Export limit exceeded: 413238 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 413238 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 413238 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 413238 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 413238 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 413238 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (413238 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-89085 | 2 Gparted, Redhat | 2 Gparted, Enterprise Linux | 2026-10-21 | 6.6 Medium |
| A flaw was found in parted. A heap-based buffer overflow can occur when processing a specially crafted FAT32 filesystem due to an integer calculation error during buffer allocation. A local attacker could exploit this by enticing a user or automated service to open a malicious filesystem image, resulting in an application crash leading to a Denial of Service (DoS) or potential memory corruption. | ||||
| CVE-2026-111601 | 2 Hippooo, Wordpress-extensions | 2 Hippoo Mobile App For Woocommerce, Hippoo Mobile App For Woocommerce | 2026-10-21 | 6.1 Medium |
| The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'token_id' parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The URL path regex constrains the path segment to word characters, but WP_REST_Request's query-string parameter precedence allows a ?token_id= value to override it and reach the handler verbatim, bypassing the regex constraint entirely. | ||||
| CVE-2026-110268 | 2 Wordpress-extensions, Wpazleen | 2 Post Export Import With Media, Post Export Import With Media | 2026-10-21 | 4.9 Medium |
| The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.2 via the 'theme_slug' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to perform actions on files outside of the originally intended directory. Exploitation requires the peiwm_enable_admin_download_buttons feature to be enabled in the plugin settings. | ||||
| CVE-2026-109985 | 2 Wordpress-extensions, Wpdevteam | 2 Xspeed Cache Ai-powered Performance Hub With Mcp, Caching & Cdn, Xspeed Cache Ai-powered Performance Hub With Mcp, Caching & Cdn | 2026-10-21 | 6.4 Medium |
| The xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-109368 | 2 Roland Murg, Wordpress-extensions | 2 Wp Booking System, Wp Booking System | 2026-10-21 | 6.5 Medium |
| The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.0.3 via the 'id' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract private per-event booking descriptions and booking IDs from any calendar managed by the site. | ||||
| CVE-2026-96660 | 2 Wordpress-extensions, Wpeverest | 2 User Registration & Membership, User Registration & Membership | 2026-10-21 | 7.2 High |
| The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Checkbox Field Value in all versions up to, and including, 5.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nopriv AJAX action user_registration_user_form_submit reaches ur_process_registration() without nonce validation, meaning any unauthenticated request can reach the vulnerable code path. | ||||
| CVE-2026-92978 | 2 Wordpress-extensions, Wpeverest | 2 User Registration & Membership, User Registration & Membership | 2026-10-21 | 4.3 Medium |
| The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.2.8 This is due to missing or incorrect nonce validation on the trigger_bulk_action function. This makes it possible for unauthenticated attackers to force administrators to approve pending user registrations or deny arbitrary user accounts, locking targeted users out of the site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. An attacker can bypass the earlier nonce check in trigger_query_actions() by supplying an empty new_role parameter, which causes that handler to return early and cede control to the unprotected trigger_bulk_action() handler; the exit() call at the end of that handler additionally prevents WordPress core's own bulk-users nonce validation from executing. | ||||
| CVE-2026-108123 | 2 Roland Murg, Wordpress-extensions | 2 Wp Booking System, Wp Booking System | 2026-10-21 | 7.5 High |
| The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to read the stored notification email body of any booking by iterating booking_id and email_log_id, exposing customer PII including names, email addresses, phone numbers, messages, and booking dates intended to be visible only to administrators. This is exploitable by any Subscriber-level user because admin_init fires on profile.php, a wp-admin page accessible to all authenticated users. | ||||
| CVE-2026-103899 | 2 Daigo75, Wordpress-extensions | 2 Eu Vat Assistant For Woocommerce, Eu Vat Assistant For Woocommerce | 2026-10-21 | 7.2 High |
| The EU VAT Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vat_number' parameter in all versions up to, and including, 2.1.30.260413 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The stored payload executes in the administrator's browser context when reviewing an order via WooCommerce → Orders → Edit Order, enabling privilege escalation up to and including full site takeover via rogue administrator account creation. | ||||
| CVE-2026-92798 | 2 Wordpress-extensions, Wpeverest | 2 User Registration & Membership, User Registration & Membership | 2026-10-21 | 8.1 High |
