VYPR
← WordPress

Vendor CVEs

WordPress

All CVEs

33,183 total · sorted by risk
  • CVE-2026-12120Jun 18, 2026
    WordPress
    FireBox Popups
    risk 0.00cvss —epss 0.00

    The FireBox Popups – Increase Sales and Grow Your Email List plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.7 via the 'form_id' parameter. This makes it possible for unauthenticated attackers to extract download a…

  • CVE-2026-11777Jun 18, 2026
    WordPress
    Form Maker
    risk 0.00cvss —epss 0.00

    The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to generic SQL Injection via the 'name' parameter in all versions up to, and including, 1.15.43 due to insufficient escaping on the user supplied parameter and lack of…

  • CVE-2026-9199Jun 18, 2026
    WordPress
    Accessibility Checker
    risk 0.00cvss —epss 0.00

    The Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.42.1. This is due to the plugin not properly verifying that a user is authorized to perform…

  • CVE-2026-12407Jun 18, 2026
    WordPress
    E2pdf
    risk 0.00cvss —epss 0.00

    The E2Pdf – Export Pdf Tool for WordPress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.32.26. This is due to the screen_action() function lacking a dedicated capability check and nonce verification — when invoked via the…

  • CVE-2026-10023Jun 18, 2026
    WordPress
    Dokan
    risk 0.00cvss —epss 0.00

    The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.0.3 via the change_order_status, add_order_note,…

  • CVE-2026-54812Jun 17, 2026
    WordPress
    Motors
    risk 0.00cvss —epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Motors allows Blind SQL Injection. This issue affects Motors: from n/a through 1.4.109.

  • CVE-2026-54810Jun 17, 2026
    WordPress
    Nexi XPay
    risk 0.00cvss —epss 0.00

    Missing Authorization vulnerability in Nexi Payments Nexi XPay allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Nexi XPay: from n/a through 8.3.1.

  • CVE-2026-54809Jun 17, 2026
    WordPress
    GIFT4U
    risk 0.00cvss —epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VillaTheme GIFT4U allows Blind SQL Injection. This issue affects GIFT4U: from n/a through 1.0.10.

  • CVE-2026-54808Jun 17, 2026
    WordPress
    Wp Travel Blocks
    risk 0.00cvss —epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel WP Travel Gutenberg Blocks allows Blind SQL Injection. This issue affects WP Travel Gutenberg Blocks: from n/a through 3.9.4.

  • CVE-2025-69189Jun 17, 2026
    WordPress
    Jobbank
    risk 0.00cvss —epss 0.00

    Missing Authorization vulnerability in EMV JobBank allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects JobBank: from n/a through 1.2.3.

  • CVE-2025-69128Jun 17, 2026
    WordPress
    JobCareer
    risk 0.00cvss —epss 0.00

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in EMV JobCareer allows Path Traversal. This issue affects JobCareer: from n/a through 7.3.

  • CVE-2025-60236Jun 17, 2026
    WordPress
    Creatify
    risk 0.00cvss —epss 0.00

    Deserialization of Untrusted Data vulnerability in EMV Creatify allows Object Injection. This issue affects Creatify: from n/a through 1.5.

  • CVE-2025-60231Jun 17, 2026
    WordPress
    The Hospital
    risk 0.00cvss —epss 0.00

    Deserialization of Untrusted Data vulnerability in EMV The Hospital nrghospital allows Object Injection. This issue affects The Hospital: from n/a through 1.8.1.

  • CVE-2026-54813Jun 17, 2026
    WordPress
    SureDash
    risk 0.00cvss —epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Brainstorm Force SureDash allows Blind SQL Injection. This issue affects SureDash: from n/a through 1.8.0.

  • CVE-2026-54814Jun 17, 2026
    WordPress
    Motors
    risk 0.00cvss —epss 0.00

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Motors allows PHP Local File Inclusion. This issue affects Motors: from n/a through 1.4.109.

