocks: from n/a…

  • CVE-2026-94662HigOct 7, 2026
    WordPress
    Unlimited Elements For Elementor
    risk 0.39cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Stored XSS. This issue affects Unlimited Elements For Elementor (Free Widgets,…

  • CVE-2026-97276HigOct 4, 2026
    WordPress
    Wp Statistics
    risk 0.39cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP Statistics wp-statistics allows Reflected XSS.This issue affects WP Statistics: from n/a through 14.16.14.

  • CVE-2026-103344HigOct 4, 2026
    WordPress
    Unlimited Elements For Elementor
    risk 0.39cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements…

  • CVE-2026-103342HigOct 3, 2026
    WordPress
    Unlimited Elements For Elementor
    risk 0.39cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements…

  • CVE-2026-93770HigSep 30, 2026
    WordPress
    Wp Statistics
    risk 0.39cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.13 versions.

  • CVE-2026-6922HigSep 22, 2026
    WordPress
    Wp Table Builder
    risk 0.39cvss 7.1epss 0.01

    The WP Table Builder – Drag & Drop Table Builder plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 2.2.1. This is due to an operator precedence bug in the post-type guard within the trash_table_bulk() and restore_table_bulk()…

  • CVE-2026-93485HigSep 18, 2026
    WordPress
    WordPress
    risk 0.39cvss 7.1epss 0.01

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WordPress wordpress allows DOM-Based XSS.This issue affects WordPress: from n/a through 7.1.

  • CVE-2026-81908MedSep 11, 2026
    Concrete CMS
    Concrete CMS
    risk 0.39cvss —epss 0.00

    Concrete CMS 9.2.0 to 9.5.2 contain a missing authorization vulnerability in the REST API Groups list endpoint. The listGroups() method in concrete/src/Api/Controller/Groups.php registers a permissions checker callback that unconditionally returns true, so no per-object (tree…

  • CVE-2026-84819HigSep 10, 2026
    WordPress
    Wpadverts
    risk 0.39cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in WPAdverts <= 2.3.3 versions.

  • CVE-2026-84820HigSep 8, 2026
    WordPress
    Unlimited Elements For Elementor
    risk 0.39cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.17 versions.

  • CVE-2026-84759HigSep 2, 2026
    WordPress
    Activity Log
    risk 0.39cvss 7.1epss 0.00

    Unauthenticated Cross Site Request Forgery (CSRF) in Activity Log <= 2.13.1 versions.

Page 455 of 808