Export limit exceeded: 15756 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (15756 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-75964 | 2 Cozmoslabs, Wordpress | 2 User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor, Wordpress | 2026-09-01 | 6.1 Medium |
| The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload reaches administrators with the manage_options capability when they visit the Users > Unconfirmed Email Addresses list table and interact with row-action links, as the poisoned javascript: href is rendered verbatim into the page HTML by row_actions(). | ||||
| CVE-2026-17589 | 2 Levelfourstorefront, Wordpress | 2 Shopping Cart \& Ecommerce Store, Wordpress | 2026-09-01 | 4.9 Medium |
| The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to generic SQL Injection via the 'product_order' parameter in all versions up to, and including, 5.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a second-order SQL injection: the payload is written to the ec_pageoption table via the ec_ajax_save_page_options handler — which applies no sanitization to raw $_POST values — and is later retrieved with stripslashes() (bypassing WordPress magic-quotes protection) before being concatenated directly into SQL on every store page render. | ||||
| CVE-2026-19952 | 2 Shabti, Wordpress | 2 Frontend Admin By Dynamapps, Wordpress | 2026-09-01 | 7.5 High |
| The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the move_folders function in all versions up to, and including, 3.29.12. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is exploitable without authentication when a form is configured with public visibility (who_can_see='all'), as the required nonce is publicly obtainable from the rendered form. | ||||
| CVE-2026-13203 | 2 Livecomposer, Wordpress | 2 Live Composer – Free Wordpress Website Builder, Wordpress | 2026-09-01 | 6.4 Medium |
| The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_id' shortcode attribute of the dslc_modules_section and dslc_modules_area shortcodes in versions up to, and including, 2.1.19. This is due to insufficient input sanitization and output escaping on the user-supplied attribute, which is concatenated into the HTML id="" attribute of the rendered <div> element in the dslc_modules_section_front() and dslc_modules_area_front() functions without esc_attr(). This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-19513 | 2 Gravityforms, Wordpress | 2 Gravity Forms, Wordpress | 2026-09-01 | 8.1 High |
| The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.0.2. This is due to insufficient validation of multi-file upload chunk state in the `GFAsyncUpload::upload()` function, where public form state URL hashes can be reused as chunk continuation hashes and attacker-controlled temporary filenames are accepted before sanitization. This makes it possible for unauthenticated attackers, when a public form contains a File Upload field with Multiple Files enabled, to upload a valid PNG/PDF polyglot to an attacker-selected public `.php` or `.html` filename in the Gravity Forms temporary upload directory. This can lead to remote code execution on WordPress systems that use NGINX or other non `.htaccess` respecting web servers. NOTE: During installation and activation, the Gravity Forms plugin places a `.htaccess` file in this directory, which prevents this vulnerability from being exploited despite the PHP file being written to the temporary upload directory. In these cases where PHP execution is blocked, attacker-written HTML can result in stored same-origin cross-site scripting if a victim visits the generated file URL. | ||||
| CVE-2026-18752 | 2 Lukeseager, Wordpress | 2 Persistent Login, Wordpress | 2026-09-01 | 6.5 Medium |
| The Persistent Login plugin for WordPress is vulnerable to generic SQL Injection via 'wppl_device_id' Cookie in all versions up to, and including, 3.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This vulnerability is only exploitable when the plugin's Login History feature is enabled. | ||||
| CVE-2026-82229 | 2 Miniorange, Wordpress | 2 Wordpress Social Login And Register, Wordpress | 2026-09-01 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.2 versions. | ||||
| CVE-2026-82221 | 2 Metagauss, Wordpress | 2 Registrationmagic, Wordpress | 2026-09-01 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in RegistrationMagic <= 6.0.9.8 versions. | ||||
| CVE-2026-81764 | 2 Acato, Wordpress | 2 Email Essentials, Wordpress | 2026-09-01 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Email Essentials <= 6.0.6 versions. | ||||
| CVE-2026-81298 | 2 Varunvairavanlc, Wordpress | 2 Leadconnector, Wordpress | 2026-09-01 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in LeadConnector <= 4.0.5 versions. | ||||
| CVE-2026-81290 | 2 Icegram, Wordpress | 2 Email Subscribers & Newsletters, Wordpress | 2026-09-01 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Email Subscribers & Newsletters <= 5.9.33 versions. | ||||
| CVE-2026-24369 | 2 Theme-one, Wordpress | 2 The Grid, Wordpress | 2026-09-01 | 7.1 High |
| Missing Authorization vulnerability in ThemeOne The Grid allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects The Grid: from n/a through 2.8.0. | ||||
| CVE-2026-24368 | 1 Wordpress | 1 Wordpress | 2026-09-01 | 5.3 Medium |
| Missing Authorization vulnerability in ThemeOne The Grid allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects The Grid: from n/a through 2.8.0. | ||||
| CVE-2026-28191 | 2 Theme-one, Wordpress | 2 The Grid, Wordpress | 2026-09-01 | 8.8 High |
| Incorrect Privilege Assignment vulnerability in ThemeOne The Grid allows Privilege Escalation. This issue affects The Grid: from n/a through 2.8.0. | ||||
| CVE-2026-75797 | 2 Ai Engine Project, Wordpress | 2 Ai Engine, Wordpress | 2026-09-01 | 7.7 High |
| The AI Engine WordPress plugin before 3.7.2 does not confine a caller-supplied URL when mapping it to a local filesystem path before reading the file and forwarding its contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and exfiltrate them off-host. Reaching the issue at subscriber level requires a non-default public API feature to be enabled; otherwise the same issue is reachable by an administrator, which on multisite allows a non-super subsite administrator to read the network-shared configuration and its secrets. | ||||
| CVE-2026-75798 | 2 Ai Engine Project, Wordpress | 2 Ai Engine, Wordpress | 2026-09-01 | 5.3 Medium |
| The AI Engine WordPress plugin before 3.7.2 does not perform an authorisation check on one of its administration-only features, relying instead on a token it hands out to anonymous visitors, allowing unauthenticated attackers to run AI queries of their own choosing against the site owner's configured provider account. | ||||
| CVE-2026-18431 | 2 Themefusion, Wordpress | 3 Avada | Website Builder For Wordpress & Woocommerce, Fusion Builder, Wordpress | 2026-09-01 | 9.8 Critical |
| The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across the two components that makes it possible for unauthenticated attackers to write attacker-controlled files to the server. This can be used to create and execute arbitrary PHP files, resulting in remote code execution and complete site compromise. Successful exploitation requires both Avada and Fusion Builder to be installed and active, as well as certain administrator-authored content to be present. | ||||
| CVE-2026-15990 | 2 Strategy11, Wordpress | 2 Formidable Forms, Wordpress | 2026-09-01 | 7.5 High |
| The Formidable Charts plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.0.1 via the 'frm_graph' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Successful exploitation requires Formidable Forms Lite, Formidable Forms Pro, and Formidable Charts to be active and requires the wp-content/uploads/frm-charts/ directory to exist, normally after an image-format chart is rendered. | ||||
| CVE-2026-19092 | 2 Tutorlms, Wordpress | 2 Tutor Lms, Wordpress | 2026-09-01 | 9.8 Critical |
| The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output. | ||||
| CVE-2026-82226 | 2 Tickera, Wordpress | 2 Tickera, Wordpress | 2026-09-01 | 9.8 Critical |
| Unauthenticated PHP Object Injection in Tickera <= 3.6.0.2 versions. | ||||