Export limit exceeded: 424351 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 424351 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 424351 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 424351 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (424351 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-15039 | 1 Wordpress-extensions | 1 Gift Cards For Woocommerce Pro | 2026-11-11 | 9.8 Critical |
| The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of its upload paths, allowing unauthenticated users to upload arbitrary files, including PHP code, which can lead to remote code execution. | ||||
| CVE-2026-15249 | 1 Wordpress-extensions | 1 Patterns Kit | 2026-11-11 | 5.4 Medium |
| The Patterns Kit WordPress plugin through 1.0.3 does not escape a link attribute before its client-side script inserts it into the page, allowing users with a role as low as Contributor to store a payload that executes in the browser of a user who views the content and clicks the affected element. | ||||
| CVE-2026-16051 | 1 Wordpress-extensions | 1 Wpmudev-updates | 2026-11-11 | 9.8 Critical |
| The wpmudev-updates WordPress plugin before 5.0.1 does not verify the integrity of the packages installed through its remote management interface, nor protect those requests against replay, allowing an attacker able to obtain or replay a valid signed management request to install and execute arbitrary code (remote code execution). | ||||
| CVE-2026-16253 | 1 Wordpress-extensions | 1 Total Upkeep | 2026-11-11 | 7.5 High |
| The Total Upkeep WordPress plugin before 1.17.3 does not adequately protect the secret that authorizes its backup-restore functionality and exposes it to unauthenticated users, allowing them to disclose sensitive backup information and to force a full site restore that overwrites the live site's files and database. This is an incomplete fix of CVE-2020-36848, as the protection added at the time never took effect on distributed copies of the plugin. | ||||
| CVE-2026-16538 | 1 Wordpress-extensions | 1 Wallet For Woocommerce | 2026-11-11 | 9.1 Critical |
| The Wallet for WooCommerce WordPress plugin before 1.6.10 does not verify the amount actually collected for a wallet top-up before crediting the wallet, allowing customers to top up their wallet balance for less than its value. | ||||
| CVE-2026-19217 | 1 Wordpress-extensions | 1 Royal Elementor Addons | 2026-11-11 | 5.4 Medium |
| The Royal Addons for Elementor WordPress plugin before 1.7.1065 does not validate a widget setting used to build an HTML tag before outputting it, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks. | ||||
| CVE-2026-15045 | 1 Wordpress-extensions | 1 Wallet System For Woocommerce | 2026-11-11 | 6.5 Medium |
| The Wallet System for WooCommerce WordPress plugin before 2.7.10 does not validate a user-supplied wallet amount against the customer's actual stored balance during checkout, allowing authenticated customers to arbitrarily reduce their own order total, including down to zero, and complete checkout without paying the merchant. | ||||
| CVE-2026-16990 | 1 Wordpress-extensions | 1 Payment Button For Paypal | 2026-11-11 | 5.3 Medium |
| The Payment Button for PayPal WordPress plugin through 1.2.3.44 does not enforce the merchant-configured price server-side and trusts a client-supplied payment amount, allowing unauthenticated attackers to create a real PayPal order against the merchant for an arbitrary lower amount. | ||||
| CVE-2026-17008 | 1 Wordpress-extensions | 1 Quick Paypal Payments | 2026-11-11 | 5.3 Medium |
| The Quick Paypal Payments WordPress plugin through 5.7.50 does not verify the paid amount, receiver, or payment status in its PayPal IPN handler and marks an order paid on an order-token match alone, so a buyer who pays an arbitrary small amount can have a full-price order marked paid. | ||||
| CVE-2026-82014 | 2026-11-11 | 4.3 Medium | ||
| Any authenticated user, including a Viewer, could change the preferences of any team, such as its home dashboard, theme and timezone, through an undocumented endpoint with no access control, and so redirect every member of that team to a dashboard of their choice (missing authorization). | ||||
| CVE-2026-13328 | 1 Wordpress-extensions | 1 Food Menu | 2026-11-11 | 5.3 Medium |
