Export limit exceeded: 16120 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (16120 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-80099 | 2 Newfold, Wordpress | 6 Wp Module Data, Wp Plugin Bluehost, Wp Plugin Crazy Domains and 3 more | 2026-09-13 | 8.8 High |
| Several Newfold plugins are vulnerable to Authentication Bypass. The vulnerability exists because the plugins bundle the wp-module-data module. In the module, the `authenticate()` method — registered on the `rest_authentication_errors` filter and therefore evaluated for every unauthenticated REST API request — performs an HMAC-style Bearer token comparison that degenerates when `HiiveConnection::get_auth_token()` returns `false`: PHP coerces `strrev(false)` to `strrev('')`, collapsing the secret salt to the publicly known constant `hash('sha256', '') = e3b0c44...`, while all remaining hash inputs (HTTP method, request URL, raw request body, and the `X-Timestamp` header) remain fully attacker-controlled. This makes it possible for unauthenticated attackers to compute a valid Bearer token entirely offline, pass the token equality check, and have `wp_set_current_user()` invoked against the first administrator returned by `get_users(['role' => 'administrator'])`, granting full administrator-level access and enabling arbitrary REST API operations such as creating new administrator accounts and achieving complete site takeover. Vulnerable versions are WP Plugin Crazy Domains (<= 2.5.2), WP Plugin Web (<= 2.3.4), WP Plugin Hostgator (<= 3.1.0), WP Plugin Bluehost (<= 4.17.1). The affected module is vulnerable in versions up to, and including, 2.9.4. | ||||
| CVE-2026-5399 | 2 Davidanderson, Wordpress | 2 Redux Framework, Wordpress | 2026-09-13 | 6.4 Medium |
| The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User Profile settings in versions up to and including 4.5.13.1. This is due to insufficient input sanitization in the user_meta_save() function (which only sanitizes array values, not scalar values) and improper output escaping in the Redux_Slider::render() method, which outputs slider values into unquoted HTML attributes. The vulnerability also exploits the fact that the clean_default() method only casts values to numeric types when they are empty or out of bounds, allowing malicious strings like '1 tabindex=0 autofocus onfocus=alert(1) x=' to pass validation through PHP's loose type comparison. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts into their user profile that will execute whenever an Administrator navigates to view the attacker's profile page. | ||||
| CVE-2026-81783 | 2 Mailmunch, Wordpress | 2 Mailmunch – Grow Your Email List, Wordpress | 2026-09-13 | 7.1 High |
| Subscriber Broken Authentication in MailMunch – Grow your Email List <= 3.2.5 versions. | ||||
| CVE-2026-81791 | 2 Ashan Perera, Wordpress | 2 Eventon, Wordpress | 2026-09-13 | 6.5 Medium |
| Subscriber Cross Site Scripting (XSS) in EventON <= 2.5.7 versions. | ||||
| CVE-2026-81794 | 2 Mlfactory, Wordpress | 2 Shirt Product Designer For Woocommerce, Wordpress | 2026-09-13 | 7.5 High |
| Unauthenticated Broken Access Control in Shirt Product Designer for WooCommerce 1.0.4 versions. | ||||
| CVE-2026-81795 | 2 Denis Botić, Wordpress | 2 Page Visits Counter – Lite, Wordpress | 2026-09-13 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Page Visits Counter – Lite <= 1.2.3 versions. | ||||
| CVE-2026-81800 | 2 Par Avisverifies, Wordpress | 2 Verified Reviews (avis Vérifiés), Wordpress | 2026-09-13 | 9.3 Critical |
| Unauthenticated SQL Injection in Verified Reviews (Avis Vérifiés) <= 2.4.6 versions. | ||||
| CVE-2026-81801 | 2 Udx Usability Dynamics, Wordpress | 2 Wp-stateless, Wordpress | 2026-09-13 | 8.1 High |
| Subscriber Settings Change in WP-Stateless <= 4.4.1 versions. | ||||
| CVE-2026-81804 | 2 Wordpress, Zain Hassan | 2 Wordpress, Zhbackup – Backup, Restore & Migration | 2026-09-13 | 7.5 High |
| Unauthenticated Sensitive Data Exposure in ZHBackup – Backup, Restore & Migration <= 2.4.2 versions. | ||||
| CVE-2026-81805 | 2 Siteskite, Wordpress | 2 Siteskite, Wordpress | 2026-09-13 | 8.1 High |
| Unauthenticated Privilege Escalation in SiteSkite <= 2.1.5 versions. | ||||
| CVE-2026-15462 | 2 Gingerplugins, Wordpress | 2 Sticky Chat Widget – Floating Chat Icons, Contact Form, Call, Click To Chat, Email & Message Buttons, Wordpress | 2026-09-13 | 7.5 High |
| The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the 'scw_form_fields' parameter array keys of the 'scw_save_form_data' AJAX action in versions up to, and including, 1.4.2. This is due to the save_form_data() function passing attacker-controlled POST array keys unsanitized to $wpdb->insert(), which wraps column identifiers in backticks without escaping them, allowing a backtick in an attacker-supplied key to break out of the column-identifier list into raw SQL; additionally, the use of filter_input() bypasses WordPress's wp_magic_quotes() protection, and the widget_id validation loop is skipped entirely when no valid widget_id is supplied, leaving $isValid at 1. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | ||||
| CVE-2026-12215 | 2 Wordpress, Xootix | 2 Wordpress, Otp Login & Register Woocommerce | 2026-09-13 | 5.3 Medium |
