Skip to content
OpenAdvisories

Source

ENISA EU Vulnerability Database

Source: https://euvd.enisa.europa.eu/

All Critical High Medium Low Exploited only Public exploit

405,160 results · Feed

  • Medium 5.3
    CVE-2026-125437

    WordPress Simply Schedule Appointments plugin <= 1.6.13.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n/a through 1.6.13.0.

    N Squared Simply Schedule Appointments
  • Medium 5.4
    CVE-2026-125434

    WordPress RepairBuddy plugin <= 4.1235 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RepairBuddy: from n/a through 4.1235.

    Webful Creations RepairBuddy
  • Medium 4.3
    CVE-2026-124753

    WordPress WP Job Portal plugin <= 2.7.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through 2.7.2.

    Ahmad WP Job Portal
  • Medium 6.5
    CVE-2026-124752

    WordPress Element Pack Elementor Addons plugin <= 10.0.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 10.0.3.

    bdthemes Element Pack Elementor Addons
  • Medium 5.3
    CVE-2026-124421

    WordPress ZoloBlocks plugin <= 2.8.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in BdThemes ZoloBlocks zoloblocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ZoloBlocks: from n/a through 2.8.2.

    bdthemes ZoloBlocks
  • Medium 5.3
    CVE-2026-124413

    WordPress WP User Manager plugin <= 2.10.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.10.4.

    WP User Manager WP User Manager
  • Medium 5.4
    CVE-2026-124408

    WordPress WPCafe plugin <= 3.0.22 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Arraytics WPCafe wp-cafe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCafe: from n/a through 3.0.22.

    Arraytics WPCafe
  • Medium 5.3
    CVE-2026-124255

    WordPress Events Made Easy plugin <= 3.3.5 - Content Injection vulnerability

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Franky Events Made Easy events-made-easy allows Code Injection.This issue affects Events Made Easy: from n/a through 3.3.5.

    Franky Events Made Easy
  • Medium 6.5
    CVE-2026-123473

    WordPress Happy Addons for Elementor plugin <= 3.51.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Stored XSS.This issue affects Happy Addons for Elementor: from n/a through 3.51.0.

    wedevs Happy Addons for Elementor
  • Medium 6.5
    CVE-2026-121773

    WordPress GenerateBlocks plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GeneratePress GenerateBlocks generateblocks allows Stored XSS.This issue affects GenerateBlocks: from n/a through 2.5.0.

    GeneratePress GenerateBlocks
  • Medium 5.4
    CVE-2026-121770

    WordPress VISeek plugin <= 1.0.5 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in VillaTheme VISeek viseek-easy-custom-search allows Cross Site Request Forgery.This issue affects VISeek: from n/a through 1.0.5.

    villatheme VISeek
  • Medium 5.3
    CVE-2026-121574

    WordPress Passster plugin <= 4.3.20 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WP Chill Passster content-protector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Passster: from n/a through 4.3.20.

    WP Chill Passster
  • Medium 5.3
    CVE-2026-121028

    WordPress Strong Testimonials plugin <= 3.3.17 - Content Injection vulnerability

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WP Chill Strong Testimonials strong-testimonials allows Code Injection.This issue affects Strong Testimonials: from n/a through 3.3.17.

    WP Chill Strong Testimonials
  • Medium 5.3
    CVE-2026-121014

    WordPress WP Job Portal plugin <= 2.7.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through 2.7.2.

    Ahmad WP Job Portal
  • Medium 6.3
    CVE-2026-124745

    Busybox: tar deferred hardlink target resolved through a deferred symlink escapes the extraction directory

    A flaw was found in BusyBox. When extracting an archive, the tar utility improperly resolves deferred hardlink targets across symbolic links pointing outside the intended extraction directory. An attacker could provide a specially crafted archive that links t…

    Red Hat Red Hat Enterprise Linux 6 Red Hat Hardened Images Linux
  • Medium 6.3
    CVE-2026-124744

    A flaw was found in BusyBox. When extracting files using the cpio utility with path traversal protection enabled, hardl…

  • Medium 5.3
    CVE-2026-126663

    Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains a path traversal vulnerability that al…

    contao contao
  • High 7.1
    CVE-2026-126662

    Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains an access control bypass vulnerability…

    contao contao
  • High 8.7
    CVE-2026-126659

    BlueprintUE Self-Hosted Edition 1.0.0 before 4.3.5 contains a resource exhaustion vulnerability that allows unauthentic…

    blueprintue blueprintue-self-hosted-edition
  • Medium 5.3
    CVE-2026-126658

    ByteStash 1.5.10 before 1.6.2 contains an insufficient session expiration vulnerability that allows holders of API keys…

    jordan-dalby ByteStash
  • Unscored —
    CVE-2026-122096

    Apache DataSketches Java: Uncontrolled resource consumption when deserializing crafted sketch images

