Skip to content
OpenAdvisories

Source

ENISA EU Vulnerability Database

Source: https://euvd.enisa.europa.eu/

All Critical High Medium Low Exploited only Public exploit

97,168 results · Clear filters · Feed

  • High 8.8
    CVE-2026-39774

    WordPress Tourfic Pro plugin <= 1.17.3 - Privilege Escalation vulnerability

    Unauthenticated Privilege Escalation in Tourfic Pro <= 1.17.3 versions.

    Tourfic AI Studio Tourfic Pro
  • High 8.8
    CVE-2026-39775

    WordPress JobZilla - Job Board WordPress Theme theme <= 2.2 - Privilege Escalation vulnerability

    Subscriber Privilege Escalation in JobZilla - Job Board WordPress Theme <= 2.2 versions.

    DexignZone JobZilla - Job Board WordPress Theme Web / CMS
  • High 8.5
    CVE-2026-39771

    WordPress Buddyboss Platform plugin <= 3.1.0 - SQL Injection vulnerability

    Subscriber SQL Injection in Buddyboss Platform <= 3.1.0 versions.

    MightyNetworks vs BuddyBoss Buddyboss Platform
  • High 7.5
    CVE-2026-39769

    WordPress Graphina plugin <= 3.1.12 - Broken Authentication vulnerability

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Iqonic Designs Graphina – Charts and Graphs For Elementor graphina-elementor-charts-and-graphs allows Password Recovery Exploitation.This issue affects Graphina – Charts and Graphs For …

    Iqonic Designs Graphina – Charts and Graphs For Elementor
  • High 7.1
    CVE-2026-39766

    WordPress ARForms plugin <= 7.1.2 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in ARForms <= 7.1.2 versions.

    Repute InfoSystems ARForms
  • High 7.2
    CVE-2026-39765

    WordPress Challan plugin <= 3.7.88 - Privilege Escalation vulnerability

    Shop Manager Privilege Escalation in Challan <= 3.7.88 versions.

    WebAppick Challan
  • High 7.1
    CVE-2026-39758

    WordPress Midtrans-WooCommerce plugin <= 2.32.3 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Midtrans-WooCommerce <= 2.32.3 versions.

    Midtrans Midtrans-WooCommerce Web / CMS
  • High 7.7
    CVE-2026-39752

    WordPress Jobs for WordPress plugin <= 2.8.2 - Arbitrary File Deletion vulnerability

    Contributor Arbitrary File Deletion in Jobs for WordPress <= 2.8.2 versions.

    BlueGlass Interactive Jobs for WordPress Web / CMS
  • High 7.5
    CVE-2026-39751

    WordPress PayPlug for WooCommerce (Official) plugin <= 3.1.0 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in PayPlug for WooCommerce (Official) <= 3.1.0 versions.

    Payplug PayPlug for WooCommerce (Official) Web / CMS
  • High 7.1
    CVE-2026-39750

    WordPress StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin <= 2.0.6 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.0.6 versions.

    wedevs StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart Web / CMS
  • High 7.1
    CVE-2026-39748

    WordPress EduMall theme <= 4.5.3 - Reflected Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in EduMall <= 4.5.3 versions.

    ThemeMove EduMall
  • High 8.5
    CVE-2026-39747

    WordPress Woffice theme < 5.4.43 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WofficeIO Woffice woffice allows SQL Injection.This issue affects Woffice: from n/a before 5.4.43.

    WofficeIO Woffice
  • High 7.1
    CVE-2026-39745

    WordPress Contact Form to DB by BestWebSoft plugin <= 1.7.6 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Contact Form to DB by BestWebSoft <= 1.7.6 versions.

    bestweblayout Contact Form to DB by BestWebSoft
  • High 7.1
    CVE-2026-39731

    WordPress Database for CF7 plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Database for CF7 <= 1.2.6 versions.

    code4life Database for CF7
  • High 7.1
    CVE-2026-39730

    WordPress Wise Chat plugin <= 3.4.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Marcin Wise Chat wise-chat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wise Chat: from n/a through 3.4.3.

    Marcin Wise Chat
  • High 7.2
    CVE-2026-39729

    WordPress Edwiser Bridge plugin <= 4.3.4 - Sensitive Data Exposure vulnerability

    Unauthenticated Sensitive Data Exposure in Edwiser Bridge <= 4.3.4 versions.

    WisdmLabs Edwiser Bridge
  • High 7.2
    CVE-2026-39728

    WordPress Instapage Plugin plugin <= 3.7.2 - Server Side Request Forgery (SSRF) vulnerability

    Unauthenticated Server Side Request Forgery (SSRF) in Instapage Plugin <= 3.7.2 versions.

    instapagedev Instapage Plugin
  • High 7.1
    CVE-2026-39726

    WordPress Lumise Product Designer plugin < 2.1.4.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lumise Lumise Product Designer lumise allows Reflected XSS.This issue affects Lumise Product Designer: from n/a before 2.1.4.1.

    Lumise Lumise Product Designer
  • High 7.1
    CVE-2026-39724

    WordPress HTTP Requests Manager plugin <= 1.3.11 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in HTTP Requests Manager <= 1.3.11 versions.

    veppa HTTP Requests Manager
  • High 7.1
    CVE-2026-39720

    WordPress Mapster WP Maps plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Mapster WP Maps <= 2.0.4 versions.

    Mapster Technology Mapster WP Maps
  • High 7.1
    CVE-2026-39722

    WordPress WPLMS theme <= 4.972 - Reflected Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in WPLMS <= 4.972 versions.

