Skip to content
OpenAdvisories

Category

Web / CMS

26,747 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

26,741 results · Feed

  • Low 1.2
    CVE-2026-103440 Public exploit

    pagetriagelist discloses suppressed reviewer usernames

    Exposure of sensitive information through data queries vulnerability in The Wikimedia Foundation MediaWiki PageTriage extension allows Information Elicitation. This issue affects MediaWiki PageTriage extension: 1.46, 1.45, and 1.43.

    The Wikimedia Foundation MediaWiki PageTriage extension Web / CMS
  • Low 0.3
    CVE-2026-103439

    Various rawParams() and escaped() updates to prevent XSS in Wikibase extension

    Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Wikbase extension allows Cross-Site Scripting (XSS). This issue affects MediaWiki Wikbase extension: 1.46, 1.45, and 1.43.

    The Wikimedia Foundation MediaWiki Wikbase extension Web / CMS
  • Low 0.3
    CVE-2026-103438

    Various rawParams() and escaped() updates to prevent XSS in Wikistories extension

    Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Wikistories extension allows Cross-Site Scripting (XSS). This issue affects MediaWiki Wikistories extension: 1.46, 1.45, and 1.43.

    The Wikimedia Foundation MediaWiki Wikistories extension Web / CMS
  • Low 1.1
    CVE-2026-103437 Public exploit

    ReadingLists imported metadata permits JavaScript URL XSS

    Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki ReadingLists extension allows Reflected XSS. This issue affects MediaWiki ReadingLists extension: 1.46 and 1.45.

    The Wikimedia Foundation MediaWiki ReadingLists extension Web / CMS
  • High 7.4
    CVE-2026-103446 Public exploit

    WikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragments

    Authorization bypass through User-Controlled key vulnerability in The Wikimedia Foundation MediaWiki WikiLambda extension allows Authentication Bypass. This issue affects MediaWiki WikiLambda extension: 1.46.

    The Wikimedia Foundation MediaWiki WikiLambda extension Web / CMS
  • Low 1.2
    CVE-2026-103445 Public exploit

    Stored XSS through PageForms #autoedit redirect links

    Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Page_Forms extension allows Stored XSS. This issue affects MediaWiki Page_Forms extension: 1.46, 1.45, and 1.43.

    The Wikimedia Foundation MediaWiki Page_Forms extension Web / CMS
  • Low 1.1
    CVE-2026-103444

    Stored XSS through system messages in WikiForum

    Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki WikiForum extension allows Stored XSS. This issue affects MediaWiki WikiForum extension: master.

    The Wikimedia Foundation MediaWiki WikiForum extension Web / CMS
  • Low 1.1
    CVE-2026-103443

    API permits session-seeded javascript URL XSS

    Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Collection (Book) extension allows XSS Targeting Non-Script Elements. This issue affects MediaWiki Collection (Book) extension: 1…

    The Wikimedia Foundation MediaWiki Collection (Book) extension Web / CMS
  • High 7.2
    CVE-2026-103442 Public exploit

    MergeAccount PHP object injection via session-key substitution

    External control of system or configuration setting vulnerability in The Wikimedia Foundation MediaWiki CentralAuth extension allows Code Injection. This issue affects MediaWiki CentralAuth extension: 1.46, 1.45, and 1.43.

    The Wikimedia Foundation MediaWiki CentralAuth extension Web / CMS
  • High 7.2
    CVE-2026-103441 Public exploit

    Unauthenticated arbitrary file deletion through Wikibase serialized entity parsing

    Deserialization of untrusted data vulnerability in The Wikimedia Foundation MediaWiki Wikibase extension allows Leverage Executable Code in Non-Executable Files. This issue affects MediaWiki Wikibase extension: 1.46, 1.45, and 1.43.

    The Wikimedia Foundation MediaWiki Wikibase extension Web / CMS
  • Critical 10.0
    CVE-2026-102427 Public exploit

    Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16

    Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16 - site/uploader.php is reached through the component’s normal frontend routing (task=getContent), a task with no authentication or ACL check anywhere in th…

    ordasoft.com OrdaSoft Joomla CCK Web / CMS
  • Critical 10.0
    CVE-2026-76570 Public exploit

    Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables < 1.21.1

    Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables 1.21.1 - The front-end CRUD API controller performs no Joomla token validation and no authentication check on any task. Table names, column names, and values…

    joomcode.com JCTables extension for Joomla Web / CMS
  • Medium 5.3
    CVE-2026-97259

    WordPress Pay with Vipps for WooCommerce plugin <= 6.2.4 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in WP Hosting AS Pay with Vipps for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pay with Vipps for WooCommerce: from n/a through 6.2.4.

