Category
Web / CMS
26,742 known vulnerabilities.
26,736 results · Feed
-
High 7.5
Cherry Plugin for WordPress < 1.2.7 Path Traversal via download-content.php
Cherry Plugin for WordPress before 1.2.7 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files via the 'file' parameter. Attackers can send GET requests to /admin/import-export/download-content.php with trav…
-
High 8.1
Issuu Panel WordPress Plugin < 1.6.6 File Inclusion via ajax-docs.php
Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability that allows unauthenticated attackers to include remote or local files through the 'abspath' parameter. Attackers can send GET requests to menu/documento/requests/ajax-d…
-
High 7.5
Memphis Documents Library WordPress Plugin < 3.1.6 Path Traversal via mdocs-img-preview
Memphis Documents Library plugin for WordPress before 3.1.6 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the mdocs-img-preview parameter. Attackers can send GET requests with traversal sequences to …
-
High 7.5
Aspose PDF Exporter WordPress Plugin < 2.0 Path Traversal via aspose_pdf_exporter_download.php
Aspose PDF Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download files through the unsanitized 'file' parameter passed to readfile(). Attackers can send GET requests to aspose_pdf_ex…
-
High 7.5
Aspose Doc Exporter WordPress Plugin < 2.0 Path Traversal via aspose_doc_exporter_download.php
Aspose Doc Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by passing unsanitized paths to readfile(). Attackers can send GET requests to aspose_doc_exporter_do…
-
High 7.5
Aspose Importer & Exporter WordPress Plugin < 3.0 Path Traversal via aspose_import_export_download.php
Aspose Importer & Exporter plugin for WordPress before 3.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files via the unsanitized 'file' parameter. Attackers can send GET requests to aspose_import_export_…
-
High 7.5
ChurcHope WordPress Theme < 2.2 Path Traversal via downloadlink.php
ChurcHope theme for WordPress before 2.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the 'file' parameter of /wp-content/themes/churchope/lib/downloadlink.php. Attackers can supply director…
-
High 7.5
NativeChurch WordPress Theme < 1.6.2 Arbitrary File Download via download.php
NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the file parameter of download.php. Attackers can send GET requests with directory traversal sequen…
-
Medium 6.1
Blogroll Fun WordPress Plugin < 0.8.5 Reflected XSS via blogroll.php
Blogroll Fun plugin for WordPress before 0.8.5 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the 'k' parameter in blogroll.php. Attackers can craft GET requests to /wp-content/plugins/b…
-
Medium 6.1
SocialFit WordPress Plugin 1.2.2 Reflected XSS via popup.php msg Parameter
SocialFit plugin for WordPress through 1.2.2 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the unsanitized msg parameter. Attackers can craft GET requests to /wp-content/plugins/socialfit/p…
-
Medium 6.1
Custom Tables WordPress Plugin < 3.4.6 Reflected XSS via iframe.php
Custom Tables plugin for WordPress before 3.4.6 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unsanitized 'key' parameter in iframe.php. Attackers can craft GET requests to /wp-cont…
-
Medium 6.1
K-news WordPress Plugin < 1.1.1 Reflected XSS via fontpicker index.php ff Parameter
K-news plugin for WordPress before 1.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying unsanitized input through the 'ff' parameter. Attackers can craft GET requests to /wp-content/…
-
High 7.5
TinyMCE Thumbnail Gallery WordPress Plugin < 1.1.0 Path Traversal via download-image.php
TinyMCE Thumbnail Gallery plugin for WordPress before 1.1.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the href parameter. Attackers can send GET requests to /php/download-image.php with traversal…
-
Medium 6.7
Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise
A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise ins…
-
Medium 6.1
VPL for Moodle before 5.0.0 Reflected XSS via similarity/diff.php filename
VPL (Virtual Programming Lab) for Moodle before 5.0.0 contains a reflected cross-site scripting vulnerability that allows remote attackers to inject script via unencoded filename1/filename2 parameters in similarity/diff.php. Attackers can craft a diff.php lin…
-
Medium 5.3
Configurable Reports block for Moodle before 5.3.1 SQL Injection via filter_var
Configurable Reports block for Moodle (moodle-block_configurablereports) before 5.3.1 contains an sql injection vulnerability in report_sql::prepare_sql() via the filter_var request parameter of viewreport.php. Low-privileged users permitted to view reports u…
-
Medium 6.5
Configurable Reports block for Moodle before 5.3.0 Authorization Bypass via get_report_data
Configurable Reports block for Moodle before 5.3.0 contains an authorization bypass vulnerability that allows authenticated users to read restricted reports through the block_configurable_reports_get_report_data web service. When check_permissions fails, the …
-
Medium 6.5
WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.15.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in eLightUp Meta Box – WordPress Custom Fields Framework meta-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Meta Box – WordPress Custom Fields Framework: from n/a through 5.1…
-
Medium 6.3
Broken Access Control in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)
The download link for files uploaded through a form relied on a token that could be predicted. The file name in the request was also not verified in a way that resisted guessing. An unauthenticated attacker could use this to access files uploaded by other vis…
-
Medium 5.3
Cross-Site Scripting in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)
Values entered by visitors were placed into the HTML summary email without being escaped. An unauthenticated attacker could use this to inject HTML into an email that is shown to the recipient.
