Export limit exceeded: 413205 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (413205 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-112327 | 2026-10-22 | 9.3 Critical | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.11. | ||||
| CVE-2026-112313 | 2026-10-22 | 7.1 High | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ACF Extended ACF Extended acf-extended allows Stored XSS.This issue affects ACF Extended: from n/a through 0.9.2.7. | ||||
| CVE-2026-112312 | 2026-10-22 | 7.5 High | ||
| Missing Authorization vulnerability in ACF Extended ACF Extended acf-extended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ACF Extended: from n/a through 0.9.2.7. | ||||
| CVE-2026-112311 | 2026-10-22 | 6.5 Medium | ||
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ACF Extended ACF Extended acf-extended allows Path Traversal.This issue affects ACF Extended: from n/a through 0.9.2.7. | ||||
| CVE-2026-112242 | 2026-10-22 | 8.8 High | ||
| Incorrect Privilege Assignment vulnerability in Cozmoslabs Profile Builder profile-builder allows Privilege Escalation.This issue affects Profile Builder: from n/a through 4.0.4. | ||||
| CVE-2026-111972 | 2026-10-22 | 4.9 Medium | ||
| The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not verify that a user is authorised to act on the targeted media attachment, allowing authenticated users with the author role and above to delete arbitrary media attachments, including those uploaded by other users and administrators. | ||||
| CVE-2026-111971 | 2026-10-22 | 6.8 Medium | ||
| The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not sanitise and escape collection and gallery names before storing them and outputting them in an administrative dashboard, allowing authenticated users with the author role and above to perform Stored Cross-Site Scripting attacks. | ||||
| CVE-2026-111958 | 1 Wordpress-extensions | 1 Royal Mcp | 2026-10-22 | 7.5 High |
| The Royal MCP WordPress plugin before 1.5.7 does not limit a preview-link token to the single preview it was issued for, so any party that obtains a valid token is authenticated as the token's owning user, an administrator in the default configuration, across the entire REST API with no nonce, leading to full site takeover. | ||||
| CVE-2026-111851 | 2026-10-22 | 7.6 High | ||
| Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Code Injection.This issue affects Royal Elementor Addons: from n/a through 1.7.1068. | ||||
| CVE-2026-111847 | 2026-10-22 | 5.4 Medium | ||
| Missing Authorization vulnerability in Kings Plugins MarketKing marketking-multivendor-marketplace-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MarketKing: from n/a through 2.1.72. | ||||
| CVE-2026-111842 | 2026-10-22 | 5.3 Medium | ||
| Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through 3.7.5. | ||||
| CVE-2026-111830 | 2 Wordpress-extensions, Wpmailster | 2 Wp Mailster, Wp Mailster | 2026-10-22 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Mailster WP Mailster wp-mailster allows Stored XSS.This issue affects WP Mailster: from n/a through 1.9.1.0. | ||||
| CVE-2026-111401 | 2026-10-22 | 6.5 Medium | ||
| Cross-Site Request Forgery (CSRF) vulnerability in Tailored Media Tailored Tools tailored-tools allows Cross Site Request Forgery.This issue affects Tailored Tools: from n/a through 3.0.3. | ||||
| CVE-2026-110894 | 3 Brainstorm Force, Brainstormforce, Wordpress-extensions | 3 Suredash, Suredash, Suredash | 2026-10-22 | 5.3 Medium |
| Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2. | ||||
| CVE-2026-110011 | 2 Deluxeblogtips, Wordpress-extensions | 2 Mb Custom Post Types \& Custom Taxonomies, Mb Custom Post Types & Custom Taxonomies | 2026-10-22 | 2.7 Low |
| The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform a capability check in its export feature, allowing users with a role as low as Contributor to read the configuration of admin-only custom post types and taxonomies, as well as the titles, dates, statuses and some stored content of other users' non-public posts and pages. | ||||
| CVE-2026-110010 | 2 Deluxeblogtips, Wordpress-extensions | 2 Mb Custom Post Types \& Custom Taxonomies, Mb Custom Post Types & Custom Taxonomies | 2026-10-22 | 4.8 Medium |
| The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform any capability or authentication check before allowing an unauthenticated request to re-run a legacy data migration, letting anyone revert a custom post type or taxonomy definition on sites upgraded from a pre-2.0 release back to its pre-upgrade state. This discards configuration changes an administrator made after upgrading and, where those changes had restricted a definition's visibility, silently re-exposes the definition and its content to anonymous visitors. | ||||
| CVE-2026-109987 | 1 Wordpress-extensions | 2 Pixel Your Site, Pixel Your Site Pro | 2026-10-22 | 7.2 High |
| The PixelYourSite WordPress plugin before 11.4.3, PixelYourSite Pro WordPress plugin before 12.6.8 do not sanitise and escape a cookie value before printing it into the page output, which, on a site running a full-page cache, allows unauthenticated attackers to store a Cross-Site Scripting payload in the cached page that is then served to other visitors. | ||||
| CVE-2026-109931 | 1 Wordpress-extensions | 1 Infility Global | 2026-10-22 | 3.7 Low |
| The Infility Global WordPress plugin before 2.16.25 does not perform any authorisation or nonce check on an AJAX action available to unauthenticated users, allowing any visitor to overwrite a machine-translation configuration value belonging to a companion Infility Global WordPress plugin before 2.16.25. | ||||
| CVE-2026-109927 | 1 Wordpress-extensions | 1 Hipaa Forms | 2026-10-22 | 7.2 High |
| The HIPAA Forms WordPress plugin before 3.3.2 does not perform a capability check when handling a request that rebuilds its own custom user role, allowing a user who already holds that role to grant it administrator-level capabilities and escalate their privileges. | ||||
| CVE-2026-103234 | 2 Roxnor, Wordpress-extensions | 2 Wp Ultimate Review, Wp Ultimate Review | 2026-10-22 | 4.8 Medium |
| The WP Ultimate Review WordPress plugin before 2.4.5 does not neutralise shortcodes in all of the review fields submitted through its public review form, which is available to unauthenticated visitors, allowing them to execute arbitrary shortcodes when the affected field is displayed, provided user reviews and that field's display are enabled. | ||||