Export limit exceeded: 422010 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (422010 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-118202 | 1 Wordpress-extensions | 1 Limit Login Attempts Reloaded | 2026-11-10 | 7.5 High |
| The Limit Login Attempts Security WordPress plugin before 3.4.1 does not confirm that its two-factor authentication step succeeded before completing a login and treats a failure to build that step as success, so an attacker who holds a protected user's password can bypass the second factor by sending a request header that breaks the step. | ||||
| CVE-2026-121759 | 1 Wordpress-extensions | 1 Fusion Page Builder | 2026-11-10 | 4.9 Medium |
| The Fusion Page Builder WordPress plugin before 1.7.1 does not check that the user owns the content it moves to the trash, which could allow users with a role as low as Contributor to trash arbitrary posts and pages, or delete them permanently where the trash is disabled. | ||||
| CVE-2026-121874 | 1 Wordpress-extensions | 1 Post Duplicator | 2026-11-10 | 7.2 High |
| The Post Duplicator WordPress plugin before 3.0.18 does not restrict settings saves to its own options, allowing a site administrator on a multisite network who is not a Super Admin to overwrite arbitrary options of their site, including the role definitions, and so grant themselves network-management capabilities. | ||||
| CVE-2026-121875 | 1 Wordpress-extensions | 1 Post Duplicator | 2026-11-10 | 7.2 High |
| The Post Duplicator WordPress plugin before 3.0.18 does not validate the capabilities assigned to roles through its permissions settings, allowing a site administrator on a multisite network who is not a Super Admin to grant any role arbitrary capabilities, including the network-management capabilities reserved to the Super Admin. | ||||
| CVE-2026-123091 | 1 Wordpress-extensions | 1 Vigilant | 2026-11-10 | 7.5 High |
| The Vigilant WordPress plugin before 2.11.0 does not enforce its two-factor authentication on login forms other than the default WordPress one, allowing an attacker who knows a user's password to skip the second factor and log in as that user. | ||||
| CVE-2026-123128 | 1 Wordpress-extensions | 1 Gembooking | 2026-11-10 | 3.7 Low |
| The GemBooking WordPress plugin before 1.7.1 does not serialise concurrent booking requests per team member, allowing unauthenticated users to create overlapping confirmed bookings for the same team member across different bookable items by sending simultaneous requests. | ||||
| CVE-2026-123131 | 1 Wordpress-extensions | 1 Gembooking | 2026-11-10 | 5.9 Medium |
| The GemBooking WordPress plugin before 1.7.1 does not properly verify that a REST request is addressed to its own routes before temporarily granting staff users administrative capabilities, allowing users with the GemBooking WordPress plugin before 1.7.1's Staff role to delete arbitrary posts and update the site's settings. | ||||
| CVE-2026-123751 | 1 Wordpress-extensions | 1 Wp Duplicate | 2026-11-10 | 9.8 Critical |
| The WP Duplicate WordPress plugin through 1.1.11 does not properly verify a request authentication value and does not validate the path or type of uploaded files, making it possible for unauthenticated attackers to write arbitrary files to the server and achieve remote code execution. This vulnerability is being actively exploited in the wild. | ||||
| CVE-2026-121760 | 2 Wedevs, Wordpress-extensions | 2 Wedocs, Wedocs | 2026-11-10 | 7.5 High |
| Missing Authorization vulnerability in weDevs weDocs wedocs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects weDocs: from n/a through 2.6.1. | ||||
| CVE-2026-111403 | 2 Wordpress-extensions, Wpinventory | 2 Wp Inventory Manager, Wp Inventory Manager | 2026-11-10 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Inventory WP Inventory Manager wp-inventory-manager allows Reflected XSS.This issue affects WP Inventory Manager: from n/a through 2.5.9. | ||||
| CVE-2026-121780 | 2 Gijo Varghese, Wordpress-extensions | 2 Flying Images, Flying Images | 2026-11-10 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gijo Varghese Flying Images nazy-load allows Stored XSS.This issue affects Flying Images: from n/a through 2.4.15. | ||||