    VibeThemes WPLMS
  • High 7.2
    CVE-2026-39719

    WordPress PDF Smart Viewer for Elementor plugin <= 1.0.4 - Server Side Request Forgery (SSRF) vulnerability

    Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor <= 1.0.4 versions.

    DeKnows PDF Smart Viewer for Elementor
  • High 7.1
    CVE-2026-32581

    WordPress Mooberry Book Manager plugin 4.16.2 - SQL Injection vulnerability

    Subscriber SQL Injection in Mooberry Book Manager 4.16.2 versions.

    Mooberry Dreams Mooberry Book Manager
  • High 7.5
    CVE-2026-32580

    WordPress WooCommerce Lottery plugin <= 2.2.9 - SQL Injection vulnerability

    Unauthenticated SQL Injection in WooCommerce Lottery <= 2.2.9 versions.

    wpgenie WooCommerce Lottery Web / CMS
  • High 7.1
    CVE-2026-32578

    WordPress ECPay Ecommerce for WooCommerce plugin <= 1.1.2606090 - Broken Access Control vulnerability

    Subscriber Broken Access Control in ECPay Ecommerce for WooCommerce <= 1.1.2606090 versions.

    techsupport ECPay Ecommerce for WooCommerce Web / CMS
  • High 7.1
    CVE-2026-32577

    WordPress Frontend File Manager plugin <= 23.6 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Frontend File Manager <= 23.6 versions.

    N-Media Frontend File Manager
  • High 7.1
    CVE-2026-32575

    WordPress SUMO Affiliates Pro plugin <= 11.7.0 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in SUMO Affiliates Pro <= 11.7.0 versions.

    Fantastic Plugins SUMO Affiliates Pro
  • High 7.1
    CVE-2026-32574

    WordPress Smart Forms plugin <= 2.6.104 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EDGARROJAS Smart Forms smart-forms allows DOM-Based XSS.This issue affects Smart Forms: from n/a through 2.6.104.

    Edgar Rojas Smart Forms
  • High 7.1
    CVE-2026-32572

    WordPress WP User Frontend Pro plugin <= 4.2.13 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in WP User Frontend Pro <= 4.2.13 versions.

    wedevs WP User Frontend Pro
  • High 7.1
    CVE-2026-32570

    WordPress Progressify - Progressive Web App (PWA) plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Progressify - Progressive Web App (PWA) <= 1.6.0 versions.

    DaftPlug Progressify - Progressive Web App (PWA)
  • High 7.1
    CVE-2026-32569

    WordPress WP Media folder plugin <= 6.2.2 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in WP Media folder <= 6.2.2 versions.

    JoomUnited WP Media folder
  • High 7.1
    CVE-2026-25433

    WordPress WP2LEADS plugin <= 3.5.7 - Broken Access Control vulnerability

    Subscriber Broken Access Control in WP2LEADS <= 3.5.7 versions.

    Tobias @Saleswonder.biz WP2LEADS
  • High 8.5
    CVE-2026-25434

    WordPress WP2LEADS plugin <= 3.5.7 - SQL Injection vulnerability

    Subscriber SQL Injection in WP2LEADS <= 3.5.7 versions.

    Tobias @Saleswonder.biz WP2LEADS
  • High 7.8
    CVE-2026-4889

    SQL Injection (SQLi) in eLoanApp Platform by RDL Technologies

    SQL injection (SQLi) vulnerability in the eLoanApp application, specifically in the POST parameter 'logina' of the user process endpoint '/ajax/users.php?op=verify'. The parameter is vulnerable to boolean-based and time-based SQL injection. Successfully explo…

    RDL Technologies eLoanApp Platform
  • High 7.1
    CVE-2026-103346

    WordPress Payflex Payment Gateway plugin <= 2.7.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomlister Payflex Payment Gateway payflex-payment-gateway allows Reflected XSS.This issue affects Payflex Payment Gateway: from n/a through 2.7.1.

    Tomlister Payflex Payment Gateway
  • High 7.3
    CVE-2026-105807

    SourceCodester Simple Student Information System searchquery.php sql injection

    A vulnerability was found in SourceCodester Simple Student Information System 1.0. This affects an unknown part of the file searchquery.php. Performing a manipulation results in sql injection. The attack can be initiated remotely.

    SourceCodester Simple Student Information System
  • High 7.6
    CVE-2026-59358 Public exploit

    UAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant type

    Improper authentication (CWE-287) in the OAuth token endpoint in Cloud Foundry UAA allows a remote, authenticated attacker holding a valid user access token to obtain a fully-privileged client_credentials token for the OAuth client that issued it, by presenti…

    Cloud Foundry CF Deployment UAA
  • High 8.8
    CVE-2026-105701

    ACPT (Premium) <= 2.0.66 - Authenticated (Subscriber+) Remote Code Execution via REST API Email Template

    The ACPT (Premium) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.66 via the render function. This is due to missing capability check on the REST API form creation endpoint and unsandboxed Twig environmen…

    Mauro Cassani ACPT (Premium) Web / CMS
  • High 7.8
    CVE-2026-57559

    Use After Free in DSP_Services

    Memory corruption while processing service requests.

    Qualcomm Snapdragon
  • High 7.8
    CVE-2026-57555

    Use After Free in DSP Service

    Memory Corruption when executing system service routines due to improper handling of user input buffers.

    Qualcomm Snapdragon