| The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Authentication Bypass via OTP Brute Force in all versions up to, and including, 2.7.2. The vulnerability exists because the OTP rate-limit attempt counter in `process_otp_form` is keyed exclusively on the attacker-controlled `xoo_ml_user_ip_data` cookie's `ip_address` field, allowing unlimited counter resets by simply rotating the cookie, while the OTP itself is generated with PHP's non-cryptographic `rand()` function over a default space of only 9,000 possible values (1000–9999), and both the OTP issuance endpoint (`xoo_ml_login_with_otp`) and verification endpoint (`xoo_ml_otp_form_submit`) are registered as unauthenticated `wp_ajax_nopriv` actions with no nonce or capability checks. This makes it possible for unauthenticated attackers to brute-force the OTP for any registered account and obtain a full WordPress authentication session — including for administrator accounts — via `wp_set_auth_cookie()` in `login_user_with_otp()`. Exploitation requires the attacker to know the target user's registered phone number, which is used to trigger OTP issuance via the unauthenticated `xoo_ml_login_with_otp` endpoint. | ||||
| CVE-2026-11496 | 2 Edgarrojas, Wordpress | 2 Pdf Builder For Woocommerce. Create Invoices,packing Slips And More, Wordpress | 2026-09-13 | 6.5 Medium |
| The Woo PDF Invoice Builder plugin (also distributed as "PDF Builder for WooCommerce") for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.8. This is due to the InspectOrder() AJAX handler (woocommerce-pdf-invoice-ajax.php:513), registered on wp_ajax_rednao_wcpdfinv_inspect_order, performing no capability check and no nonce verification before loading an arbitrary order by the attacker-supplied 'OrderNumber' POST field and serializing its full WC_Order::get_data() and meta to the response. This makes it possible for authenticated attackers with Subscriber-level access and above to read every WooCommerce order on the site — including billing/shipping address, email, phone number, payment method, gateway transaction ID, and order totals — by iterating order IDs. | ||||
| CVE-2026-18964 | 2 Premio, Wordpress | 2 Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, Wechat, Email, Sms, Call Button – Chaty, Wordpress | 2026-09-13 | 6.1 Medium |
| The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 3.5.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. WordPress's server-side HTML encoding of the 's' search parameter in the <title> element is bypassed because the browser DOM API decodes HTML entities when jQuery's .text() method reads document.title, returning literal special characters that are then embedded unescaped into the constructed HTML attribute value. | ||||
| CVE-2026-8778 | 2 Mulika, Wordpress | 2 Mipl Grouped Checkout Fields For Woocommerce. Customize & Organize Checkout Fields., Wordpress | 2026-09-13 | 9.8 Critical |
| The MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields. plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the `mipl_wc_upload_file` function in all versions up to, and including, 1.2.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. | ||||
| CVE-2026-81754 | 2 Fernandot, Wordpress | 2 Vigilant – 100% Free Security Suite: Firewall, 2fa, Login, Headers, Scanner…, Wordpress | 2026-09-13 | 7.2 High |
| The Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User-Agent Header in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The malicious payload is delivered passively by any unauthenticated visitor who triggers a failed login attempt with a crafted User-Agent header, requiring no further interaction from the attacker once stored. | ||||
| CVE-2026-18562 | 2 Realmag777, Wordpress | 2 Husky – Products Filter For Woocommerce Professional, Wordpress | 2026-09-13 | 6.1 Medium |
| The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via SEO-friendly permalink filter URL segments in versions up to, and including, 1.4.3. This is due to insufficient input sanitization and output escaping in the wp_load_js() function, which reads filter values from the URL path via the url_request extension's parse_url_query() and embeds them into an inline JavaScript string using json_encode() without escaping single quotes. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link. | ||||
| CVE-2026-86781 | 2 Unknown, Wordpress | 2 Ssl Zen — Ssl Certificate Installer & Https Redirects, Wordpress | 2026-09-13 | 5.3 Medium |
| The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40 does not perform capability or nonce checks on a certificate-file download routine that runs early in the WordPress admin request lifecycle, allowing any authenticated user, including Subscribers, to download the site's TLS private key, certificates, and diagnostic logs. | ||||
| CVE-2026-27378 | 2 Magepeopleteam, Wordpress | 2 Deposits And Partial Payments For Woocommerce, Wordpress | 2026-09-13 | 5.3 Medium |
| Unauthenticated Broken Access Control in Deposits and Partial Payments for WooCommerce <= 3.1.0 versions. | ||||
| CVE-2026-62106 | 2 Cozy Vision Technologies Pvt. Ltd., Wordpress | 2 Sms Alert Order Notifications, Wordpress | 2026-09-13 | 8.8 High |
| Subscriber Privilege Escalation in SMS Alert Order Notifications <= 3.9.9 versions. | ||||