Vendor CVEs
WordPress
All CVEs
38,650 total · sorted by risk| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-54827 | Cri | 0.00 | 9.3 | 0.00 | Jun 26, 2026 | Unauthenticated SQL Injection in Real Estate 7 <= 3.5.9 versions. | ||
| CVE-2026-54826 | Hig | 0.00 | 7.6 | 0.00 | Jun 26, 2026 | Subscriber Insecure Direct Object References (IDOR) in SupportCandy <= 3.4.6 versions. | ||
| CVE-2026-54825 | Cri | 0.00 | 9.3 | 0.00 | Jun 26, 2026 | Unauthenticated SQL Injection in wpDataTables <= 7.4 versions. | ||
| CVE-2026-54824 | Hig | 0.00 | 7.5 | 0.00 | Jun 26, 2026 | Unauthenticated Sensitive Data Exposure in Ads by WPQuads <= 3.0.3 versions. | ||
| CVE-2026-54820 | Cri | 0.00 | 9.3 | 0.00 | Jun 26, 2026 | Unauthenticated SQL Injection in JetBooking <= 4.0.4.1 versions. | ||
| CVE-2026-52701 | Med | 0.00 | 6.5 | 0.00 | Jun 26, 2026 | Unauthenticated Broken Access Control in User Registration <= 5.2.2 versions. | ||
| CVE-2026-24547 | Med | 0.00 | 5.3 | 0.00 | Jun 26, 2026 | Unauthenticated Broken Access Control in SiteGround Email Marketing <= 1.7.5 versions. | ||
| CVE-2026-57620 | Med | 0.00 | 6.5 | 0.00 | Jun 26, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tim Strifler Exclusive Addons Elementor allows Stored XSS. This issue affects Exclusive Addons Elementor: from n/a through 2.7.9.8. | ||
| CVE-2026-1869 | Med | 0.00 | 6.5 | 0.00 | Jun 26, 2026 | The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to unauthorized modification of data due to missing validation checks in the… | ||
| CVE-2026-8380 | Med | 0.00 | 6.5 | 0.00 | Jun 26, 2026 | The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly verify ownership of every targeted post before permanent deletion, allowing authenticated users with author-level access and above to permanently delete arbitrary posts and pages. When the Frontend… | ||
| CVE-2026-10835 | Hig | 0.00 | 7.7 | 0.00 | Jun 26, 2026 | The SALESmanago & Leadoo WordPress plugin before 3.11.3 does not properly sanitise and escape a parameter passed to one of its AJAX actions before using it in a SQL statement, and fails to enforce authorisation on that action, allowing authenticated users with minimal… | ||
| CVE-2026-10823 | Hig | 0.00 | 7.5 | 0.02 | Jun 26, 2026 | The YMC Filter WordPress plugin before 3.11.3 does not properly authorize access to one of its REST API endpoints and does not validate a user-supplied query parameter, allowing unauthenticated attackers to retrieve the titles and content of private, draft, and other non-public… | ||
| CVE-2026-13226 | Med | 0.00 | 6.5 | 0.00 | Jun 26, 2026 | The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'after' parameter in all versions up to, and including, 4.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient… | ||
| CVE-2026-57700 | Cri | 0.00 | 10.0 | 0.01 | Jun 25, 2026 | Unrestricted Upload of File with Dangerous Type vulnerability in Daan.Dev OMGF Pro allows Using Malicious Files. This issue affects OMGF Pro: from n/a through 5.2.6. | ||
| CVE-2026-57619 | Med | 0.00 | 6.5 | 0.00 | Jun 25, 2026 | Contributor Sensitive Data Exposure in Elementor Website Builder <= 4.1.3 versions. | ||
| CVE-2026-57429 | Med | 0.00 | 6.5 | 0.00 | Jun 25, 2026 | Contributor Broken Access Control in Slim SEO <= 4.6.2 versions. | ||
