Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2,272

Export CSV
CVE-2026-84069

WebFacing Email Accounts for cPanel 5.3 - 5.3.6 - Unauthenticated LFI via assets/index.php

The WebFacing™ WordPress plugin before 5.4 does not restrict access to one of its bundled scripts and does not validate a user-supplied path before using it to include a local file, allowing unauthenticated users to perform Local File Inclusion.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Webfacing
CVE-2026-81655

Ad Inserter 2.8.12 - 2.8.18 - Subscriber+ RCE / Stored XSS via Global Custom Fields

The Ad Inserter WordPress plugin before 2.8.19 does not correctly restrict access to one of its settings pages, making it reachable by every logged in user under a configuration its own settings allow, and does not filter the content saved there, allowing users with a role as low as subscriber to store code which is then executed as PHP or served unescaped to site visitors.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Ad Inserter
CVE-2026-85002

EmbedPress < 4.6.7 - Contributor+ Stored XSS via Instagram Carousel Block Attributes

The EmbedPress WordPress plugin before 4.6.7 does not escape one of its block attributes before outputting it inside an HTML attribute, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against higher privileged users viewing the post.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Embedpress
CVE-2026-86609

Download Manager Pro < 7.5.6 - Unauthenticated Stored XSS via Email Lock Subscription

The Download Manager WordPress plugin before 7.5.6 does not sanitise and escape data submitted through its email-locked download subscription form before outputting it back in an admin page, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against administrators. This affects the commercial Pro edition only; the free Download Manager WordPress plugin before 7.5.6 published under the same slug does not ship the affected feature.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Download Manager Pro
CVE-2026-89000

WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ SSRF via Campaign Run

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check or validate the destination of a user-supplied feed URL before fetching it server-side, allowing users with contributor-level access and above to make the server issue requests to internal-only resources and read the responses back.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Wpematico Rss Feed Fetcher
CVE-2026-89003

WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ SSRF via Campaign Preview

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check before fetching a user-supplied URL and rendering the response, allowing users with contributor-level access and above to force the server to issue requests to internal-only hosts and read the responses back.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Wpematico Rss Feed Fetcher
CVE-2026-89006

WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Stored XSS via Feed Import

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not sanitize imported feed content before storing it as post content, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Wpematico Rss Feed Fetcher
CVE-2026-92436

Mailchimp for WooCommerce < 6.3 - Unauthenticated Customer Email and Cart Disclosure via IDOR

The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication or verify ownership before loading a saved cart from a request-supplied identifier that is derived from a customer's email address, allowing an unauthenticated attacker who knows a customer's email address to confirm that the customer shops at the store and to read that customer's saved cart contents.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Mailchimp For Woocommerce
CVE-2026-96895

WP YouTube Lyte < 1.7.31 - Contributor+ Stored XSS via Embed Block Attributes

The WP YouTube Lyte WordPress plugin before 1.7.31 does not escape some attributes of YouTube embed blocks before outputting them in an HTML attribute when rendering the block, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Wp Youtube Lyte
CVE-2026-96897

Optima Express 8.5.0 - 8.7.5 - Unauthenticated Author Account Creation & Application Password Rotation via ihf_clear_cache

The Optima Express IDX WordPress plugin before 8.7.6 does not perform any authorisation check on one of its AJAX actions that is available to logged-out users, allowing unauthenticated attackers to force the creation of a fixed author-role account and to repeatedly rotate its application password on any connected install.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Optima Express Idx
CVE-2026-96899

Optima Express 8.6.0 - 8.7.5 - Author+ Stored XSS via faq_script

The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value submitted through one of its REST endpoints before storing it and echoing it into the document head when the post is rendered, allowing users with a role as low as author to perform Stored Cross-Site Scripting attacks.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Optima Express Idx
CVE-2026-97319

PowerPress < 11.17.2 - Contributor+ Stored XSS via Podcast Player Block

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.2 does not sanitize and escape a block attribute before outputting it in a page, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Powerpress
CVE-2026-86785

Social Commerce for WooCommerce <= 2.5.4 - Unauthenticated Plugin Option and Product Sync Status Update

The Social Commerce for WooCommerce WordPress plugin through 2.5.4 does not have authorisation checks on some of its REST API endpoints, allowing unauthenticated users to update Social Commerce for WooCommerce WordPress plugin through 2.5.4 configuration and product synchronisation state.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Social Commerce For Woocommerce
CVE-2022-4997

JetFormBuilder Stripe Gateway < 1.1.0 - Unauthenticated Blind SQLi via Payment Token

The jet-form-builder-stripe-gateway WordPress plugin before 1.1.0 does not sanitise and escape a payment token before using it in a SQL statement, allowing unauthenticated users to extract arbitrary data from the database, including password hashes.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Jet Form Builder Stripe Gateway
CVE-2025-15696

Real3D Flipbook Lite < 5.4 - Author+ Stored XSS

The Real3D Flipbook WordPress plugin before 5.4 does not sanitize or escape several flipbook editor fields before rendering them back in the admin editor, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any user who later opens the affected flipbook for editing, including administrators.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Real3d Flipbook Lite
CVE-2026-14321

Divi Dash < 1.0.7 - Unauthenticated Denial of Service via IP Address Spoofing

The divi-dash WordPress plugin before 1.0.7 does not validate the source of the client IP address it uses for rate limiting and banning, allowing unauthenticated attackers to spoof arbitrary IP addresses in order to bypass rate limiting, ban chosen addresses from the feature, and grow a stored option without bound, resulting in denial of service.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Divi Dash
CVE-2026-16264

Newsletters < 4.18.1 - Unauthenticated Subscriber Record Overwrite and PII Disclosure via IDOR

The Newsletters WordPress plugin before 4.18.1 does not perform an ownership check on some of its subscriber management actions, and issues a management session to unauthenticated visitors on request, allowing attackers to read any subscriber's personal data and overwrite any subscriber's record including their email address.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Newsletters
CVE-2026-18364

Zportals < 6.4.2 - Subscriber+ Arbitrary Plugin Settings Update

The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on several of its AJAX actions, allowing users with a subscriber-level account to modify the zportals WordPress plugin before 6.4.2's stored integration settings.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Zportals
CVE-2026-18365

Zportals < 6.4.2 - Subscriber+ User Email Disclosure

The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on one of its AJAX actions, allowing users with a subscriber-level account to disclose the display name and email address of every registered user, including administrators.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Zportals
CVE-2026-75799

YAHMAN Add-ons < 0.9.31 - Unauthenticated Arbitrary File Upload via Blog Card Cache

The YAHMAN Add-ons WordPress plugin before 0.9.31 does not validate the type of the remote files it caches in a publicly accessible directory, allowing unauthenticated attackers to write arbitrary PHP files on the server and achieve RCE when the relevant feature is enabled.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Yahman Add-ons