Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2,272

Export CSV
CVE-2026-97280

WordPress Review Schema plugin 3.1.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Mamunur Rashid Review Schema review-schema allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Review Schema: 3.1.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mamunur Rashid Wordpress-extensions
Products
Review Schema Review Schema
CVE-2026-103082

WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery (SSRF) vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Server Side Request Forgery.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.6.2.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
La-studioweb Wordpress-extensions
Products
Element Kit For Elementor La-studio Element Kit For Elementor
CVE-2026-97265

WordPress JetEngine plugin <= 3.8.15.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock. Jetimpex Inc. JetEngine allows Stored XSS. This issue affects JetEngine: from n/a through 3.8.15.3.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Crocoblock. Jetimpex Inc. Wordpress-extensions
Products
Jetengine Jetengine
CVE-2026-97290

WordPress Photonic Gallery & Lightbox for Flickr, SmugMug & Others plugin <= 3.36 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.36 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Sayontan Sinha Wordpress-extensions
Products
Photonic Gallery & Lightbox For Flickr, Smugmug & Others Photonic Gallery & Lightbox For Flickr, Smugmug & Others
CVE-2026-89424

Duplicate Post <= 1.5.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'noti_token' Parameter

The Duplicate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'noti_token' parameter in all versions up to, and including, 1.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires that the site owner has enabled the plugin's User Level Permissions for the Subscriber role, as this grants access to the i_saw_this_noti AJAX branch needed to deliver the payload.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Inisev Wordpress-extensions
Products
Duplicate Post Duplicate Post
CVE-2026-97661

Business Essentials for Contact Form 7 <= 1.2.1 - Unauthenticated Stored Cross-Site Scripting via 'gateway' Form Field

The Business Essentials for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'gateway' Form Field in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Payments module to be enabled and a form to be configured to accept both PayPal and Stripe as payment gateways.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Scottpaterson Wordpress-extensions
Products
Business Essentials For Contact Form 7 Business Essentials For Contact Form 7
CVE-2026-103353

WordPress FluentForm plugin <= 6.2.14 - Broken Access Control vulnerability

Incorrect Behavior Order vulnerability in WP ManageNinja LLC FluentForm fluentform allows Removing Important Client Functionality.This issue affects FluentForm: from n/a through 6.2.14.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Wpmanageninja
Products
Fluentform Fluent Forms
CVE-2026-103067

WordPress Memberful - Membership Plugin plugin <= 1.81.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Memberful Memberful - Membership Plugin memberful-wp allows Cross Site Request Forgery.This issue affects Memberful - Membership Plugin: from n/a through 1.81.0.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed
Vendors
Memberful Wordpress-extensions
Products
Memberful - Membership Plugin Memberful
CVE-2026-103340

WordPress Site Reviews plugin <= 8.3.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Gemini Labs Site Reviews site-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Site Reviews: from n/a through 8.3.2.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Geminilabs Wordpress-extensions
Products
Site Reviews Site Reviews