  • CVE-2026-54815Jun 17, 2026
    WordPress
    Cargo Shipping Location for WooCommerce
    risk 0.00cvss —epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cargo RD Cargo Shipping Location for WooCommerce allows Blind SQL Injection. This issue affects Cargo Shipping Location for WooCommerce: from n/a through 5.6.

  • CVE-2026-54816Jun 17, 2026
    WordPress
    Advanced Ads
    risk 0.00cvss —epss 0.00

    Improper Control of Generation of Code ('Code Injection') vulnerability in Monetizemore Advanced Ads allows Remote Code Inclusion. This issue affects Advanced Ads: from n/a through 2.0.21.

  • CVE-2026-54817Jun 17, 2026
    WordPress
    Mstore API
    risk 0.00cvss —epss 0.00

    Authentication Bypass Using an Alternate Path or Channel vulnerability in FluxBuilder MStore API allows Password Recovery Exploitation. This issue affects MStore API: from n/a through 4.18.4.

  • CVE-2026-54818Jun 17, 2026
    WordPress
    Slimstat Analytics
    risk 0.00cvss —epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VeronaLabs Slimstat Analytics allows Blind SQL Injection. This issue affects Slimstat Analytics: from n/a through 5.4.11.

  • CVE-2026-54819Jun 17, 2026
    WordPress
    Listdom
    risk 0.00cvss —epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Webilia Inc. Listdom allows Blind SQL Injection. This issue affects Listdom: from n/a through 5.4.0.

  • CVE-2025-60230Jun 17, 2026
    WordPress
    The Barber Shop
    risk 0.00cvss —epss 0.00

    Deserialization of Untrusted Data vulnerability in Themeton The Barber Shop allows Object Injection. This issue affects The Barber Shop: from n/a through 1.9.

  • CVE-2025-60229Jun 17, 2026
    WordPress
    Lagom
    risk 0.00cvss —epss 0.00

    Deserialization of Untrusted Data vulnerability in Themeton Lagom allows Object Injection. This issue affects Lagom: from n/a through 2.0.

  • CVE-2026-52716Jun 17, 2026
    WordPress
    Workscout Core
    risk 0.00cvss —epss 0.00

    Unauthenticated Arbitrary File Deletion in WorkScout-Core <= 1.7.11 versions.

  • CVE-2026-52707Jun 17, 2026
    WordPress
    Kastell
    risk 0.00cvss —epss 0.00

    Unauthenticated Local File Inclusion in Kastell <= 2.0 versions.

  • CVE-2026-49108Jun 17, 2026
    WordPress
    Moderno
    risk 0.00cvss —epss 0.00

    Unauthenticated PHP Object Injection in Moderno < 1.43 versions.

  • CVE-2026-40757Jun 17, 2026
    WordPress
    Château
    risk 0.00cvss —epss 0.00

    Unauthenticated PHP Object Injection in Château <= 1.2.1 versions.

  • CVE-2026-40756Jun 17, 2026
    WordPress
    Zoya
    risk 0.00cvss —epss 0.00

    Unauthenticated PHP Object Injection in Zoya <= 1.4 versions.

  • CVE-2026-40752Jun 17, 2026
    WordPress
    Manufaktur Solutions
    risk 0.00cvss —epss 0.00

    Unauthenticated PHP Object Injection in Manufaktur Solutions <= 1.1.1 versions.

  • CVE-2026-40738Jun 17, 2026
    WordPress
    Eldon
    risk 0.00cvss —epss 0.00

    Unauthenticated PHP Object Injection in Eldon <= 1.4.1 versions.

  • CVE-2026-40733Jun 17, 2026
    WordPress
    ShiftUp
    risk 0.00cvss —epss 0.00

    Unauthenticated PHP Object Injection in ShiftUp <= 1.3 versions.

  • CVE-2026-40720Jun 17, 2026
    WordPress
    Royal Elementor Addons
    risk 0.00cvss —epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Royal Elementor Addons Pro < 1.7.1041 versions.