| CVE-2026-56071 | Hig | 0.00 | 7.1 | 0.00 | Jun 25, 2026 | Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.53.1 versions. | ||
| CVE-2026-56054 | Hig | 0.00 | 7.7 | 0.00 | Jun 25, 2026 | Subscriber Arbitrary File Deletion in JS Help Desk <= 3.1.1 versions. | ||
| CVE-2026-56053 | Hig | 0.00 | 8.8 | 0.01 | Jun 25, 2026 | Subscriber PHP Object Injection in EventPrime <= 4.3.4.1 versions. | ||
| CVE-2026-56051 | Hig | 0.00 | 7.1 | 0.00 | Jun 25, 2026 | Unauthenticated Cross Site Scripting (XSS) in TablePress <= 3.3.1 versions. | ||
| CVE-2026-56050 | Med | 0.00 | 6.5 | 0.00 | Jun 25, 2026 | Improper Access Control vulnerability in Themeisle PPOM for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PPOM for WooCommerce: from n/a through 33.0.18. | ||
| CVE-2026-56049 | Hig | 0.00 | 8.5 | 0.01 | Jun 25, 2026 | Contributor Remote Code Execution (RCE) in Post Snippets <= 4.0.19 versions. | ||
| CVE-2026-56042 | Hig | 0.00 | 7.1 | 0.00 | Jun 25, 2026 | Customer Cross Site Scripting (XSS) in Advanced Order Export For WooCommerce <= 4.0.9 versions. | ||
| CVE-2026-56023 | Med | 0.00 | 5.4 | 0.00 | Jun 25, 2026 | Customer Broken Access Control in UPI QR Code Payment Gateway for WooCommerce <= 1.6.2 versions. | ||
| CVE-2026-56014 | Hig | 0.00 | 7.1 | 0.00 | Jun 25, 2026 | Unauthenticated Cross Site Scripting (XSS) in Master Slider <= 3.11.2 versions. | ||
| CVE-2026-56013 | Med | 0.00 | 6.5 | 0.00 | Jun 25, 2026 | Unauthenticated Insecure Direct Object References (IDOR) in License Manager for WooCommerce <= 3.0.15 versions. | ||
| CVE-2026-56006 | Hig | 0.00 | 7.1 | 0.00 | Jun 25, 2026 | Unauthenticated Cross Site Scripting (XSS) in H5P <= 1.17.6 versions. | ||
| CVE-2026-54849 | Cri | 0.00 | 9.3 | 0.00 | Jun 25, 2026 | Unauthenticated SQL Injection in Premmerce Wishlist for WooCommerce <= 1.1.11 versions. | ||
| CVE-2026-54848 | Hig | 0.00 | 8.3 | 0.00 | Jun 25, 2026 | Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal APIExperts Square for WooCommerce allows Retrieve Embedded Sensitive Data. This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.3. | ||
| CVE-2026-54845 | Hig | 0.00 | 8.1 | 0.00 | Jun 25, 2026 | Unauthenticated Local File Inclusion in MDTF <= 1.3.8 versions. | ||
| CVE-2026-54844 | Hig | 0.00 | 7.5 | 0.00 | Jun 25, 2026 | Unauthenticated Broken Access Control in CheckView Automated Testing <= 2.1.0 versions. | ||
| CVE-2026-54843 | Cri | 0.00 | 9.3 | 0.00 | Jun 25, 2026 | Unauthenticated SQL Injection in MDTF <= 1.3.7 versions. | ||
| CVE-2026-54842 | Hig | 0.00 | 8.1 | 0.00 | Jun 25, 2026 | Missing Authorization vulnerability in Royal Plugins Royal MCP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Royal MCP: from n/a through 1.4.25. | ||
| CVE-2026-54841 | Hig | 0.00 | 7.5 | 0.00 | Jun 25, 2026 | Unauthenticated Sensitive Data Exposure in Vitepos <= 3.4.2 versions. | ||
| CVE-2026-54838 | Hig | 0.00 | 8.5 | 0.00 | Jun 25, 2026 | Subscriber SQL Injection in WC Vendors Marketplace <= 2.6.8 versions. | ||
| CVE-2026-54836 | Cri | 0.00 | 9.3 | 0.01 | Jun 25, 2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YMC Filter allows SQL Injection. This issue affects YMC Filter: from n/a through 3.11.5. | ||
