Vendor CVEs
WordPress
All CVEs
37,946 total · sorted by risk| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-65454 | Hig | 0.00 | 8.5 | 0.00 | Jul 23, 2026 | Contributor SQL Injection in Quiz And Survey Master <= 11.2.0 versions. | ||
| CVE-2026-65453 | Med | 0.00 | 5.3 | 0.00 | Jul 23, 2026 | Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions. | ||
| CVE-2026-65452 | Med | 0.00 | 5.3 | 0.00 | Jul 23, 2026 | Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions. | ||
| CVE-2026-65451 | Hig | 0.00 | 8.5 | 0.00 | Jul 23, 2026 | Contributor SQL Injection in MapSVG <= 8.14.0 versions. | ||
| CVE-2026-65450 | Hig | 0.00 | 8.5 | 0.00 | Jul 23, 2026 | Contributor SQL Injection in MapSVG <= 8.14.0 versions. | ||
| CVE-2026-65449 | Med | 0.00 | 6.5 | 0.00 | Jul 23, 2026 | Contributor Cross Site Scripting (XSS) in MapSVG <= 8.14.0 versions. | ||
| CVE-2026-61981 | Med | 0.00 | 5.4 | 0.00 | Jul 23, 2026 | Unauthenticated Cross Site Request Forgery (CSRF) in Simple Link Directory Pro <= 15.0.8 versions. | ||
| CVE-2026-61973 | Med | 0.00 | 4.3 | 0.00 | Jul 23, 2026 | Subscriber Broken Access Control in ShopLentor Pro <= 2.8.5 versions. | ||
| CVE-2026-61972 | Med | 0.00 | 5.3 | 0.00 | Jul 23, 2026 | Unauthenticated Broken Access Control in ShopLentor Pro <= 2.8.5 versions. | ||
| CVE-2026-61954 | Hig | 0.00 | 7.5 | 0.00 | Jul 23, 2026 | Unauthenticated Broken Access Control in PayU India <= 3.8.9 versions. | ||
| CVE-2026-61951 | Cri | 0.00 | 9.8 | 0.00 | Jul 23, 2026 | Unauthenticated Privilege Escalation in TrueBooker <= 1.2.3 versions. | ||
| CVE-2026-61950 | Cri | 0.00 | 9.3 | 0.00 | Jul 23, 2026 | Unauthenticated SQL Injection in TrueBooker <= 1.2.3 versions. | ||
| CVE-2026-61949 | Cri | 0.00 | 9.3 | 0.00 | Jul 23, 2026 | Unauthenticated SQL Injection in Bookly <= 27.7 versions. | ||
| CVE-2026-61948 | Cri | 0.00 | 9.3 | 0.00 | Jul 23, 2026 | Unauthenticated SQL Injection in WPDM – Premium Packages <= 6.2.0 versions. | ||
| CVE-2026-61947 | Hig | 0.00 | 7.1 | 0.00 | Jul 23, 2026 | Unauthenticated Cross Site Scripting (XSS) in Form Vibes – Database Manager for Forms <= 1.5.2 versions. | ||
| CVE-2026-61946 | Med | 0.00 | 6.5 | 0.00 | Jul 23, 2026 | Unauthenticated Insecure Direct Object References (IDOR) in Easy Appointments <= 3.12.27 versions. | ||
| CVE-2026-61945 | Med | 0.00 | 6.5 | 0.00 | Jul 23, 2026 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in MultiVendorX WooCommerce Product Stock Alert allows Retrieve Embedded Sensitive Data. This issue affects WooCommerce Product Stock Alert: from n/a through 3.0.6. | ||
| CVE-2026-61944 | Hig | 0.00 | 7.1 | 0.00 | Jul 23, 2026 | Unauthenticated Cross Site Scripting (XSS) in Bookly <= 27.7 versions. | ||
| CVE-2026-61943 | Hig | 0.00 | 7.5 | 0.00 | Jul 23, 2026 | Unauthenticated Broken Access Control in WPDM – Premium Packages <= 6.2.0 versions. | ||
| CVE-2026-59555 | Cri | 0.00 | 10.0 | 0.01 | Jul 23, 2026 | Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.3 versions. | ||