| CVE-2026-123465 | 2 Mycred, Wordpress-extensions | 2 Mycred, Mycred | 2026-11-10 | 7.5 High |
| Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in myCred myCred mycred allows Retrieve Embedded Sensitive Data.This issue affects myCred: from n/a through 4.0.2. | ||||
| CVE-2026-121764 | 2 Foliovision, Wordpress-extensions | 2 Fv Flowplayer Video Player, Fv Flowplayer Video Player | 2026-11-10 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Flowplayer Video Player fv-wordpress-flowplayer allows Stored XSS.This issue affects FV Flowplayer Video Player: from n/a through 7.5.56.7212. | ||||
| CVE-2026-119514 | 2 Webful Creations, Wordpress-extensions | 2 Repairbuddy, Repairbuddy | 2026-11-10 | 6.3 Medium |
| Incorrect Privilege Assignment vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Privilege Escalation.This issue affects RepairBuddy: from n/a through 4.1234. | ||||
| CVE-2026-82436 | 1 Apache | 1 Storm Client | 2026-11-10 | N/A |
| Description `DefaultStateSerializer`, used to persist and restore stateful bolt checkpoints, configured Kryo with class registration disabled and an instantiation strategy that constructs objects without invoking their constructors, then deserialized whatever bytes the state store returned. A party able to write to the topology's keyspace in the state store, for example a co-tenant of a shared Redis instance or anyone with network access to it, could therefore place a serialized object graph that executes code inside the worker JVM when the state is restored. This requires the Redis-backed state provider, which is not the default. Write access to a state-store key is a data-plane privilege; code execution in the worker JVM is not, so the two are not equivalent. Mitigation Upgrade to 3.1.0, where the state serializer requires registered classes. Note that this is a behaviour change for existing state: checkpoints written by an affected version may fail to restore, and a migration step may be required. Users who cannot upgrade immediately should restrict network and credential access to the state store to the cluster itself. Credit The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm. | ||||
| CVE-2026-106466 | 1 Wordpress-extensions | 1 Jwt Auth | 2026-11-10 | 7.5 High |
| The JWT Auth WordPress plugin through 3.0.2 does not invalidate previously issued refresh tokens when a user changes or resets their password or removes a connected device, allowing an attacker who obtained a refresh token before such an event to keep issuing valid access tokens and retain authenticated access to the account, up to Administrator. | ||||
| CVE-2026-115252 | 1 Wordpress-extensions | 1 Confection | 2026-11-10 | 10 Critical |
| The Confection WordPress Cable WordPress plugin from 0.4.0 to 0.4.7 does not perform any capability or nonce checks before saving its settings and writing one of them, unmodified, into a standalone PHP file that it then serves, allowing unauthenticated users to execute arbitrary PHP code on the server. | ||||
| CVE-2026-106008 | 1 Wordpress-extensions | 1 Fraudlabs Pro Sms Verification | 2026-11-10 | 5.3 Medium |
| The FraudLabs Pro SMS Verification WordPress plugin from 1.11.2 to 1.12.1 does not perform authorisation or validity checks before marking a WooCommerce order's SMS verification as completed, allowing unauthenticated users to forge the verified state of an order and bypass the plugin's SMS verification control. | ||||
| CVE-2026-121570 | 2 Wordpress-extensions, Wpchill | 2 Rsvp And Event Management, Rsvp And Event Management | 2026-11-10 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill RSVP and Event Management rsvp allows Stored XSS.This issue affects RSVP and Event Management: from n/a through 2.7.17. | ||||
| CVE-2026-120855 | 2 Templateinvaders, Wordpress-extensions | 2 Ti Woocommerce Wishlist, Ti Woocommerce Wishlist | 2026-11-10 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TemplateInvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Stored XSS.This issue affects TI WooCommerce Wishlist: from n/a through 2.14.0. | ||||