| CVE-2026-54830 | Hig | 0.00 | 7.5 | 0.00 | Jun 25, 2026 | Unauthenticated Broken Access Control in Five Star Restaurant Reservations <= 2.7.19 versions. | ||
| CVE-2026-54829 | Hig | 0.00 | 7.5 | 0.00 | Jun 25, 2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jacob N. Breetvelt WP Photo Album Plus allows Blind SQL Injection. This issue affects WP Photo Album Plus: from n/a through 9.1.13.005. | ||
| CVE-2026-54828 | Hig | 0.00 | 7.5 | 0.00 | Jun 25, 2026 | Unauthenticated Broken Access Control in Motors <= 1.4.109 versions. | ||
| CVE-2026-54823 | Cri | 0.00 | 9.9 | 0.01 | Jun 25, 2026 | Contributor Remote Code Execution (RCE) in Widget Options <= 4.2.3 versions. | ||
| CVE-2026-54822 | Hig | 0.00 | 8.5 | 0.00 | Jun 25, 2026 | Subscriber SQL Injection in SALESmanago & Leadoo <= 3.11.2 versions. | ||
| CVE-2026-54821 | Hig | 0.00 | 7.4 | 0.00 | Jun 25, 2026 | Subscriber Sensitive Data Exposure in Visual Link Preview <= 2.3.1 versions. | ||
| CVE-2026-27366 | Hig | 0.00 | 7.5 | 0.00 | Jun 25, 2026 | Unauthenticated Broken Access Control in MainWP Child <= 6.1.1 versions. | ||
| CVE-2026-12937 | Hig | 0.00 | 7.5 | 0.01 | Jun 25, 2026 | The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin plugin for WordPress is vulnerable to generic SQL Injection via the 'post_id' parameter in all versions up to, and including, 2.22.7 due to insufficient escaping on the user supplied parameter… | ||
| CVE-2026-9702 | Hig | 0.00 | 7.5 | 0.00 | Jun 25, 2026 | The InPost PL WordPress plugin before 1.9.1 does not verify that the request originates from the legitimate buyer before allowing the WooCommerce order parcel-locker destination to be updated, allowing unauthenticated attackers to silently redirect the shipping destination of… | ||
| CVE-2026-5305 | Hig | 0.00 | 8.8 | 0.01 | Jun 25, 2026 | The Email Address Encoder WordPress plugin before 1.0.25, email-encoder-premium WordPress plugin before 0.3.12 does not properly handle email replacement, which could allow unauthenticated users to perform Stored XSS attacks | ||
| CVE-2026-10824 | Med | 0.00 | 6.5 | 0.00 | Jun 25, 2026 | The Masteriyo LMS WordPress plugin before 2.2.1 does not perform authorization checks in a course-progress REST API controller, allowing unauthenticated users to read and permanently delete any user's course-progress records. | ||
| CVE-2026-2508 | Med | 0.00 | 6.5 | 0.00 | Jun 25, 2026 | The Gravity Forms Booking plugin for WordPress is vulnerable to time-based SQL Injection via the ‘staff_id’ parameter in all versions up to, and including, 2.7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing… | ||
| CVE-2026-12079 | Med | 0.00 | 6.5 | 0.00 | Jun 25, 2026 | The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the ’orderby’ parameter in all versions up to, and including, 5.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. … | ||
| CVE-2026-12077 | Hig | 0.00 | 7.5 | 0.00 | Jun 25, 2026 | The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the via 'latitude' and 'longitude' parameters in all versions up to, and including, 5.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the… |
- risk 0.00cvss 9.3epss 0.00
Unauthenticated SQL Injection in Real Estate 7 <= 3.5.9 versions.
