Export limit exceeded: 30199 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (30199 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-117524 | 2026-11-11 | 2.7 Low | ||
| The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not perform a status or capability check when resolving post identifiers passed to one of its shortcodes, allowing authenticated users with at least the Contributor role to disclose the content of other users' draft, private and password-protected posts. An Author can republish that content to anonymous visitors. | ||||
| CVE-2026-125435 | 2026-11-11 | 5.3 Medium | ||
| Insertion of Sensitive Information Into Sent Data vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Retrieve Embedded Sensitive Data.This issue affects PowerPack Addons for Elementor: from n/a through 3.1.3. | ||||
| CVE-2026-125777 | 2026-11-11 | 5.3 Medium | ||
| Insertion of Sensitive Information Into Sent Data vulnerability in Cozmoslabs Profile Builder profile-builder allows Retrieve Embedded Sensitive Data.This issue affects Profile Builder: from n/a through 4.0.6. | ||||
| CVE-2026-123178 | 2026-11-11 | 4.5 Medium | ||
| An insufficient input validation vulnerability in the listed NETGEAR Orbi Models router allows an authenticated administrator connected to the local network to execute unauthorized commands and modify the router’s software and functionality, potentially compromising the integrity of the affected device. | ||||
| CVE-2026-14839 | 1 Wordpress-extensions | 1 Mapster Wp Maps | 2026-11-11 | 7.5 High |
| The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowing unauthenticated users to retrieve the title and full content of any post regardless of its status, including unpublished (draft, pending, private, and trashed) posts. | ||||
| CVE-2026-16602 | 1 Wordpress-extensions | 1 Passster | 2026-11-11 | 7.5 High |
| The Passster WordPress plugin before 4.3.6 does not perform a post-status check before returning post content from an unauthenticated REST endpoint, allowing unauthenticated users to disclose the content of non-public (draft, private, and pending) posts on sites that have a captcha provider configured. | ||||
| CVE-2026-16603 | 1 Wordpress-extensions | 1 Passster | 2026-11-11 | 7.5 High |
| The Passster WordPress plugin before 4.3.6 does not enforce its category-based content protection on the WordPress REST API, allowing unauthenticated users to read the full content, title, and excerpt of category-locked posts through the core REST API. | ||||
| CVE-2026-16604 | 1 Wordpress-extensions | 1 Passster | 2026-11-11 | 7.5 High |
| The Passster WordPress plugin before 4.3.6 outputs password-protected block content in the public page response before verifying the password, allowing unauthenticated users to recover the protected content without knowing the password. | ||||
| CVE-2026-16993 | 1 Wordpress-extensions | 1 Dhl For Woocommerce | 2026-11-11 | 3.7 Low |
| The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not protect its shipping-label storage directory with server-independent access control, relying only on an Apache .htaccess file, so on a web server that does not honor .htaccess (such as nginx) an unauthenticated visitor can download stored shipping labels (each containing a customer's name and postal address) by requesting predictable filenames. | ||||
| CVE-2026-14314 | 1 Wordpress-extensions | 1 Peprodev Woocommerce Receipt Uploader | 2026-11-11 | 5.3 Medium |
| The PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 does not verify that a requested attachment belongs to the order referenced by its access token, allowing unauthenticated attackers to forge a token and disclose image attachments, including other customers' uploaded payment receipts, that they do not own. | ||||
| CVE-2026-16954 | 1 Wordpress-extensions | 1 Ai Engine | 2026-11-11 | 6.5 Medium |
| The AI Engine WordPress plugin before 3.6.4 does not redact secret configuration values before exposing them in an admin page's inline script data, allowing users with the Editor role to read the site's stored third-party API key and authentication tokens in cleartext, despite those secrets being restricted to administrators everywhere else. | ||||
| CVE-2026-18050 | 1 Wordpress-extensions | 1 Events Manager | 2026-11-11 | 7.5 High |
| The Events Manager WordPress plugin before 7.4 does not perform any authorization check on a REST route that serves temporarily stored file uploads, allowing unauthenticated users to retrieve another user's in-progress upload when its temporary identifier is known. The identifier is high-entropy, is disclosed only to the uploader, and the file is removed on submission or by a scheduled cleanup, so a cross-user read is not achievable by guessing alone. | ||||
| CVE-2026-3430 | 1 Wordpress-extensions | 1 Creative Mail | 2026-11-11 | 8.6 High |
| The Creative Mail WordPress plugin from 1.6.5 to 1.6.9 does not sanitize and escape a parameter before using in an SQL statement, leading to an unauthenticated SQL injection when the abandoned cart email is managed by creative mail. | ||||
| CVE-2026-5336 | 1 Wordpress-extensions | 1 Dataverse Integration | 2026-11-11 | 6.8 Medium |
| The DataPress (Dataverse Integration) WordPress plugin before 2.91 does not properly restrict access to its template rendering feature and exposes the viewing user's data to it, allowing users with a role as low as Contributor to disclose sensitive information, such as the session cookies of higher privileged users who view the affected content. | ||||
| CVE-2026-14943 | 1 Wordpress-extensions | 1 Password Protected | 2026-11-11 | 7.5 High |
| The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin before 2.8.4 does not restrict REST API access to authenticated users when a specific option is enabled, allowing unauthenticated visitors to bypass the sitewide password gate and read otherwise-protected content and account identifiers via the REST API. This re-introduces a previously-fixed issue (CVE-2024-0437), which was patched in 2.6.7 and regressed in 2.6.8. | ||||
| CVE-2026-16578 | 1 Wordpress-extensions | 1 Admin Safety Guard | 2026-11-11 | 7.5 High |
| The Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection WordPress plugin before 1.4.0 does not perform any capability check on one of its REST API endpoints, allowing unauthenticated attackers to retrieve the full list of registered users including their usernames, email addresses, roles, and two-factor authentication enrollment status. | ||||
| CVE-2026-16988 | 1 Wordpress-extensions | 1 Geodirectory | 2026-11-11 | 7.5 High |
| The GeoDirectory WordPress plugin before 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing, allowing unauthenticated users to disclose the title and exact geographic coordinates of non-public (pending or draft) listings. | ||||
| CVE-2026-18032 | 1 Wordpress-extensions | 1 Wp Data Access | 2026-11-11 | 7.5 High |
| The WP Data Access WordPress plugin before 5.5.79 does not validate the column names it accepts on one of its unauthenticated AJAX actions, and the nonce guarding that action does not cover them, allowing unauthenticated attackers to read arbitrary columns of the database table the affected front-end form is bound to, including user password hashes where that table is the users table. | ||||
| CVE-2026-18357 | 1 Wordpress-extensions | 1 Wpc Order Tip For Woocommerce | 2026-11-11 | 7.5 High |
| The WPC Order Tip for WooCommerce WordPress plugin before 3.3.1 does not perform authorisation or nonce checks in one of its reporting features, allowing unauthenticated attackers to retrieve sensitive order data belonging to any customer of the store, such as billing names, order IDs and statuses, fee amounts and order dates. | ||||
| CVE-2026-40454 | 1 Apache | 1 Iotdb C++ Client | 2026-11-11 | 7.5 High |
| Out-of-bounds Read, Improper Input Validation vulnerability in Apache IoTDB C++ client. Out-of-bounds reads in IoTDB C++ client TsBlock deserializer crash client process on malformed server data. This issue affects Apache IoTDB C++ client: from 1.3.5 before 1.3.8, from 2.0.5 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the issue. | ||||