Category
Web / CMS
26,715 known vulnerabilities.
26,710 results · Feed
-
Medium 6.5
Travelly <= 2.3.11 - Missing Authorization to Authenticated (Contributor+) Payment Gateway Credential Disclosure via edit_form_top Handler on Tour/Hotel Edit Screen
The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.11 This is due to the plugin not properly verifying that a user is authorized to perform an actio…
-
Medium 6.4
Permalink Manager Lite <= 2.6.1 - Authenticated (Author+) Stored Cross-Site Scripting via Post Slug
The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slug' parameter in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authentica…
-
High 7.2
Graphina <= 3.1.13 - Unauthenticated Stored Cross-Site Scripting via Tree Chart Widget Settings
The Graphina – Charts and Graphs For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'iq_tree_chart_node_font_family (and any text control serialized into chart_data['settings'])' parameter in all versions up to, and includ…
-
Medium 6.4
Posts Table with Search & Sort <= 1.4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date_format' Shortcode Attribute
The Posts Table with Search & Sort plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'date_format' parameter in all versions up to, and including, 1.4.14 due to insufficient input sanitization and output escaping. This makes it possibl…
-
Medium 6.4
UsersWP <= 1.2.80 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'badge' Shortcode Attribute
The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'badge' parameter in all versions up to, and including, 1.2.80 due to insufficient …
-
Medium 5.3
Quick Event Manager 9.9.5 - 9.18 - Unauthenticated PayPal IPN Verification Bypass via the 'debug' Parameter
The Quick Event Manager WordPress plugin before 9.19 does not verify the authenticity of PayPal payment notifications before marking event registrations as paid, which could allow unauthenticated attackers to mark registrations as paid without making a paymen…
-
Medium 5.3
Order Tracking < 3.6.0 - Unauthenticated Payment Confirmation Forgery via PayPal IPN Listener
The Order Tracking WordPress plugin before 3.6.0 does not verify that a PayPal payment notification was sent to the merchant's account, or that its amount matches the order total, before marking an order as paid, which could allow unauthenticated attackers to…
-
Critical 10.0CVE-2026-118423 Public exploit
WP Libre Form 1.5.0.1 - Unauthenticated RCE via Arbitrary File Upload
The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution.
-
Medium 4.8
MC4WP: Mailchimp for WordPress < 4.15.0 - Unauthenticated Arbitrary Shortcode Execution via Dynamic Content Tag
The MC4WP: Mailchimp for WordPress WordPress plugin before 4.15.0 does not prevent request-derived values in its dynamic content tags from being processed as shortcodes when a form is embedded with its block, allowing unauthenticated visitors to execute arbit…
-
Medium 5.3
MC4WP: Mailchimp for WordPress < 4.15.0 - Unauthenticated Subscription Audience Override
The MC4WP: Mailchimp for WordPress plugin before 4.15.0 does not validate that the Mailchimp audience a sign-up form or bundled integration subscribes a visitor to matches the audience configured by the site owner, allowing unauthenticated visitors to subscri…
-
Medium 4.9
PublishPress Revisions 3.6.0 - 4.2.0 - Contributor+ Unapproved Content Publishing via Revision Workflow
The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not correctly restrict who may publish content, allowing users such as Contributors who can edit but not publish to make unreviewed po…
-
Low 2.7
PublishPress Revisions < 4.3.1 - Contributor+ Unpublished Content Disclosure via IDOR
The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not verify that a user requesting to duplicate or revise a post has access to that specific post, only that they can edit posts of tha…
-
Medium 4.3
PublishPress Revisions 3.9.0 - 4.2.0 - Subscriber+ Unpublished Content Disclosure
The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not verify that a user is permitted to read a given post before returning its content through its revision-comparison feature, allowin…
-
Medium 5.6
AutomatorWP < 6.0.7 - Unauthenticated Zoom/AWeber Integration Connection Hijack via OAuth Callback
The AutomatorWP WordPress plugin before 6.0.7 does not check that the user completing its Zoom and AWeber integration connections is allowed to do so, allowing unauthenticated attackers to replace the stored integration credentials with their own and divert t…
-
Medium 6.8
Blocks for ShopEngine < 2.4.4 - Contributor+ Stored XSS via gutenova_store_css
The ShopEngine Gutenberg WooCommerce Builder Blocks Addon WordPress plugin before 2.4.4 does not validate the user's capabilities or the ownership of the targeted post in one of its AJAX actions, and does not escape the stored value before outputting it in a …
-
High 7.5
Advanced Custom Fields (ACF®) < 6.8.11 - Unauthenticated Stored XSS via HTML Attribute Name Injection