| The Food Menu WordPress plugin before 6.0.2 does not perform any capability or ownership check on its reservation-status update action, which is also exposed to unauthenticated users and gated only by a nonce that is publicly available to visitors, allowing unauthenticated attackers to change the status of arbitrary reservations. | ||||
| CVE-2026-18945 | 1 Wordpress-extensions | 1 Wp Helper Premium | 2026-11-11 | 8.2 High |
| The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its custom order confirmation page or when handling the related AJAX actions, allowing unauthenticated users to view other customers' order details, including personal information, as well as change the state of arbitrary orders. Exploitation requires WooCommerce to be active and the WP Helper Premium WordPress plugin before 4.7.6's optional order confirmation page module to be enabled. | ||||
| CVE-2026-15413 | 1 Wordpress-extensions | 1 Link Factory | 2026-11-11 | 10 Critical |
| The Link Factory WordPress plugin is a backdoor. Distributed as a "homepage sentence publisher", it exposes an operator-controlled REST API under /wp-json/link-factory/v1/ - authenticated by a detached Ed25519 signature verified against a hardcoded operator public key (except for the health check). | ||||
| CVE-2026-14290 | 1 Wordpress-extensions | 1 Embed Google Photos Album | 2026-11-11 | 6.8 Medium |
| The Embed Google Photos album WordPress plugin through 2.2.1 does not escape a shortcode attribute value before outputting it inside an HTML attribute, allowing users with the Contributor role or above to inject arbitrary JavaScript that executes in the browser of any user, including administrators, who views the affected post. | ||||
| CVE-2026-15205 | 1 Wordpress-extensions | 1 Paymob For Woocommerce | 2026-11-11 | 8.6 High |
| The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthenticated payment callback, and performs this query before verifying the payment provider's HMAC signature. This allows unauthenticated attackers to perform SQL injection and read arbitrary data from the database — including user credentials and other secrets — through both in-band (reflected) and time-based blind extraction. | ||||
| CVE-2026-16739 | 1 Wordpress-extensions | 1 Epeken All Kurir | 2026-11-11 | 5.9 Medium |
| The Epeken All Kurir for Woocommerce WordPress plugin through 2.1.4 does not verify that a payment-confirmation request originates from the owner of the targeted order, nor that any payment actually occurred, allowing unauthenticated attackers to mark arbitrary orders as confirmed and, in a non-default configuration, paid. | ||||
| CVE-2026-14229 | 1 Wordpress-extensions | 1 Ecs | 2026-11-11 | 5.3 Medium |
| The ECS WordPress plugin before 4.3.8 does not check the post status or any capability when rendering an Elementor document requested through one of its AJAX actions, allowing unauthenticated users to retrieve the rendered content of unpublished (private, draft, pending) documents by supplying their identifier. | ||||
| CVE-2026-14230 | 1 Wordpress-extensions | 1 Ecs | 2026-11-11 | 5.4 Medium |
| The ECS WordPress plugin before 4.3.8 does not perform capability or object-ownership checks on its Dynamic Repeater AJAX handlers (gated only by a capability-agnostic nonce that any edit_posts user obtains from the Elementor editor), so a Contributor can write a data-source binding into any post — including admin-authored pages — whose attacker-controlled values are rendered into a widget's repeater output without sanitization, executing JavaScript in the session of any visitor or administrator who views the page. | ||||
| CVE-2026-16541 | 1 Wordpress-extensions | 1 Simply Schedule Appointments | 2026-11-11 | 6.5 Medium |
| The Simply Schedule Appointments WordPress plugin before 1.6.12.17 does not restrict the user records returned by some of its REST endpoints to those the requester is entitled to see, allowing users with a low-privileged staff role to disclose the names and email addresses of arbitrary registered users. | ||||
| CVE-2026-14242 | 2026-11-11 | 6.5 Medium | ||
| A user with the Editor role could delete, move, push or pull Git Sync managed resources in folders where they only had view access, by creating a provisioning job through the jobs resource API, which skipped the folder permission checks (incorrect authorization). | ||||