Skip to content
OpenAdvisories

Source

ENISA EU Vulnerability Database

Source: https://euvd.enisa.europa.eu/

All Critical High Medium Low Exploited only Public exploit

97,168 results · Clear filters · Feed

  • High 8.1
    CVE-2026-104747

    WordPress Haaken theme <= 1.5 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Haaken <= 1.5 versions.

    Edge-Themes Haaken
  • High 7.1
    CVE-2026-104670

    WordPress LearnPress plugin <= 4.4.9 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in LearnPress <= 4.4.9 versions.

    ThimPress LearnPress
  • High 8.1
    CVE-2026-104405

    WordPress GiveWP plugin <= 4.17.0 - Privilege Escalation vulnerability

    Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions.

    Nexcess GiveWP
  • High 7.3
    CVE-2026-104406

    WordPress picu plugin <= 3.10.1 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in picu <= 3.10.1 versions.

    picu picu
  • High 7.1
    CVE-2026-104395

    WordPress picu plugin <= 3.10.1 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in picu <= 3.10.1 versions.

    picu picu
  • High 7.1
    CVE-2026-104394

    WordPress Charitable plugin <= 1.8.12.3 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions.

    Syed Balkhi Charitable
  • High 7.2
    CVE-2026-104387

    WordPress PowerPress Podcasting plugin <= 11.17.9 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in PowerPress Podcasting <= 11.17.9 versions.

    blubrry PowerPress Podcasting
  • High 7.5
    CVE-2026-104385

    WordPress Groundhogg plugin <= 4.8.3 - Sensitive Data Exposure vulnerability

    Unauthenticated Sensitive Data Exposure in Groundhogg <= 4.8.3 versions.

    Adrian Tobey Groundhogg
  • High 7.5
    CVE-2026-102387

    WordPress Xserver Migrator plugin <= 1.6.6 - Sensitive Data Exposure vulnerability

    Unauthenticated Sensitive Data Exposure in Xserver Migrator <= 1.6.6 versions.

    XServer Xserver Migrator
  • High 8.5
    CVE-2026-102915

    WordPress WPO365 plugin <= 44.1 - Broken Access Control vulnerability

    Subscriber Broken Access Control in WPO365 <= 44.1 versions.

    Marco van Wieren WPO365
  • High 8.1
    CVE-2026-95594

    WordPress SMS Alert Order Notifications plugin <= 4.0.0 - Privilege Escalation vulnerability

    Incorrect Privilege Assignment vulnerability in Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications sms-alert allows Privilege Escalation.This issue affects SMS Alert Order Notifications: from n/a through 4.0.0.

    Cozy Vision Technologies Pvt SMS Alert Order Notifications
  • High 7.3
    CVE-2026-95526

    WordPress BEAR plugin <= 1.2.2 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in BEAR <= 1.2.2 versions.

    RealMag777 BEAR
  • High 7.1
    CVE-2026-94675

    WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.13 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack <= 6.2.13 versions.

    Fluent Forms Free vs Pro Fluent Forms Pro Add On Pack
  • High 8.8
    CVE-2026-62072

    WordPress Progress Planner plugin <= 1.10.0 - Broken Access Control vulnerability

    Subscriber Broken Access Control in Progress Planner <= 1.10.0 versions.

    Progress Planner Progress Planner
  • High 7.5
    CVE-2026-48199

    WordPress Sermon'e plugin <= 1.0.2 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Sermon'e <= 1.0.2 versions.

    Beplusthemes Sermon'e
  • High 7.2
    CVE-2026-48197

    WordPress PublishPress Capabilities plugin <= 2.45.0 - Privilege Escalation vulnerability

    Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation.This issue affects PublishPress Capabilities: from n/a through 2.45.0.

    publishpress PublishPress Capabilities
  • High 7.5
    CVE-2026-42638

    WordPress Easy Digital Downloads plugin <= 3.7.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Awesomemotive Easy Digital Downloads easy-digital-downloads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Digital Downloads: from n/a through 3.7.1.

    Awesome Motive Easy Digital Downloads
  • High 7.1
    CVE-2026-42636

    WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.4.6 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.4.6 versions.

    WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent
  • High 7.1
    CVE-2026-42635

    WordPress WooCommerce Simple Auctions plugin <= 3.0.10 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in WooCommerce Simple Auctions <= 3.0.10 versions.

    wpgenie WooCommerce Simple Auctions Web / CMS
  • High 7.1
    CVE-2026-42418

    WordPress Social Rocket plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Socialrocket Social Rocket social-rocket allows Reflected XSS.This issue affects Social Rocket: from n/a through 1.3.5.

    Social Rocket Social Rocket
  • High 7.1
    CVE-2026-42634

    WordPress Video Background Block – Use video as background in the section. plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Video Background Block – Use video as background in the section. <= 2.0.3 versions.

    bPlugins Video Background Block – Use video as background in the section.
  • High 8.5
    CVE-2026-42416

    WordPress UDesign Core plugin <= 4.15.0 - SQL Injection vulnerability

    Subscriber SQL Injection in UDesign Core <= 4.15.0 versions.