    WP Hosting AS Pay with Vipps for WooCommerce Web / CMS
  • Medium 5.4
    CVE-2026-97299

    WordPress Razorpay Payment Links for WooCommerce plugin <= 2.1.5 - Cross Site Request Forgery (CSRF) vulnerability

    Unauthenticated Cross Site Request Forgery (CSRF) in Razorpay Payment Links for WooCommerce <= 2.1.5 versions.

    Knit Pay Razorpay Payment Links for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2026-97292

    WordPress YITH WooCommerce Tab Manager plugin <= 2.15.0 - Cross Site Scripting (XSS) vulnerability

    Author Cross Site Scripting (XSS) in YITH WooCommerce Tab Manager <= 2.15.0 versions.

    YITHEMES YITH WooCommerce Tab Manager Web / CMS
  • High 7.1
    CVE-2026-97272

    WordPress Premmerce Permalink Manager for WooCommerce plugin <= 2.3.13 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Premmerce Permalink Manager for WooCommerce <= 2.3.13 versions.

    Premmerce Premmerce Permalink Manager for WooCommerce Web / CMS
  • High 7.5
    CVE-2026-97197

    WordPress WordPress Backup & Migration plugin <= 1.6.0 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in WordPress Backup & Migration <= 1.6.0 versions.

    WebToffee WordPress Backup & Migration Web / CMS
  • High 8.8
    CVE-2026-96838 Public exploit

    WordPress Blacklist Manager &#8211; WooCommerce Anti-Fraud, Blacklist &amp; Checkout Verification plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability

    Unauthenticated Cross Site Request Forgery (CSRF) in Blacklist Manager &#8211; WooCommerce Anti-Fraud, Blacklist &amp; Checkout Verification <= 2.3.1 versions.

    YoOhw Studio Blacklist Manager &#8211; WooCommerce Anti-Fraud, Blacklist &amp; Checkout Verification Web / CMS
  • High 7.6
    CVE-2026-96828

    WordPress Category Discount Woocommerce plugin <= 5.18 - SQL Injection vulnerability

    Administrator SQL Injection in Category Discount Woocommerce <= 5.18 versions.

    Vidish Category Discount Woocommerce Web / CMS
  • High 7.5
    CVE-2026-96823

    WordPress Customer Reviews for WooCommerce plugin <= 5.120.0 - Arbitrary Content Deletion vulnerability

    Unauthenticated Arbitrary Content Deletion in Customer Reviews for WooCommerce <= 5.120.0 versions.

    CusRev Customer Reviews for WooCommerce Web / CMS
  • High 8.2
    CVE-2026-96817

    WordPress MakeCommerce for WooCommerce plugin <= 4.1.0 - Broken Access Control vulnerability

    Subscriber Broken Access Control in MakeCommerce for WooCommerce <= 4.1.0 versions.

    MakeCommerce.net MakeCommerce for WooCommerce Web / CMS
  • High 7.1
    CVE-2026-96816

    WordPress Trusted Shops Easy Integration for WooCommerce plugin <= 2.0.6 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Trusted Shops Easy Integration for WooCommerce <= 2.0.6 versions.

    vendidero Trusted Shops Easy Integration for WooCommerce Web / CMS
  • High 7.1
    CVE-2026-96814

    WordPress WooCommerce Product Table Lite plugin <= 5.6.7 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in WooCommerce Product Table Lite <= 5.6.7 versions.

    WP Titan Labs WooCommerce Product Table Lite Web / CMS
  • High 7.1
    CVE-2026-96352

    WordPress YITH WooCommerce Ajax Search plugin <= 2.28.0 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in YITH WooCommerce Ajax Search <= 2.28.0 versions.

    YITHEMES YITH WooCommerce Ajax Search Web / CMS
  • High 7.2
    CVE-2026-94677

    WordPress Kadence WooCommerce Email Designer plugin <= 1.5.19.1 - PHP Object Injection vulnerability

    Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions.