The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not properly sanitize a stored field definition that can be modified through its comment handling, allowing unauthenticated users to inject a payload that is emitted as an HTML attribute na…
-
Critical 9.8CVE-2026-113615 Public exploit
GS JWT Authentication <= 1.0.0 - Unauthenticated Privilege Escalation via SQLi
The GS JWT Authentication for WP REST API WordPress plugin through 1.0.0 does not sanitize or parameterize a request value before using it in SQL queries on several unauthenticated REST routes, allowing unauthenticated attackers to perform SQL injection and o…
-
High 7.5
Anti-Spam by CleanTalk < 6.91 - Unauthenticated Stored XSS via Comment Author Email
The Anti-Spam, Spam FireWall by CleanTalk WordPress plugin before 6.91 does not escape a commenter-supplied value before outputting it on an administrative spam-review screen, allowing unauthenticated users to inject arbitrary web scripts that execute in the …
-
Medium 6.5
Surfer < 1.8.1.759 - Contributor+ Privilege Escalation via Editor API Key Disclosure
The Surfer WordPress plugin before 1.8.1.759 discloses a sensitive API credential to low-privileged users through the post editor page and relies on that same credential as the sole authorization for its privileged REST API, allowing users with contributor-le…
-
Medium 5.3
All-in-One Video Gallery < 5.1.0 - Unauthenticated Views and Duration Post Meta Write
The All-in-One Video Gallery WordPress plugin before 5.1.0 does not check the type, status or ownership of the target post before writing its view count and duration meta, allowing unauthenticated visitors to create or change that meta on any post, including …
-
High 8.0
All-in-One Video Gallery < 5.1.0 - Subscriber+ Stored XSS via 'image' Post Meta
The All-in-One Video Gallery WordPress plugin before 5.1.0 does not escape a video's stored thumbnail URL before outputting it in the admin video list, and does not sanitise that value when it is written outside its own editor, allowing users with a role as l…
-
Medium 6.5
WCFM Membership < 2.12.1 - Subscriber+ Payment Verification Bypass
The WCFM Membership WordPress plugin before 2.12.1 does not verify that payment was made before completing a paid membership, allowing any authenticated Subscriber/Customer to activate a paid vendor membership for free and gain the marketplace vendor role.
-
High 7.5
iubenda < 3.13.7 - Unauthenticated Stored XSS via Cookie Block HTML Parser
The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more WordPress plugin before 3.13.7 does not properly escape content it re-emits through its bundled HTML parser, allowing unauthenticated users to inject arbitrary web scripts in pages that…
-
High 8.8
Cool Media Filter <= 1.0.1 - Subscriber+ Privilege Escalation via role_permission
The Cool Media Filter WordPress plugin through 1.0.1 does not perform any capability or nonce check when updating the capabilities of a role, allowing any authenticated user, such as a subscriber, to grant their own role administrator capabilities and take ov…
-
Medium 6.8
GutenKit 2.5.0 - 2.5.4 - Author+ Stored XSS via Page Settings Custom CSS
The GutenKit WordPress plugin before 2.5.5 does not properly sanitize custom CSS saved against a post before printing it inside an inline style block on the published page, allowing users with the Author role and above to break out of the style element and st…
-
Critical 9.8
WHIZZ <= 1.1.8 - Unauthenticated Arbitrary User Password Reset
The WHIZZ WordPress plugin through 1.1.8 does not validate the password-reset key before updating a user's password, relying only on a nonce that is exposed to unauthenticated visitors, allowing attackers to set an arbitrary password for any user, including a…
-
Critical 9.8
Static Snapshot <= 0.2.1 - Unauthenticated RCE via 'name' Parameter
The Static Snapshot WordPress plugin through 0.2.1 does not sanitise shell metacharacters in a user-supplied value before concatenating it into operating-system commands run by the server, allowing unauthenticated attackers to execute arbitrary commands on th…
-
High 8.7
Ever Accounting < 2.3.3 - Accounting Manager+ Arbitrary File Deletion via CSV Import
The Ever Accounting WordPress plugin before 2.3.3 does not restrict the file path supplied to its CSV import routine to an allowed directory, allowing users with its custom Accounting Manager role (which does not have administrator privileges) to delete arbit…
-
High 8.8
MCB Stats <= 1.0.0 - Unauthenticated Stored XSS via User-Agent
The MCB WordPress plugin through 1.0.0 does not sanitise or escape request header values before storing them and later rendering them in the administrator statistics grid, allowing unauthenticated attackers to store malicious JavaScript that executes in an ad…
-
High 8.6
Mail Mage <= 0.0.25 - Unauthenticated SQLi via 'ewp_unsubscribe' Parameter
The Mail Mage WordPress plugin through 0.0.25 does not properly sanitise and escape a user-supplied value before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.
