Category
Web / CMS
26,747 known vulnerabilities.
5,589 results · Clear filters · Feed
-
High 7.5
WebP Express < 0.25.16 - Unauthenticated Stored XSS via Alter HTML Parser
The WebP Express WordPress plugin before 0.25.16 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled, allowing unauthenticated users to submit content that is stored and later …
-
High 7.5
Royal MCP < 1.5.7 - Authentication Bypass via Preview Link Token
The Royal MCP WordPress plugin before 1.5.7 does not limit a preview-link token to the single preview it was issued for, so any party that obtains a valid token is authenticated as the token's owning user, an administrator in the default configuration, across…
-
High 7.2
PixelYourSite (Free & Pro) - Unauthenticated Stored XSS via Cookie
The PixelYourSite WordPress plugin before 11.4.3, PixelYourSite Pro WordPress plugin before 12.6.8 do not sanitise and escape a cookie value before printing it into the page output, which, on a site running a full-page cache, allows unauthenticated attackers …
-
High 7.2
CM HIPAA Forms < 3.3.2 - hipaa_forms+ Privilege Escalation via cm_hipaa_update_user_role
The HIPAA Forms WordPress plugin before 3.3.2 does not perform a capability check when handling a request that rebuilds its own custom user role, allowing a user who already holds that role to grant it administrator-level capabilities and escalate their privi…
-
High 8.2
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth SAML and LDAP auto-linking were both enabled, an authenticated user could have taken over an existing…
-
High 7.5
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have poisoned a shared cache's OAuth/OIDC discovery documen…
-
High 8.8
WordPress WordPress Team Members – GS Plugins plugin <= 2.8.2 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in GS Plugins WordPress Team Members – GS Plugins gs-team-members allows Object Injection.This issue affects WordPress Team Members – GS Plugins: from n/a through 2.8.2.
-
High 8.8
Jane Menu < 1.5.1 - Unauthenticated Stored XSS via Store Config Proxy URL
The Jane Menu WordPress plugin before 1.5.1 does not have any capability or nonce checks on one of its form handlers, which is reachable by unauthenticated users, allowing them to bind any published page to a remote document of their choosing. The plugin then…
-
High 8.6CVE-2026-92998 Scanner template
Click n Chat 1.0.4 - 1.1.2 - Unauthenticated SQLi via 'sort_by'/'sort_order' Parameters
The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not sanitise sort parameters before using them in a SQL ORDER BY clause, allowing unauthenticated attackers to perform SQL injection attacks.
-
High 8.6
Click n Chat < 1.1.3 - Unauthenticated SQLi via 'datacolumn' Parameter
The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not properly validate a parameter before using it as a column identifier in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks.
-
High 7.5
Weglot < 6.4.3 - Unauthenticated Stored XSS via Translated Page Link Rewriting
The Translate WordPress with Weglot 2.0 WordPress plugin before 6.4.3 does not escape the URLs it re-inserts into a page when rewriting links for a translated language, and reverses the encoding that was applied to them beforehand, allowing unauthenticated us…
-
High 7.5
Formidable Forms 6.5 - 6.35 - Unauthenticated Payment Gateway Connect Verification DoS
The Formidable Forms WordPress plugin before 7.0 does not verify the identity of the caller before recording the timestamp it uses to rate limit payment gateway verification requests, allowing unauthenticated attackers to consume the daily allowance and cause…
-
High 7.1
Advanced File Manager 5.4.13 - 5.4.14 - Authenticated Stored XSS via SVG Sanitiser Content-Sniff Bypass
The Advanced File Manager WordPress plugin before 6.0.0 does not correctly determine whether a stored file is an SVG before sanitising it, allowing users granted file-manager access by an administrator to store a file containing script that is not stripped an…
-
High 7.1
Profile Builder < 4.0.1 - Reflected XSS via Unconfirmed Emails Row Actions
The User Profile Builder WordPress plugin before 4.0.1 does not escape the current page URL before outputting it in a JavaScript context on one of its admin pages, leading to Reflected Cross-Site Scripting against high-privilege users.