  • CVE-2026-39590Jun 17, 2026
    WordPress
    Atomlab
    risk 0.00cvss —epss 0.00

    Unauthenticated Local File Inclusion in Atomlab <= 2.4.5 versions.

  • CVE-2026-39576Jun 17, 2026
    WordPress
    SingleMalt
    risk 0.00cvss —epss 0.00

    Unauthenticated PHP Object Injection in SingleMalt <= 1.5 versions.

  • CVE-2026-39560Jun 17, 2026
    WordPress
    Hiroshi
    risk 0.00cvss —epss 0.00

    Unauthenticated PHP Object Injection in Hiroshi <= 1.5.1 versions.

  • CVE-2026-39559Jun 17, 2026
    WordPress
    Uppercase
    risk 0.00cvss —epss 0.00

    Unauthenticated Local File Inclusion in Uppercase < 1.2.2 versions.

  • CVE-2026-39556Jun 17, 2026
    WordPress
    Konsept
    risk 0.00cvss —epss 0.00

    Unauthenticated PHP Object Injection in Konsept <= 1.9 versions.

  • CVE-2026-39523Jun 17, 2026
    WordPress
    Solene Core
    risk 0.00cvss —epss 0.00

    Unauthenticated Local File Inclusion in Solene Core <= 2.3.2 versions.

  • CVE-2026-39445Jun 17, 2026
    WordPress
    Alukas
    risk 0.00cvss —epss 0.00

    Unauthenticated PHP Object Injection in Alukas < 3.0.0 versions.

  • CVE-2026-39442Jun 17, 2026
    WordPress
    Pressmart
    risk 0.00cvss —epss 0.00

    Unauthenticated PHP Object Injection in PressMart <= 1.2.26 versions.

  • CVE-2025-69175Jun 17, 2026
    WordPress
    Line Agency
    risk 0.00cvss —epss 0.00

    Unauthenticated Local File Inclusion in Line Agency <= 1.3.1 versions.

  • CVE-2025-69174Jun 17, 2026
    WordPress
    Etude
    risk 0.00cvss —epss 0.00

    Unauthenticated Local File Inclusion in Etude <= 1.6 versions.

  • CVE-2025-69170Jun 17, 2026
    WordPress
    Eventicity
    risk 0.00cvss —epss 0.00

    Unauthenticated Local File Inclusion in Eventicity <= 1.5 versions.

  • CVE-2025-69166Jun 17, 2026
    WordPress
    Gunslinger
    risk 0.00cvss —epss 0.00

    Unauthenticated Local File Inclusion in Gunslinger <= 1.7 versions.

  • CVE-2025-69164Jun 17, 2026
    WordPress
    Skyward
    risk 0.00cvss —epss 0.00

    Unauthenticated Local File Inclusion in Skyward <= 1.10 versions.

  • CVE-2025-69158Jun 17, 2026
    WordPress
    Granola
    risk 0.00cvss —epss 0.00

    Unauthenticated Local File Inclusion in Granola <= 1.13 versions.

  • CVE-2025-69157Jun 17, 2026
    WordPress
    Gamic
    risk 0.00cvss —epss 0.00

    Unauthenticated Local File Inclusion in Gamic <= 1.15 versions.

  • CVE-2025-69144Jun 17, 2026
    WordPress
    Preservation
    risk 0.00cvss —epss 0.00

    Unauthenticated Local File Inclusion in Preservation <= 1.10 versions.

  • CVE-2025-69140Jun 17, 2026
    WordPress
    sweetdate-core
    risk 0.00cvss —epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in SweetDate Core < 1.1.5 versions.

  • CVE-2025-69130Jun 17, 2026
    WordPress
    Entrepreneur
    risk 0.00cvss —epss 0.00

    Subscriber PHP Object Injection in Entrepreneur - Booking for Small Businesses WordPress Theme <= 3.1.3 versions.

  • CVE-2025-69127Jun 17, 2026
    WordPress
    Plumbing
    risk 0.00cvss —epss 0.00

    Unauthenticated PHP Object Injection in Plumbing <= 1.6 versions.

Page 645 of 664