    AndonDesign UDesign Core
  • High 8.5
    CVE-2026-42414

    WordPress ListingPro plugin <= 2.9.12 - SQL Injection vulnerability

    Subscriber SQL Injection in ListingPro <= 2.9.12 versions.

    Cridio Studio ListingPro
  • High 7.5
    CVE-2026-42413

    WordPress Snapshotify – All-in-One Backup & Restore & Migrate plugin <= 1.3.2 - Sensitive Data Exposure vulnerability

    Unauthenticated Sensitive Data Exposure in Snapshotify &#8211; All-in-One Backup &amp; Restore &amp; Migrate <= 1.3.2 versions.

    DaftPlug Snapshotify &#8211; All-in-One Backup &amp; Restore &amp; Migrate
  • High 7.5
    CVE-2026-41562

    WordPress Norvis Backup plugin <= 1.1.0 - Sensitive Data Exposure vulnerability

    Unauthenticated Sensitive Data Exposure in Norvis Backup <= 1.1.0 versions.

    norvisgabriel Norvis Backup
  • High 7.5
    CVE-2026-41561

    WordPress Museder RestoreOne plugin <= 2.7.276 - Sensitive Data Exposure vulnerability

    Unauthenticated Sensitive Data Exposure in Museder RestoreOne <= 2.7.276 versions.

    Adrian Lin Museder RestoreOne
  • High 7.5
    CVE-2026-41560

    WordPress WXD Backup Lite plugin <= 1.0.2 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in WXD Backup Lite <= 1.0.2 versions.

    wxdlabs WXD Backup Lite
  • High 7.5
    CVE-2026-41559

    WordPress SafeSnap – Verified WordPress Backup & Restore plugin <= 2.1.2 - Sensitive Data Exposure vulnerability

    Unauthenticated Sensitive Data Exposure in SafeSnap – Verified WordPress Backup &amp; Restore <= 2.1.2 versions.

    Pluginjoy SafeSnap – Verified WordPress Backup &amp; Restore Web / CMS
  • High 7.1
    CVE-2026-40807

    WordPress CF7 Views – Complete Entry Management for Contact Form 7 plugin <= 3.2.6 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in CF7 Views &#8211; Complete Entry Management for Contact Form 7 <= 3.2.6 versions.

    Aman CF7 Views &#8211; Complete Entry Management for Contact Form 7
  • High 7.1
    CVE-2026-40806

    WordPress Blog, Posts and Category Filter for Elementor plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Blog, Posts and Category Filter for Elementor <= 2.1.0 versions.

    Plugin Devs Blog, Posts and Category Filter for Elementor
  • High 7.5
    CVE-2026-39796

    WordPress Advanced Posts Listing – Show Post List Easily plugin <= 1.0.8 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Advanced Posts Listing – Show Post List Easily <= 1.0.8 versions.

    Flipper Code – WordPress Development Company Advanced Posts Listing – Show Post List Easily
  • High 7.5
    CVE-2026-39794

    WordPress WooCommerce Multivendor Marketplace – REST API plugin <= 1.6.3 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in WooCommerce Multivendor Marketplace – REST API <= 1.6.3 versions.

    WC Lovers WooCommerce Multivendor Marketplace – REST API Web / CMS
  • High 8.8
    CVE-2026-39793

    WordPress Simple JWT Login plugin 4.0.0 - Broken Authentication vulnerability

    Subscriber Broken Authentication in Simple JWT Login 4.0.0 versions.

    Nicu Micle Simple JWT Login
  • High 8.6
    CVE-2026-39792

    WordPress Simple File List plugin <= 6.3.11 - Arbitrary File Deletion vulnerability

    Unauthenticated Arbitrary File Deletion in Simple File List <= 6.3.11 versions.

    Mitchell Bennis Simple File List
  • High 7.1
    CVE-2026-39790

    WordPress VikRentCar plugin <= 1.4.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Reflected XSS.This issue affects VikRentCar: from n/a through 1.4.7.

    e4jvikwp VikRentCar
  • High 7.1
    CVE-2026-39781

    WordPress Document Gallery plugin <= 5.1.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dan Rossiter Document Gallery document-gallery allows Reflected XSS.This issue affects Document Gallery: from n/a through 5.1.1.

    Dan Rossiter Document Gallery
  • High 7.1
    CVE-2026-39784

    WordPress Hotel Booking plugin <= 3.8 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Hotel Booking <= 3.8 versions.

    nicdark Hotel Booking
  • High 7.1
    CVE-2026-39780

    WordPress Youzify plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Youzify <= 1.3.7 versions.

    Youzify Youzify
  • High 7.1
    CVE-2026-39778

    WordPress Ansar Import – One Click Starter Sites – for Elementor & Themes plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Ansar Import – One Click Starter Sites – for Elementor &amp; Themes <= 2.1.2 versions.

    Themeansar Ansar Import – One Click Starter Sites – for Elementor &amp; Themes
  • High 8.0
    CVE-2026-39776

    WordPress Tabs plugin <= 2.5 - Remote Code Execution (RCE) vulnerability

    Editor Remote Code Execution (RCE) in Tabs <= 2.5 versions.

    wpshopmart Tabs