Export limit exceeded: 422266 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 422266 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (422266 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-14919 | 1 Wordpress-extensions | 1 Shopmonitor.io | 2026-11-10 | 9.8 Critical |
| The ShopMonitor.io WordPress plugin before 1.2.0 does not properly restrict its email-rerouting test mode, gating it behind a trusted-source check that is satisfiable with client-supplied request headers, allowing unauthenticated attackers to redirect outgoing emails, including the WordPress administrator password-reset email, to an address they control and take over the administrator account. | ||||
| CVE-2026-12966 | 1 Wordpress-extensions | 1 Direct Payments For Woocommerce | 2026-11-10 | 5.3 Medium |
| The Direct Payments for WooCommerce WordPress plugin before 2.5.3 does not verify that the requester owns the targeted WooCommerce order in several unauthenticated AJAX handlers before changing its status and overwriting its payment metadata, allowing unauthenticated attackers to tamper with other customers' orders, including forging a "payment sent" state, overwriting the payment-method label, and attaching forged payment-proof files. | ||||
| CVE-2026-14197 | 1 Wordpress-extensions | 1 Fluent Support | 2026-11-10 | 3.8 Low |
| The Fluent Support WordPress plugin before 2.3.1 does not perform a per-ticket access check before reassigning a ticket's customer, allowing a restricted support agent to change the assigned customer of any ticket in the system, including tickets outside their granted scope. | ||||
| CVE-2026-14309 | 1 Wordpress-extensions | 1 Chat On Desk | 2026-11-10 | 8.1 High |
| The Chat On Desk Order Notifications WordPress plugin before 1.0.9 does not verify that the one-time password has been validated before processing a password-reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, and take over their accounts when SMS one-time-password password reset is enabled. | ||||
| CVE-2026-122062 | 1 Wordpress-extensions | 2 Pronamic Pay, Pronamic Pay Doneren Met Mollie | 2026-11-10 | 5.3 Medium |
| The Pronamic Pay WordPress plugin before 11.1.0, Pronamic Pay doneren met Mollie WordPress plugin before 1.7.1 do not restrict access to stored form submissions through the REST API, allowing unauthenticated users to read the messages that visitors submitted through the bundled forms. | ||||
| CVE-2026-103375 | 1 Wordpress-extensions | 1 Antom Payments | 2026-11-10 | 5.3 Medium |
| The Antom Payments WordPress plugin through 2.0.11 does not perform any ownership or authorisation check before returning an order's confirmation link, which contains its secret key, to unauthenticated visitors, allowing attackers to view any customer's order details, including name, address, phone number and email. | ||||
| CVE-2026-103303 | 1 Wordpress-extensions | 1 Turisbook Booking System | 2026-11-10 | 8.8 High |
| The Turisbook Booking System WordPress plugin through 1.3.8 does not have authorisation and CSRF checks when saving its settings, and does not sanitise and escape one of them before outputting it in an admin page, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators. | ||||
| CVE-2026-104307 | 1 Wordpress-extensions | 1 Backupwordpress | 2026-11-10 | 5.4 Medium |
| The BackUpWordPress plugin before 3.15 does not perform a capability or nonce check on an AJAX action that cleans up its backup directory, allowing any authenticated user (Subscriber and above) to delete the BackUpWordPress plugin before 3.15's backup protection and working files, removing download protection from stored backups and disrupting in-progress backups. | ||||
| CVE-2026-105970 | 1 Wordpress-extensions | 1 Bck Auto-confirm Bank Transfer | 2026-11-10 | 5.3 Medium |
| The Thanh Toán Quét Mã QR Code Tự Động WordPress plugin through 2.0.1 does not properly verify the authenticity of incoming bank-transfer payment notifications on a default installation, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid. | ||||
| CVE-2026-106015 | 1 Wordpress-extensions | 1 Ecommerce Affiliate | 2026-11-10 | 8.1 High |
| The Ecommerce Affiliate WordPress plugin through 1.0.0 does not restrict one-time password issuance and verification to the legitimate account owner, nor limit verification attempts, allowing unauthenticated attackers to take over any account, including administrators. | ||||
| CVE-2026-109925 | 1 Wordpress-extensions | 1 Productive Commerce | 2026-11-10 | 8.6 High |
| The Productive Commerce WordPress plugin before 1.1.54 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks. | ||||
| CVE-2026-110132 | 1 Wordpress-extensions | 1 Sync Post With Other Site | 2026-11-10 | 4.9 Medium |
| The Sync Post With Other Site WordPress plugin before 1.9.4 does not properly authorize a content-management action for post types other than pages, allowing users with Contributor-level access or above to create and modify arbitrary custom post types, including reassigning content authorship. | ||||
| CVE-2026-110963 | 1 Wordpress-extensions | 1 Userplace | 2026-11-10 | 9.8 Critical |
| The Userplace WordPress plugin through 1.2.0 does not perform authorization checks on an AJAX action available to unauthenticated users and publicly exposes the nonce that protects it, allowing unauthenticated attackers to create an administrator account or write arbitrary site options, leading to full site takeover. | ||||
| CVE-2026-114188 | 2 Wordpress-extensions, Wpvibes | 2 Anywhere Elementor, Anywhere Elementor | 2026-11-10 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Stored XSS.This issue affects AnyWhere Elementor: from n/a through 1.3.0. | ||||
| CVE-2026-114189 | 2 Wordpress-extensions, Wpvibes | 2 Anywhere Elementor, Anywhere Elementor | 2026-11-10 | 8.5 High |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Blind SQL Injection.This issue affects AnyWhere Elementor: from n/a through 1.3.0. | ||||
| CVE-2026-114186 | 2 Wordpress-extensions, Wpvibes | 2 Anywhere Elementor, Anywhere Elementor | 2026-11-10 | 6.5 Medium |
| Missing Authorization vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AnyWhere Elementor: from n/a through 1.3.0. | ||||
| CVE-2026-115212 | 1 Wordpress-extensions | 1 Mview | 2026-11-10 | 8.8 High |
| The mView 豆瓣电影 WordPress plugin through 1.0.3 does not validate the type, name, or source of a remotely fetched file, nor perform any capability or authorization check, before saving it to a web-accessible directory, allowing any authenticated user such as a subscriber to upload arbitrary PHP files and achieve remote code execution. | ||||
| CVE-2026-115213 | 1 Wordpress-extensions | 1 Easy-js-wpapi | 2026-11-10 | 9.8 Critical |
| The EASY-JS-WPAPI Client HANDLE for the WordPress REST-API WordPress plugin through 2.0 does not prevent the administrator credentials it stores from being disclosed to unauthenticated users and does not correctly verify authentication, allowing unauthenticated attackers to obtain administrator credentials and gain full administrator access to the site. | ||||
| CVE-2026-115237 | 1 Wordpress-extensions | 1 Grand Job | 2026-11-10 | 9.8 Critical |
| The Grand Job WordPress plugin through 1.2.1 does not correctly verify the password reset code before updating a user's password, allowing unauthenticated attackers to set the password of arbitrary accounts, including administrators, and fully take over the site. | ||||
| CVE-2026-115256 | 1 Wordpress-extensions | 1 Mail Debug For Woocommerce | 2026-11-10 | 7.5 High |
| The Mail Debug for WooCommerce WordPress plugin through 1.3.0 does not perform any capability, authentication, or nonce check on one of its email-logging actions, which is exposed to unauthenticated users and is not restricted to its own data, allowing anyone to read the full body of every email the site has sent, including password-reset emails whose reset key lets an attacker take over an administrator account. | ||||