    Nexcess Kadence WooCommerce Email Designer Web / CMS
  • Medium 6.5
    CVE-2026-94674

    WordPress Pixel Manager for WooCommerce plugin <= 1.69.0 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in Pixel Manager for WooCommerce <= 1.69.0 versions.

    SweetCode Pixel Manager for WooCommerce Web / CMS
  • High 7.1
    CVE-2026-94081

    WordPress WordPress Persistent Login plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in WordPress Persistent Login <= 3.1.3 versions.

    lukeseager WordPress Persistent Login Web / CMS
  • High 7.2
    CVE-2026-93771

    WordPress Cost of Goods for WooCommerce plugin <= 3.5.2 - PHP Object Injection vulnerability

    Shop manager PHP Object Injection in Cost of Goods for WooCommerce <= 3.5.2 versions.

    WPFactory Cost of Goods for WooCommerce Web / CMS
  • High 7.2
    CVE-2026-93651

    WordPress Minimum and Maximum Quantity for WooCommerce plugin <= 2.1.2 - PHP Object Injection vulnerability

    Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce <= 2.1.2 versions.

    Dotstore Minimum and Maximum Quantity for WooCommerce Web / CMS
  • High 7.2
    CVE-2026-93624

    WordPress Music Player for WooCommerce plugin <= 1.9.1 - PHP Object Injection vulnerability

    Shop manager PHP Object Injection in Music Player for WooCommerce <= 1.9.1 versions.

    codepeople Music Player for WooCommerce Web / CMS
  • High 7.1
    CVE-2026-93512

    WordPress JW Player for WordPress plugin <= 2.3.11 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in JW Player for WordPress <= 2.3.11 versions.

    ilGhera JW Player for WordPress Web / CMS
  • Low 2.7
    CVE-2026-27085

    WordPress Astra WordPress theme theme <= 4.13.12 - Content Injection vulnerability

    Shop manager Content Injection in Astra WordPress Theme <= 4.13.12 versions.

    Brainstorm Force Astra WordPress Theme Web / CMS
  • Medium 5.4
    CVE-2026-13720

    Editor can forge file-provisioning provenance on dashboards via the dashboard API

    An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The da…

    Grafana Grafana OSS Grafana Enterprise grafana-12.3 Web / CMS Alpine Wolfi
  • Medium 4.3
    CVE-2026-13719

    Alert rules in restricted folders disclosed via the alert rules list API

    An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction was dropped and every alert rule in the organizati…

    Grafana Grafana OSS Grafana Enterprise grafana-12.3 Web / CMS Alpine Wolfi
  • Medium 6.5
    CVE-2026-102588

    Moodle: csrf in xml grade import

    A flaw was found in Moodle. The XML grade import feature lacks proper Cross-Site Request Forgery (CSRF) token validation. By tricking an authenticated user with grade management permissions into visiting a malicious webpage, an attacker can trigger unauthoriz…

    moodle Web / CMS Ubuntu
  • Low 2.7
    CVE-2026-102587

    Moodle: user list filters bypass profile field visibility

    A flaw was found in Moodle. User list filters do not properly enforce visibility restrictions on user profile fields. An authorized user with manager privileges can filter user lists using profile attributes they are not permitted to view directly, resulting …

    moodle Web / CMS Ubuntu
  • Medium 4.3
    CVE-2026-102586

    Moodle: xss via password reset link due to insufficient username escaping

    A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cross-site scripting (XSS) attack. By convincing an unauthenticated user to access a specially crafted password reset link…

    moodle Web / CMS Ubuntu
  • Medium 4.3
    CVE-2026-102585

    Moodle: group validation missing when enrolling user to course

    A flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the application does not verify whether the selected group actually belongs to that course. An authenticated user with teacher privileges could exploit this flaw …

    moodle Web / CMS Ubuntu
  • Medium 4.3
    CVE-2026-102584

    Moodle: missing capability check allows unauthorised grade penalty recalculation

    A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade penalties without holding the required permissions. This issue allows unauthorized users to modify grade penalty records,…

    moodle Web / CMS Ubuntu
  • Low 2.7
    CVE-2026-102583

    Moodle: incorrect capability check in ai generate image web service

    A flaw was found in Moodle. An incorrect capability check in the artificial intelligence (AI) editor placement's image generation web service allows an authenticated user to invoke the feature without holding the required capability. This flaw permits unautho…

    moodle Web / CMS Ubuntu