-
Critical 9.8
Wurdey <= 1.0.0 - Unauthenticated Administrator Authentication Bypass
The Wurdey WordPress plugin through 1.0.0 does not verify a request signature before logging a user in, allowing unauthenticated attackers to authenticate as an administrator knowing only the administrator's username.
-
Critical 9.8
Real Estate Website Builder <= 1.4.3 - Unauthenticated Account Takeover via User Email Update
The placester WordPress plugin through 1.4.3 does not perform any capability, nonce or ownership check on an AJAX action that updates account details, allowing unauthenticated attackers to overwrite any user's email address, including an administrator's, and …
-
Medium 6.9
Joomla Extension - tassos.gr - File deletion through improper access control in Advanced Custom Fields extension 2.8.13-2.8.15, 3.1.4-3.1.8 and Smile Pack 1.2.7-1.2.9, 2.1.2-2.1.6
Joomla Extension - tassos.gr - File deletion through improper access control in Advanced Custom Fields extension 2.8.13-2.8.15, 3.1.4-3.1.8 and Smile Pack 1.2.7-1.2.9, 2.1.2-2.1.6 - Anyone could delete images in the Gallery folders, including images on publis…
-
High 8.2
Joomla Extension - jreviews.com - Secret configs cached in a web-accessible in JReviews 1.0.0-5.12.0, 6.0.0-6.6.9
Joomla Extension - jreviews.com - Secret configs cached in a web-accessible in JReviews 1.0.0-5.12.0, 6.0.0-6.6.9 - JReviews caches its full settings table, including the Joomla global configuration secret (copied into cms_secret) and third-party API keys and…
-
High 8.3
Joomla Extension - balbooa.com - Unauthenticated arbitrary file deletion via path traversal in Gridbox < 2.20.5.0
Joomla Extension - balbooa.com - Unauthenticated arbitrary file deletion via path traversal in Gridbox < 2.20.5.0
-
Medium 6.9
Joomla Extension - balbooa.com - Unauthenticated deletion of submission/field files in Gridbox < 2.20.5.0
Joomla Extension - balbooa.com - Unauthenticated deletion of submission/field files in Gridbox < 2.20.5.0
-
High 8.6
Joomla Extension - balbooa.com - Stored XSS in reviews via inconsistent sanitization in Gridbox < 2.20.5.0
Joomla Extension - balbooa.com - Stored XSS in reviews via inconsistent sanitization in Gridbox < 2.20.5.0
-
High 8.6
Joomla Extension - balbooa.com - Unauthenticated stored XSS in the "Recent Comments / Recent Reviews" widget in Gridbox < 2.20.5.0
Joomla Extension - balbooa.com - Unauthenticated stored XSS in the "Recent Comments / Recent Reviews" widget in Gridbox < 2.20.5.0
-
High 7.5
Joomla Extension - tassos.gr - Privileged stored XSS in Advanced Custom Fields 2.8.2-2.8.15, 3.0.0-3.1.8 and Smile Pack 1.1.2-1.2.9, 2.0.0-2.1.6
Joomla Extension - tassos.gr - Privileged stored XSS in Advanced Custom Fields 2.8.2-2.8.15, 3.0.0-3.1.8 and Smile Pack 1.1.2-1.2.9, 2.0.0-2.1.6 - A user who could edit a Map marker label, like an article author, could add a script that ran for anyone who ope…
-
Medium 5.3
Content Egg WordPress Plugin < 12.1.0 Unauthenticated Information Disclosure via render-blocks
Content Egg plugin for WordPress before 12.1.0 contains a broken access control vulnerability that allows unauthenticated attackers to retrieve Content Egg product data from unpublished posts by calling the REST route POST /wp-json/content-egg/v1/render-block…