-
High 7.5
Redirection for Contact Form 7 2.2.7 - 3.2.11 - Unauthenticated Stored XSS via Lead Debug Metabox
The Redirection for Contact Form 7 WordPress plugin before 3.2.12 does not sanitise or escape submitted form data stored as lead entries before outputting it in the lead debug metabox, allowing unauthenticated attackers to store a malicious script that execut…
-
High 7.5
miniOrange 2FA 6.2.9 - 6.3.0 - 2FA Bypass via Passkey Second-Factor Rebinding
The miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add their own authenticator and…
-
High 7.1
WP Booking System < 2.1.0.3 - Reflected XSS via 'booking_id' Parameter
The WP Booking System WordPress plugin before 2.1.0.3 does not validate and escape one of its parameters before reflecting it back in an admin page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as administrat…
-
High 8.1
WP User Manager 2.9.21 - 2.9.25 - Unauthenticated Privilege Escalation via Paid Registration Role After Stripe Disconnect
The WP User Manager WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force once the payment gateway is disconnected, while a published paid registration form continues to assign its configured role, allowing unauth…
-
High 7.5
Simple Banner < 3.3.3 - Authenticated Privilege Escalation via User Permissions Setting
The Simple Banner WordPress plugin before 3.3.3 does not correctly limit the capabilities it grants to the user roles an administrator allows to manage its banners, granting such roles the full administrator capability, which allows users in a low-privileged …
-
High 7.5
Uncanny Toolkit for LearnDash < 3.8.2 - Account Takeover via Password Reset CSRF
The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not validate the origin of a password-reset request, allowing an unauthenticated attacker to set the password of a user who is partway through a password reset to an attacker-chosen value th…
-
High 8.2
Backup and Staging by WP Time Capsule < 1.22.28 - Subscriber+ Staging-to-Live Deployment via wptc_copy_stage_to_live
The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.28 does not perform capability or nonce checks on the handler that deploys a staging site to the live site, allowing any authenticated user with a Subscriber account on a WP Time Capsule s…
-
High 8.0
Falang multilanguage for WordPress < 1.4.6 - Subscriber+ Stored XSS via Term Translation
The Falang multilanguage for WordPress plugin before 1.4.6 does not perform a capability check when saving term translations, and exposes a valid nonce to any logged-in user through an unprotected handler, allowing users with Subscriber-level access and above…
-
High 7.7
Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_attendees AJAX Action
The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement, which allows authenticated users with Subscriber-level access a…
-
High 7.5
Cherry Plugin for WordPress < 1.2.7 Path Traversal via download-content.php
Cherry Plugin for WordPress before 1.2.7 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files via the 'file' parameter. Attackers can send GET requests to /admin/import-export/download-content.php with trav…
-
High 8.1
Issuu Panel WordPress Plugin < 1.6.6 File Inclusion via ajax-docs.php
Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability that allows unauthenticated attackers to include remote or local files through the 'abspath' parameter. Attackers can send GET requests to menu/documento/requests/ajax-d…
-
High 7.5
Memphis Documents Library WordPress Plugin < 3.1.6 Path Traversal via mdocs-img-preview
Memphis Documents Library plugin for WordPress before 3.1.6 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the mdocs-img-preview parameter. Attackers can send GET requests with traversal sequences to …
-
High 7.5
Aspose PDF Exporter WordPress Plugin < 2.0 Path Traversal via aspose_pdf_exporter_download.php
Aspose PDF Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download files through the unsanitized 'file' parameter passed to readfile(). Attackers can send GET requests to aspose_pdf_ex…
-
High 7.5
Aspose Doc Exporter WordPress Plugin < 2.0 Path Traversal via aspose_doc_exporter_download.php
Aspose Doc Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by passing unsanitized paths to readfile(). Attackers can send GET requests to aspose_doc_exporter_do…
-
High 7.5
Aspose Importer & Exporter WordPress Plugin < 3.0 Path Traversal via aspose_import_export_download.php
Aspose Importer & Exporter plugin for WordPress before 3.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files via the unsanitized 'file' parameter. Attackers can send GET requests to aspose_import_export_…
-
High 7.5
ChurcHope WordPress Theme < 2.2 Path Traversal via downloadlink.php
ChurcHope theme for WordPress before 2.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the 'file' parameter of /wp-content/themes/churchope/lib/downloadlink.php. Attackers can supply director…
-
High 7.5
NativeChurch WordPress Theme < 1.6.2 Arbitrary File Download via download.php
NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the file parameter of download.php. Attackers can send GET requests with directory traversal sequen…
-
High 7.5
TinyMCE Thumbnail Gallery WordPress Plugin < 1.1.0 Path Traversal via download-image.php
TinyMCE Thumbnail Gallery plugin for WordPress before 1.1.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the href parameter. Attackers can send GET requests to /php/download-image.php with traversal…
-
High 7.2
Broken Access Control in extension "TYPO3 AI Integration Extension" (ns_t3ai)
The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user's permissions nor limits which fields can be changed. Any authenticated backend user can therefore change any…
-
High 7.1
Sensitive Data Exposure in extension "TYPO3 AI Integration Extension" (ns_t3ai)
In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor plugin can contact the OpenAI service directly from the browser. Any authenticated backend user can read the key and use it at the expe…
-
High 7.5CVE-2026-93300 Public exploit
EventON - Subscriber <= 1.4.5 - Unauthenticated SQL Injection via 'email' Parameter
The EventON - Subscriber plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all versions up to, and including, 1.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the ex…
-
High 7.7
Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_fes_csv_export
The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing authenticated users with minimal privileges (Subscri…
-
High 7.1
WP Photo Album Plus < 9.2.11.002 - Reflected XSS via 'wppa-cat' Parameter
The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a JavaScript event handler on its gallery breadcrumb links, allowing unauthenticated attackers to inject arbitrary script…
-
High 7.2
Salon Booking System 10.17 - 10.31.10 - Salon Staff+ Privilege Escalation to Administrator via Case-Insensitive User Meta Key
The Salon Booking System WordPress plugin before 10.31.11 does not prevent users holding its custom salon staff role from assigning arbitrary capabilities to other accounts when editing a customer, allowing them to escalate any account to administrator and ta…
-
High 7.1
WordPress PAYCOMET for WooCommerce plugin <= 5.45 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PAYCOMET PAYCOMET for WooCommerce paytpv-for-woocommerce allows Reflected XSS.This issue affects PAYCOMET for WooCommerce: from n/a through 5.45.
-
High 7.2
European VAT Compliance Assistant for WooCommerce <= 1.36.10 - Unauthenticated Stored Cross-Site Scripting via CF-IPCountry Header
The European VAT Compliance Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via CF-IPCountry Header in all versions up to, and including, 1.36.10 due to insufficient input sanitization and output escaping. This make…