- risk 0.00cvss 7.6epss 0.00
Subscriber Insecure Direct Object References (IDOR) in SupportCandy <= 3.4.6 versions.
- risk 0.00cvss 9.3epss 0.00
Unauthenticated SQL Injection in wpDataTables <= 7.4 versions.
- risk 0.00cvss 7.5epss 0.00
Unauthenticated Sensitive Data Exposure in Ads by WPQuads <= 3.0.3 versions.
- risk 0.00cvss 9.3epss 0.00
Unauthenticated SQL Injection in JetBooking <= 4.0.4.1 versions.
- risk 0.00cvss 6.5epss 0.00
Unauthenticated Broken Access Control in User Registration <= 5.2.2 versions.
- risk 0.00cvss 5.3epss 0.00
Unauthenticated Broken Access Control in SiteGround Email Marketing <= 1.7.5 versions.
- risk 0.00cvss 6.5epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tim Strifler Exclusive Addons Elementor allows Stored XSS. This issue affects Exclusive Addons Elementor: from n/a through 2.7.9.8.
- risk 0.00cvss 6.5epss 0.00
The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to unauthorized modification of data due to missing validation checks in the…
- risk 0.00cvss 6.5epss 0.00
The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly verify ownership of every targeted post before permanent deletion, allowing authenticated users with author-level access and above to permanently delete arbitrary posts and pages. When the Frontend…
- risk 0.00cvss 7.7epss 0.00
The SALESmanago & Leadoo WordPress plugin before 3.11.3 does not properly sanitise and escape a parameter passed to one of its AJAX actions before using it in a SQL statement, and fails to enforce authorisation on that action, allowing authenticated users with minimal…
- risk 0.00cvss 7.5epss 0.02
The YMC Filter WordPress plugin before 3.11.3 does not properly authorize access to one of its REST API endpoints and does not validate a user-supplied query parameter, allowing unauthenticated attackers to retrieve the titles and content of private, draft, and other non-public…
- risk 0.00cvss 6.5epss 0.00
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'after' parameter in all versions up to, and including, 4.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient…
- risk 0.00cvss 10.0epss 0.01
Unrestricted Upload of File with Dangerous Type vulnerability in Daan.Dev OMGF Pro allows Using Malicious Files. This issue affects OMGF Pro: from n/a through 5.2.6.
- risk 0.00cvss 6.5epss 0.00
Contributor Sensitive Data Exposure in Elementor Website Builder <= 4.1.3 versions.
- risk 0.00cvss 6.5epss 0.00
Contributor Broken Access Control in Slim SEO <= 4.6.2 versions.
- risk 0.00cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.53.1 versions.
- risk 0.00cvss 7.7epss 0.00
Subscriber Arbitrary File Deletion in JS Help Desk <= 3.1.1 versions.
- risk 0.00cvss 8.8epss 0.01
Subscriber PHP Object Injection in EventPrime <= 4.3.4.1 versions.
- risk 0.00cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in TablePress <= 3.3.1 versions.
- risk 0.00cvss 6.5epss 0.00
Improper Access Control vulnerability in Themeisle PPOM for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PPOM for WooCommerce: from n/a through 33.0.18.
- risk 0.00cvss 8.5epss 0.01
Contributor Remote Code Execution (RCE) in Post Snippets <= 4.0.19 versions.
- risk 0.00cvss 7.1epss 0.00
Customer Cross Site Scripting (XSS) in Advanced Order Export For WooCommerce <= 4.0.9 versions.
- risk 0.00cvss 5.4epss 0.00
Customer Broken Access Control in UPI QR Code Payment Gateway for WooCommerce <= 1.6.2 versions.
- risk 0.00cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Master Slider <= 3.11.2 versions.
- risk 0.00cvss 6.5epss 0.00
Unauthenticated Insecure Direct Object References (IDOR) in License Manager for WooCommerce <= 3.0.15 versions.