    Uncontrolled Resource Consumption vulnerability in the sketch deserialization of Apache DataSketches Java. Several deserializers trusted sizes and counts declared in the serialized input. A small crafted input could make an application allocate an excessive a…

    Apache Software Foundation Apache DataSketches Java
  • Medium 4.8
    CVE-2026-112201

    A flaw was found in the login-failure storage component of Keycloak, the identity and access management solution. This …

    Red Hat keycloak-services
  • High 8.8
    CVE-2026-125446

    WordPress Edwiser Bridge plugin <= 4.3.4 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in WisdmLabs Edwiser Bridge edwiser-bridge allows Cross Site Request Forgery.This issue affects Edwiser Bridge: from n/a through 4.3.4.

    WisdmLabs Edwiser Bridge
  • Medium 4.3
    CVE-2026-125445

    WordPress VOD Infomaniak plugin <= 1.5.16 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Cross Site Request Forgery.This issue affects VOD Infomaniak: from n/a through 1.5.16.

    Infomaniak Network VOD Infomaniak
  • Medium 4.3
    CVE-2026-125782

    WordPress PowerPress Podcasting plugin <= 11.18.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PowerPress Podcasting: from n/a through 11.18.2.

    Blubrry Podcasting PowerPress Podcasting
  • Medium 5.3
    CVE-2026-125435

    WordPress PowerPack Addons for Elementor plugin <= 3.1.3 - Sensitive Data Exposure vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Retrieve Embedded Sensitive Data.This issue affects PowerPack Addons for Elementor: from n/a through 3.1.3.

    IdeaBox Creations PowerPack Addons for Elementor
  • Medium 6.5
    CVE-2026-124411

    WordPress SureCart plugin <= 4.12.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.12.1.

    Brainstorm Force SureCart
  • Medium 4.3
    CVE-2026-124417

    WordPress WP Job Portal plugin <= 2.7.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through 2.7.2.

    Ahmad WP Job Portal
  • Medium 4.3
    CVE-2026-124269

    WordPress Happy Addons for Elementor plugin <= 3.51.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Happy Addons for Elementor: from n/a through 3.51.0.

    wedevs Happy Addons for Elementor
  • Medium 5.3
    CVE-2026-124262

    WordPress Ad Inserter plugin <= 2.8.19 - Content Injection vulnerability

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Igor Funa Ad Inserter ad-inserter allows Code Injection.This issue affects Ad Inserter: from n/a through 2.8.19.

    Igor Funa Ad Inserter
  • Medium 5.3
    CVE-2026-125439 Public exploit

    WordPress Kit (formerly ConvertKit) plugin <= 3.5.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit): from n/a through 3.5.0.

    Kit Kit (formerly ConvertKit)
  • Medium 5.3
    CVE-2026-115600

    WordPress Restrict User Access – Membership plugin with Force plugin <= 2.8.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in DEV Institute Restrict User Access – Membership Plugin with Force restrict-user-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restrict User Access – Membership Plugin w…

    DEV Institute Restrict User Access – Membership Plugin with Force
  • High 8.8
    CVE-2026-125784

    WordPress RestroPress plugin <= 3.4.11 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Magnigenie RestroPress restropress allows Cross Site Request Forgery.This issue affects RestroPress: from n/a through 3.4.11.

    magnigenie RestroPress
  • Medium 6.5
    CVE-2026-122671

    Missing Authorization vulnerability in E2Pdf.com e2pdf e2pdf allows Exploiting Incorrectly Configured Access Control Se…

    E2Pdf e2pdf
  • Medium 6.5
    CVE-2026-125781

    WordPress Event post plugin <= 6.1.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NOUS Ouvert Utile et Simple Event post event-post allows Stored XSS.This issue affects Event post: from n/a through 6.1.2.

    NOUS Ouvert Utile et Simple Event post
  • Medium 5.3
    CVE-2026-125444

    Missing Authorization vulnerability in King Addons King Addons for Elementor king-addons allows Exploiting Incorrectly …

    KingAddons.com King Addons for Elementor
  • Medium 5.3
    CVE-2026-124271

    Missing Authorization vulnerability in DEV Institute Restrict User Access – Membership Plugin with Force restrict-user-…

    DEV Institute Restrict User Access – Membership Plugin with Force
  • Medium 6.4
    CVE-2026-119097

    Author Image <= 4.9.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter

    The Author Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 4.9.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticate…

    denis-de-bernardy Author Image Web / CMS
  • High 8.8
    CVE-2026-103883

    The 6Storage Rentals plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeo…

    6Storage 6Storage Rentals Web / CMS
  • High 8.8
    CVE-2026-119615

    The Reset Database plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.1.3. …

    maltesesolutions Reset Database Web / CMS