| CVE-2026-59554 | Hig | 0.00 | 7.5 | 0.00 | Jul 23, 2026 | Unauthenticated Broken Authentication in Ziina <= 1.2.21 versions. | ||
| CVE-2026-59547 | Hig | 0.00 | 7.5 | 0.00 | Jul 23, 2026 | Unauthenticated Broken Access Control in Payment Gateway for PayPal on WooCommerce <= 9.1.4 versions. | ||
| CVE-2026-59545 | Hig | 0.00 | 8.1 | 0.00 | Jul 23, 2026 | Unauthenticated Broken Authentication in miniOrange Discord Integration <= 2.2.4 versions. | ||
| CVE-2026-59544 | Cri | 0.00 | 9.8 | 0.01 | Jul 23, 2026 | Unauthenticated PHP Object Injection in Thrive Quiz Builder <= 10.9.3.0 versions. | ||
| CVE-2026-59543 | Cri | 0.00 | 9.9 | 0.01 | Jul 23, 2026 | Subscriber Remote Code Execution (RCE) in Advanced Views <= 3.8.11 versions. | ||
| CVE-2026-59542 | Hig | 0.00 | 7.7 | 0.00 | Jul 23, 2026 | Subscriber Arbitrary File Deletion in Kali Forms <= 2.4.18 versions. | ||
| CVE-2026-59541 | Hig | 0.00 | 8.8 | 0.00 | Jul 23, 2026 | Subscriber Privilege Escalation in WP BASE Booking <= 6.3.1 versions. | ||
| CVE-2026-59540 | Cri | 0.00 | 9.8 | 0.00 | Jul 23, 2026 | Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 3.9.6 versions. | ||
| CVE-2026-59526 | Cri | 0.00 | 9.3 | 0.00 | Jul 23, 2026 | Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions. | ||
| CVE-2026-59525 | Cri | 0.00 | 9.3 | 0.00 | Jul 23, 2026 | Unauthenticated SQL Injection in Participants Database <= 2.7.8.3 versions. | ||
| CVE-2026-59524 | Med | 0.00 | 6.5 | 0.00 | Jul 23, 2026 | Unauthenticated Broken Authentication in Easy Digital Downloads <= 3.6.7 versions. | ||
| CVE-2026-59522 | Med | 0.00 | 6.5 | 0.00 | Jul 23, 2026 | Subscriber Broken Access Control in WP ERP <= 1.17.5 versions. | ||
| CVE-2026-59517 | Hig | 0.00 | 7.1 | 0.00 | Jul 23, 2026 | Unauthenticated Cross Site Scripting (XSS) in Easy Form Builder <= 4.0.12 versions. | ||
| CVE-2026-59514 | Cri | 0.00 | 9.3 | 0.00 | Jul 23, 2026 | Unauthenticated SQL Injection in Buddyboss Platform <= 3.0.5 versions. | ||
| CVE-2026-59513 | Med | 0.00 | 6.5 | 0.00 | Jul 23, 2026 | Subscriber Cross Site Scripting (XSS) in Masteriyo - LMS <= 2.3.0 versions. | ||
| CVE-2026-59512 | Hig | 0.00 | 7.1 | 0.00 | Jul 23, 2026 | Unauthenticated Cross Site Scripting (XSS) in Product Enquiry for WooCommerce <= 2.2.34.43 versions. | ||
| CVE-2026-57809 | Hig | 0.00 | 7.1 | 0.00 | Jul 23, 2026 | Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.34.0 versions. | ||
| CVE-2026-57808 | Med | 0.00 | 6.5 | 0.00 | Jul 23, 2026 | Subscriber Arbitrary Content Deletion in WP EasyPay <= 4.5.0 versions. | ||
| CVE-2026-57785 | Hig | 0.00 | 8.8 | 0.00 | Jul 23, 2026 | Unauthenticated Cross Site Request Forgery (CSRF) in ApusListing <= 1.2.63 versions. | ||
| CVE-2026-57784 | Cri | 0.00 | 9.6 | 0.00 | Jul 23, 2026 | Unauthenticated Cross Site Request Forgery (CSRF) in Ninja Forms File Uploads Extension <= 3.3.26 versions. | ||
| CVE-2026-57769 | Hig | 0.00 | 7.1 | 0.00 | Jul 23, 2026 | Unauthenticated Cross Site Scripting (XSS) in Grand Photography <= 5.7.8 versions. | ||