| The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 5.2.8 This is due to insufficient input sanitization in the 'referrer_url' branch of UR_Smart_Tags::process(), where the attacker-controlled HTTP_REFERER header is only passed through sanitize_text_field() — which does not strip WordPress shortcode delimiters — before being substituted into a Content Restriction message that is subsequently executed via apply_shortcodes()/do_shortcode(). This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes on any restricted page whose message uses the supported {{referrer_url}} smart tag. | ||||
| CVE-2026-103376 | 2 Peachpay, Wordpress-extensions | 2 Peachpay - Payments & Express Checkout For Woocommerce (supports Stripe, Paypal, Square, Authorizenet), Peachpay | 2026-10-21 | 5.3 Medium |
| The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) WordPress plugin before 1.120.70 does not perform any capability or ownership check before returning an order's secret key in response to an unauthenticated request, allowing anyone to retrieve the key for any paid order and use it to view that order's customer name, email address, postal address and contents. | ||||
| CVE-2026-81343 | 1 Wordpress-extensions | 1 Frontend Admin By Dynamiapps | 2026-10-21 | 5.3 Medium |
| The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not perform a capability check on one of its form-submission actions before writing submitted values into the site's global ACF options store, allowing unauthenticated visitors to overwrite site-wide option values via a public form. | ||||
| CVE-2026-81344 | 1 Wordpress-extensions | 1 Frontend Admin By Dynamiapps | 2026-10-21 | 6.6 Medium |
| The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not restrict which PHP classes may be instantiated when it deserialises stored post content that is rendered on public-facing pages, allowing high-privilege users such as administrators to inject a PHP object which, given a suitable POP chain in another installed ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 or in WordPress core, can be leveraged to achieve remote code execution. | ||||
| CVE-2026-97314 | 1 Wordpress-extensions | 1 Thirstyaffiliates | 2026-10-21 | 6.5 Medium |
| The ThirstyAffiliates WordPress plugin before 3.12.1 does not check the status or type of the object requested by its link redirect tracking handler, allowing unauthenticated attackers to disclose the destination URLs of unpublished affiliate links and to record fabricated click statistics. | ||||
| CVE-2026-110384 | 2 Heateor Support, Wordpress-extensions | 2 Fancy Comments Wordpress, Fancy Comments Wordpress | 2026-10-21 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Heateor Support Fancy Comments WordPress fancy-facebook-comments allows Reflected XSS.This issue affects Fancy Comments WordPress: from n/a through 1.2.21. | ||||
| CVE-2026-112861 | 2 Wordpress-extensions, Xnau Webdesign | 2 Participants Database, Participants Database | 2026-10-21 | 6.3 Medium |
| Authorization Bypass Through User-Controlled Key vulnerability in xnau webdesign Participants Database participants-database allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Participants Database: from n/a through 2.7.8.5. | ||||
| CVE-2012-20002 | 2 James Charlesworth, Wordpress-extensions | 2 Tinymce Thumbnail Gallery, Tinymce Thumbnail Gallery | 2026-10-21 | 7.5 High |
| TinyMCE Thumbnail Gallery plugin for WordPress before 1.1.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the href parameter. Attackers can send GET requests to /php/download-image.php with traversal sequences like ../../../../wp-config.php to retrieve database credentials and system files. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19. | ||||
| CVE-2012-20005 | 2 Wordpress-extensions, Łukasz Więcek | 2 Socialfit, Socialfit | 2026-10-21 | 6.1 Medium |
| SocialFit plugin for WordPress through 1.2.2 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the unsanitized msg parameter. Attackers can craft GET requests to /wp-content/plugins/socialfit/popup.php with service=googleplus and malicious msg values to execute script and steal session cookies. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19. | ||||
| CVE-2026-113730 | 1 Orphan-oss | 1 Ognl | 2026-10-21 | 5.6 Medium |
| OGNL is an Object Graph Navigation Library for Java. Prior to 3.4.13, the optional stricter-invocation mode in OgnlRuntime.invokeMethod checks the declaring class of the method that OGNL invokes but does not block java.lang.reflect.Method, java.lang.reflect.Constructor, or java.lang.reflect.Field. An attacker-controlled expression can invoke one of these reflection objects as a proxy for a method on a blocked class, causing the real operation to execute inside JDK reflection without passing through the stricter-invocation check again. Exploitation requires an application to evaluate untrusted OGNL expressions, use the default or an equivalently permissive MemberAccess that permits reflection, and rely on stricter invocation as a sandbox. Applications using a restrictive MemberAccess, including Apache Struts with SecurityMemberAccess, are not affected by this bypass. This issue is fixed in 3.4.13. | ||||
| CVE-2026-111943 | 2 Go Standard Library, Redhat | 3 Crypto/x509, Enterprise Linux, Hummingbird | 2026-10-21 | 6.8 Medium |
| On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy. | ||||