-
Medium 6.9CVE-2026-112071 Public exploit
Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)
The order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns it. Any site visitor can set orders that are still awaiting payment to "canceled". This requires a page that contains the…
-
High 7.2
Broken Access Control in extension "TYPO3 AI Integration Extension" (ns_t3ai)
The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user's permissions nor limits which fields can be changed. Any authenticated backend user can therefore change any…
-
Medium 6.9CVE-2026-113468 Public exploit
Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)
The payment notification endpoint for PayPal accepts incoming data without verifying that it comes from the payment provider. Any site visitor can overwrite the stored payment notification of an order that is still awaiting payment with arbitrary content. Thi…
-
High 7.1
Sensitive Data Exposure in extension "TYPO3 AI Integration Extension" (ns_t3ai)
In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor plugin can contact the OpenAI service directly from the browser. Any authenticated backend user can read the key and use it at the expe…
-
Medium 6.4
DiviGear Carousel <= 5.2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via update_license AJAX Action
The DiviGear Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via update_license AJAX Action in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authentic…
-
Medium 4.3
Easy Property Listings < 3.5.27 - Subscriber+ Sensitive Data Disclosure via Contact CRM AJAX Handlers
The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contact-management read AJAX actions, allowing any authenticated user with a role as low as subscriber to read other users' CRM contact and lead …
-
Medium 5.3
Easy Property Listings < 3.5.28 - Unauthenticated Hidden Listing Details Disclosure via REST API
The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public REST API output, allowing unauthenticated users to read details a site has chosen to hide on published listings, such as the asking price, s…
-
High 7.5CVE-2026-93300 Public exploit
EventON - Subscriber <= 1.4.5 - Unauthenticated SQL Injection via 'email' Parameter
The EventON - Subscriber plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all versions up to, and including, 1.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the ex…
-
Medium 4.3
Sensei LMS 4.26.4 Broken Access Control via save_new_message
The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the legacy save_new_message handler hooked on the init action, which validates only a generic nonce without verifying course enrollment or restricting post_id to v…
-
Medium 4.3
Sensei LMS 4.26.4 Broken Access Control via add_new_module_term AJAX
The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the add_new_module_term AJAX handler that allows authenticated Teacher-role attackers to assign module taxonomy terms to arbitrary courses by supplying a crafted c…
-
Medium 5.3
WordPress YITH WooCommerce Product Bundles plugin <= 2.29.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Product Bundles: from n/a through 2.29.0.
-
Medium 6.5
WordPress YITH WooCommerce Wishlist plugin <= 4.18.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Wishlist yith-woocommerce-wishlist allows Stored XSS.This issue affects YITH WooCommerce Wishlist: from n/a through 4.18.1.
-
Medium 5.3
App Builder 3.8.4 - 5.7.0 - Unauthenticated Option Write and Redirect via includes/pure.php
The App Builder WordPress plugin before 5.7.1 does not require authentication or authorisation before writing attacker-supplied data to one of its options and, on a separate unauthenticated request, redirecting the visitor's browser to a URI built from that s…
-
Medium 5.3
Snap Finance 1.0.8 - 3.11.0 - Unauthenticated Arbitrary Order Status Change via Multiple AJAX Actions
The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to fail.
-
Medium 5.3
TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Booking Creation with Arbitrary Price via Multiple AJAX Actions
The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in some of its AJAX actions, and does not validate the submitted service price server-side, allowing unauthenticated users to create bookings at a price of their choosing and to a…
-
Medium 5.3
TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Service and Category Creation and Modification
The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in place in some of its functionality, allowing unauthenticated users to create and modify booking services and categories, including their prices.
-
Medium 5.3
TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Customer PII Disclosure via IDOR in 'refappbkd' Parameter
The TrueBooker WordPress plugin before 1.3.0 does not verify that the requester owns a booking before rendering its confirmation summary, allowing unauthenticated attackers to enumerate booking identifiers and retrieve the personal information of customers wh…
-
Medium 5.3
TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Plugin Settings Overwrite via admin_setting_setup_data
The TrueBooker WordPress plugin before 1.3.0 does not perform any capability check on one of its setup handlers, and the token it does check is issued to unauthenticated visitors, allowing anyone to overwrite the plugin's entire configuration and to discard a…
-
Low 3.8
Subscribe to Comments 2.3 - 2.3.2 - Author+ Email Header Injection via From Name Setting
The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers, allowing users with Author-level access and above to inject arbitrary e-mail headers, such …
-
Medium 5.3
Document Gallery 4.1 - 5.1.1 - Unauthenticated Document Thumbnail Replacement via Thumber Webhook Signature Bypass
The Document Gallery WordPress plugin through 5.1.1 does not verify the signature on one of its unauthenticated webhook endpoints when no shared secret has been configured, which is the default state, allowing unauthenticated users to replace the thumbnail im…