Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 61

Export CSV
CVE-2026-87844

Product Designer <= 1.0.40 - Unauthenticated Design Template Data Injection

The PickPlugins Product Designer for WooCommerce WordPress plugin through 1.0.40 does not perform any capability check and its nonce verification is inverted, accepting requests with an invalid or absent nonce while rejecting valid ones, and it does not validate the post the data is written to, allowing unauthenticated users to insert design template data into the metadata of any post on the site.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Pickplugins Wordpress-extensions
Products
Product Designer For Woocommerce Product Designer
CVE-2024-11080

Post Grid and Gutenberg Blocks – ComboBlocks 2.2.85 - 2.3.32 - Unauthenticated Hook Injection

The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Unauthenticated Hook Injection in versions 2.2.32 to 2.3.1 via several functions in the ~/includes/blocks/form-wrap/function.php file. This makes it possible for unauthenticated attackers to execute actions with hooks in WordPress, granted no other security controls are present in the function.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Pickplugins Wordpress
Products
Post Grid Wordpress
CVE-2026-10207

PickPlugins Question Answer <= 1.2.73 - Unauthenticated SQL Injection via 'id' Parameter

The PickPlugins Question Answer plugin for WordPress is vulnerable to SQL Injection in versions up to and including 1.2.73. This is due to insufficient sanitization of user-supplied input via the 'id' GET parameter in the user profile template combined with the use of wp_unslash() which removes WordPress's magic quotes protection, followed by direct concatenation into a SQL query without proper escaping or prepared statements in the qa_user_profile_card() function. This makes it possible for unauthenticated attackers to append additional SQL queries into existing queries, which can be used to extract sensitive information from the database.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Pickplugins Wordpress
Products
Pickplugins Question Answer Wordpress
CVE-2026-10862

Accordions <= 2.3.23 - Authenticated (Custom+) Stored Cross-Site Scripting via Accordion Body Field

The Accordions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Accordion body field in all versions up to, and including, 2.3.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Pickplugins Wordpress
Products
Accordion Wordpress
CVE-2025-62745

WordPress Team Showcase plugin <= 1.22.28 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Team Showcase allows Stored XSS. This issue affects Team Showcase: from n/a through 1.22.28.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Pickplugins Wordpress
Products
Team Showcase Wordpress
CVE-2026-7458

User Verification by PickPlugins <= 2.0.46 - Unauthenticated Authentication Bypass via OTP Verification REST API Endpoint

The User Verification by PickPlugins plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.46. This is due to the use of a loose PHP comparison operator to validate OTP codes in the "user_verification_form_wrap_process_otpLogin" function. This makes it possible for unauthenticated attackers to log in as any user with a verified email address, such as an administrator, by submitting a "true" OTP value.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Pickplugins Wordpress
Products
User Verification By Pickplugins Wordpress
CVE-2026-32497

WordPress User Verification plugin <= 2.0.45 - Email Verification Bypass vulnerability

Weak Authentication vulnerability in PickPlugins User Verification user-verification allows Authentication Abuse.This issue affects User Verification: from n/a through <= 2.0.45.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Pickplugins Wordpress
Products
User Verification Wordpress
CVE-2024-30441

WordPress Combo Blocks plugin <= 2.2.74 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Post Grid allows Reflected XSS.This issue affects Post Grid: from n/a through 2.2.74.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Pickplugins Wordpress
Products
Post Grid Wordpress
CVE-2024-32816

WordPress Combo Blocks plugin <= 2.2.78 - Sensitive Data Exposure via API vulnerability

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in PickPlugins Post Grid.This issue affects Post Grid: from n/a through 2.2.78.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Pickplugins
Products
Post Grid
CVE-2023-51666

WordPress Related Post Plugin <= 2.0.53 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Related Post allows Stored XSS.This issue affects Related Post: from n/a through 2.0.53.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Pickplugins
Products
Related Post
CVE-2023-40211

WordPress Post Grid Plugin <= 2.2.50 is vulnerable to Sensitive Data Exposure

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in PickPlugins Post Grid Combo – 36+ Gutenberg Blocks.This issue affects Post Grid Combo – 36+ Gutenberg Blocks: from n/a through 2.2.50.

CVSS 3.1 · 7.5 High EPSS 2.2% KEV · Not listed
Vendors
Pickplugins
Products
Post Grid Combo
CVE-2025-53421

WordPress Accordion plugin <= 2.3.14 - Broken Access Control vulnerability

Missing Authorization vulnerability in PickPlugins Accordion accordions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accordion: from n/a through <= 2.3.14.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Pickplugins Wordpress
Products
Accordion Wordpress
CVE-2025-68605

WordPress Post Grid and Gutenberg Blocks plugin <= 2.3.23 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Stored XSS.This issue affects Post Grid and Gutenberg Blocks: from n/a through <= 2.3.23.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Pickplugins Wordpress
Products
Post Grid Wordpress
CVE-2025-68000

WordPress Testimonial Slider plugin <= 2.0.15 - Broken Access Control vulnerability

Missing Authorization vulnerability in PickPlugins Testimonial Slider testimonial allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Testimonial Slider: from n/a through <= 2.0.15.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Pickplugins Wordpress
Products
Testimonial Slider Wordpress
CVE-2026-25455

WordPress Product Slider for WooCommerce plugin <= 1.13.61 - Broken Access Control vulnerability

Missing Authorization vulnerability in PickPlugins Product Slider for WooCommerce woocommerce-products-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Slider for WooCommerce: from n/a through <= 1.13.61.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Pickplugins Wordpress
Products
Product Slider For Woocommerce Wordpress
CVE-2025-66058

WordPress Post Grid and Gutenberg Blocks plugin <= 2.3.17 - Broken Access Control vulnerability

Missing Authorization vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Grid and Gutenberg Blocks: from n/a through <= 2.3.17.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Pickplugins Wordpress
Products
Post Grid Wordpress
CVE-2025-63043

WordPress Post Grid and Gutenberg Blocks plugin <= 2.3.23 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Grid and Gutenberg Blocks: from n/a through <= 2.3.23.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Pickplugins Wordpress
Products
Post Grid Wordpress
CVE-2025-62924

WordPress Post Grid and Gutenberg Blocks plugin <= 2.3.17 - Broken Access Control vulnerability

Missing Authorization vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Grid and Gutenberg Blocks: from n/a through <= 2.3.17.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Pickplugins Wordpress
Products
Post Grid Wordpress
CVE-2025-60162

WordPress Job Board Manager Plugin <= 2.1.61 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Job Board Manager job-board-manager allows DOM-Based XSS.This issue affects Job Board Manager: from n/a through <= 2.1.61.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Pickplugins Wordpress
Products
Job Board Manager Wordpress