| CVE-2026-57767 | Hig | 0.00 | 7.1 | 0.00 | Jul 23, 2026 | Unauthenticated Cross Site Scripting (XSS) in WP Google Maps Pro <= 10.1.02 versions. | ||
| CVE-2026-57735 | Hig | 0.00 | 7.1 | 0.00 | Jul 23, 2026 | Unauthenticated Cross Site Scripting (XSS) in Breakdance <= 2.7.1 versions. | ||
| CVE-2026-57717 | Med | 0.00 | 6.5 | 0.00 | Jul 23, 2026 | Unauthenticated Broken Access Control in Knit Pay <= 9.6.0.0 versions. | ||
| CVE-2026-57716 | Med | 0.00 | 5.3 | 0.00 | Jul 23, 2026 | Unauthenticated Arbitrary File Deletion in Broadcast Live Video <= 7.2.4 versions. | ||
| CVE-2026-57704 | Hig | 0.00 | 7.1 | 0.00 | Jul 23, 2026 | Unauthenticated Cross Site Scripting (XSS) in Smart Manager <= 8.90.0 versions. | ||
| CVE-2026-57703 | Med | 0.00 | 6.3 | 0.00 | Jul 23, 2026 | Subscriber Broken Access Control in Sunshine Photo Cart <= 3.6.10.1 versions. | ||
| CVE-2026-57701 | Hig | 0.00 | 7.1 | 0.00 | Jul 23, 2026 | Unauthenticated Cross Site Scripting (XSS) in Real Estate Manager Pro <= 12.8.5 versions. | ||
| CVE-2026-57699 | Hig | 0.00 | 7.1 | 0.00 | Jul 23, 2026 | Subscriber Cross Site Scripting (XSS) in Slider Pro <= 4.8.13 versions. | ||
| CVE-2026-57696 | Hig | 0.00 | 7.1 | 0.00 | Jul 23, 2026 | Contributor Arbitrary File Deletion in Picture Gallery <= 1.6.5 versions. |
- risk 0.00cvss 8.5epss 0.00
Contributor SQL Injection in Quiz And Survey Master <= 11.2.0 versions.
- risk 0.00cvss 5.3epss 0.00
Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions.
- risk 0.00cvss 5.3epss 0.00
Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions.
- risk 0.00cvss 8.5epss 0.00
Contributor SQL Injection in MapSVG <= 8.14.0 versions.
- risk 0.00cvss 8.5epss 0.00
Contributor SQL Injection in MapSVG <= 8.14.0 versions.
- risk 0.00cvss 6.5epss 0.00
Contributor Cross Site Scripting (XSS) in MapSVG <= 8.14.0 versions.
- risk 0.00cvss 5.4epss 0.00
Unauthenticated Cross Site Request Forgery (CSRF) in Simple Link Directory Pro <= 15.0.8 versions.
- risk 0.00cvss 4.3epss 0.00
Subscriber Broken Access Control in ShopLentor Pro <= 2.8.5 versions.
- risk 0.00cvss 5.3epss 0.00
Unauthenticated Broken Access Control in ShopLentor Pro <= 2.8.5 versions.
- risk 0.00cvss 7.5epss 0.00
Unauthenticated Broken Access Control in PayU India <= 3.8.9 versions.
- risk 0.00cvss 9.8epss 0.00
Unauthenticated Privilege Escalation in TrueBooker <= 1.2.3 versions.
- risk 0.00cvss 9.3epss 0.00
Unauthenticated SQL Injection in TrueBooker <= 1.2.3 versions.
- risk 0.00cvss 9.3epss 0.00
Unauthenticated SQL Injection in Bookly <= 27.7 versions.
- risk 0.00cvss 9.3epss 0.00
Unauthenticated SQL Injection in WPDM – Premium Packages <= 6.2.0 versions.
- risk 0.00cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Form Vibes – Database Manager for Forms <= 1.5.2 versions.
- risk 0.00cvss 6.5epss 0.00
Unauthenticated Insecure Direct Object References (IDOR) in Easy Appointments <= 3.12.27 versions.