- risk 0.00cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in H5P <= 1.17.6 versions.
- risk 0.00cvss 9.3epss 0.00
Unauthenticated SQL Injection in Premmerce Wishlist for WooCommerce <= 1.1.11 versions.
- risk 0.00cvss 8.3epss 0.00
Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal APIExperts Square for WooCommerce allows Retrieve Embedded Sensitive Data. This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.3.
- risk 0.00cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in MDTF <= 1.3.8 versions.
- risk 0.00cvss 7.5epss 0.00
Unauthenticated Broken Access Control in CheckView Automated Testing <= 2.1.0 versions.
- risk 0.00cvss 9.3epss 0.00
Unauthenticated SQL Injection in MDTF <= 1.3.7 versions.
- risk 0.00cvss 8.1epss 0.00
Missing Authorization vulnerability in Royal Plugins Royal MCP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Royal MCP: from n/a through 1.4.25.
- risk 0.00cvss 7.5epss 0.00
Unauthenticated Sensitive Data Exposure in Vitepos <= 3.4.2 versions.
- risk 0.00cvss 8.5epss 0.00
Subscriber SQL Injection in WC Vendors Marketplace <= 2.6.8 versions.
- risk 0.00cvss 9.3epss 0.01
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YMC Filter allows SQL Injection. This issue affects YMC Filter: from n/a through 3.11.5.
- risk 0.00cvss 7.5epss 0.00
Unauthenticated Broken Access Control in Five Star Restaurant Reservations <= 2.7.19 versions.
- risk 0.00cvss 7.5epss 0.00
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jacob N. Breetvelt WP Photo Album Plus allows Blind SQL Injection. This issue affects WP Photo Album Plus: from n/a through 9.1.13.005.
- risk 0.00cvss 7.5epss 0.00
Unauthenticated Broken Access Control in Motors <= 1.4.109 versions.
- risk 0.00cvss 9.9epss 0.01
Contributor Remote Code Execution (RCE) in Widget Options <= 4.2.3 versions.
- risk 0.00cvss 8.5epss 0.00
Subscriber SQL Injection in SALESmanago & Leadoo <= 3.11.2 versions.
- risk 0.00cvss 7.4epss 0.00
Subscriber Sensitive Data Exposure in Visual Link Preview <= 2.3.1 versions.
- risk 0.00cvss 7.5epss 0.00
Unauthenticated Broken Access Control in MainWP Child <= 6.1.1 versions.
- risk 0.00cvss 7.5epss 0.01
The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin plugin for WordPress is vulnerable to generic SQL Injection via the 'post_id' parameter in all versions up to, and including, 2.22.7 due to insufficient escaping on the user supplied parameter…
- risk 0.00cvss 7.5epss 0.00
The InPost PL WordPress plugin before 1.9.1 does not verify that the request originates from the legitimate buyer before allowing the WooCommerce order parcel-locker destination to be updated, allowing unauthenticated attackers to silently redirect the shipping destination of…
- risk 0.00cvss 8.8epss 0.01
The Email Address Encoder WordPress plugin before 1.0.25, email-encoder-premium WordPress plugin before 0.3.12 does not properly handle email replacement, which could allow unauthenticated users to perform Stored XSS attacks
- risk 0.00cvss 6.5epss 0.00
The Masteriyo LMS WordPress plugin before 2.2.1 does not perform authorization checks in a course-progress REST API controller, allowing unauthenticated users to read and permanently delete any user's course-progress records.
- risk 0.00cvss 6.5epss 0.00
The Gravity Forms Booking plugin for WordPress is vulnerable to time-based SQL Injection via the ‘staff_id’ parameter in all versions up to, and including, 2.7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing…
- risk 0.00cvss 6.5epss 0.00
The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the ’orderby’ parameter in all versions up to, and including, 5.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. …
- risk 0.00cvss 7.5epss 0.00
The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the via 'latitude' and 'longitude' parameters in all versions up to, and including, 5.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the…
Page 759 of 773