- risk 0.00cvss 6.5epss 0.00
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in MultiVendorX WooCommerce Product Stock Alert allows Retrieve Embedded Sensitive Data. This issue affects WooCommerce Product Stock Alert: from n/a through 3.0.6.
- risk 0.00cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Bookly <= 27.7 versions.
- risk 0.00cvss 7.5epss 0.00
Unauthenticated Broken Access Control in WPDM – Premium Packages <= 6.2.0 versions.
- risk 0.00cvss 10.0epss 0.01
Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.3 versions.
- risk 0.00cvss 7.5epss 0.00
Unauthenticated Broken Authentication in Ziina <= 1.2.21 versions.
- risk 0.00cvss 7.5epss 0.00
Unauthenticated Broken Access Control in Payment Gateway for PayPal on WooCommerce <= 9.1.4 versions.
- risk 0.00cvss 8.1epss 0.00
Unauthenticated Broken Authentication in miniOrange Discord Integration <= 2.2.4 versions.
- risk 0.00cvss 9.8epss 0.01
Unauthenticated PHP Object Injection in Thrive Quiz Builder <= 10.9.3.0 versions.
- risk 0.00cvss 9.9epss 0.01
Subscriber Remote Code Execution (RCE) in Advanced Views <= 3.8.11 versions.
- risk 0.00cvss 7.7epss 0.00
Subscriber Arbitrary File Deletion in Kali Forms <= 2.4.18 versions.
- risk 0.00cvss 8.8epss 0.00
Subscriber Privilege Escalation in WP BASE Booking <= 6.3.1 versions.
- risk 0.00cvss 9.8epss 0.00
Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 3.9.6 versions.
- risk 0.00cvss 9.3epss 0.00
Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions.
- risk 0.00cvss 9.3epss 0.00
Unauthenticated SQL Injection in Participants Database <= 2.7.8.3 versions.
- risk 0.00cvss 6.5epss 0.00
Unauthenticated Broken Authentication in Easy Digital Downloads <= 3.6.7 versions.
- risk 0.00cvss 6.5epss 0.00
Subscriber Broken Access Control in WP ERP <= 1.17.5 versions.
- risk 0.00cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Easy Form Builder <= 4.0.12 versions.
- risk 0.00cvss 9.3epss 0.00
Unauthenticated SQL Injection in Buddyboss Platform <= 3.0.5 versions.
- risk 0.00cvss 6.5epss 0.00
Subscriber Cross Site Scripting (XSS) in Masteriyo - LMS <= 2.3.0 versions.
- risk 0.00cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Product Enquiry for WooCommerce <= 2.2.34.43 versions.
- risk 0.00cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.34.0 versions.
- risk 0.00cvss 6.5epss 0.00
Subscriber Arbitrary Content Deletion in WP EasyPay <= 4.5.0 versions.
- risk 0.00cvss 8.8epss 0.00
Unauthenticated Cross Site Request Forgery (CSRF) in ApusListing <= 1.2.63 versions.
- risk 0.00cvss 9.6epss 0.00
Unauthenticated Cross Site Request Forgery (CSRF) in Ninja Forms File Uploads Extension <= 3.3.26 versions.
- risk 0.00cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Grand Photography <= 5.7.8 versions.
- risk 0.00cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in WP Google Maps Pro <= 10.1.02 versions.
- risk 0.00cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Breakdance <= 2.7.1 versions.
- risk 0.00cvss 6.5epss 0.00
Unauthenticated Broken Access Control in Knit Pay <= 9.6.0.0 versions.
- risk 0.00cvss 5.3epss 0.00
Unauthenticated Arbitrary File Deletion in Broadcast Live Video <= 7.2.4 versions.
- risk 0.00cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Smart Manager <= 8.90.0 versions.
- risk 0.00cvss 6.3epss 0.00
Subscriber Broken Access Control in Sunshine Photo Cart <= 3.6.10.1 versions.
- risk 0.00cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Real Estate Manager Pro <= 12.8.5 versions.
- risk 0.00cvss 7.1epss 0.00
Subscriber Cross Site Scripting (XSS) in Slider Pro <= 4.8.13 versions.
- risk 0.00cvss 7.1epss 0.00
Contributor Arbitrary File Deletion in Picture Gallery <= 1.6.5 versions.
Page 725 of 759