Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2,275

Export CSV
CVE-2026-119616

Noptin <= 4.4.3 - Unauthenticated Local File Inclusion via 'the_template_path' Merge-Tag Attribute via Stored Subscriber first_name

The Noptin – Newsletter, New Post Notifications & Email Automation plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.4.3 via the 'noptin_fields[first_name]' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. The public Manage Preferences page issues a nonce to unauthenticated visitors, meaning there is no effective authorization barrier — an unauthenticated attacker can store the malicious payload as their first_name and have it executed the next time any newsletter is sent by the site operator. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Picocodes Wordpress-extensions
Products
Noptin – Newsletter, New Post Notifications & Email Automation Noptin
CVE-2026-120555

Jupiter X Core <= 4.62.0 - Missing Authorization to Unauthenticated Limited File Download via 'file' Parameter

The Jupiter X Core plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.62.0 via the 'file' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The path confinement check introduced in the CVE-2023-3813 fix (strpos + realpath) is present and working, so reads are confined to wp-content/uploads/ and cannot reach wp-config.php or other files outside that directory.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Artbees Wordpress-extensions
Products
Jupiter X Core Jupiter X Core
CVE-2026-119098

LifterLMS <= 10.3.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Content Question Answer

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'answer[]' parameter in all versions up to, and including, 10.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the attacker to be enrolled as a student in a course containing a Content-type quiz question; the injected payload executes in the administrator's browser session during the normal grading workflow when 'Start a Review' is clicked on the affected attempt.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Lifterlms Wordpress-extensions
Products
Lifterlms Lifterlms
CVE-2026-119213

Fluent Support <= 2.4.7 — Unauthenticated Limited Modification of Linked Customer Profile Fields via Fluent Forms Feed

The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to unauthenticated modification of a linked customer's stored profile fields in versions up to, and including, 2.4.7 Its first-party Fluent Forms integration (FeedIntegration::notify()) opens a ticket from each public form submission and, for a logged-out submitter, resolves the submitted email to an existing WordPress account via get_user_by('email', ...) without verifying the submitter controls that address, then passes the attacker-supplied data to Customer::maybeCreateCustomer(). This makes it possible for unauthenticated attackers to overwrite a limited set of a registered customer's stored profile fields where an administrator has enabled a FluentSupport feed on a public form. The email address, role and status are never changed; first and last name are overwritten only when the target user has no name set in user meta; and other fields (title, address, city, state, zip, country) are writable only where an administrator has mapped them in the feed.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Wpmanageninja
Products
Fluent Support Fluent Support
CVE-2026-119165

WPBakery Page Builder <= 9.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Post Author Display Name

The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name / nickname' parameter in all versions up to, and including, 9.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful execution requires that at least one public post attributed to the attacker's account be rendered through a Basic Grid using a Grid Builder template with the Post Author element configured to link to the post author; Author-level users can satisfy this precondition unassisted, while Subscribers depend on an administrator having assigned or published a post under their account.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Wpbakery
Products
Wpbakery Page Builder Wpbakery Page Builder
CVE-2026-104913

Interactive Real Estate <= 2.6.0- Authenticated (Subscriber+) Arbitrary File Upload via Project Import ZIP with Crafted image_map.json

The Interactive Real Estate – Floor Plan & Building Visualizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.6.0 via the extract_zip_data function. This is due to missing capability check, nonce verification, and file extension or MIME type validation before copying attacker-supplied ZIP members to the uploads directory. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. This vulnerability is only exploitable on sites where the plugin's Freemius Premium license or trial is active, as the sole gate in the handler is a site-level license check rather than a per-user capability check.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Esaia Wordpress-extensions
Products
Interactive Real Estate – Floor Plan & Building Visualizer Interactive Real Estate
CVE-2026-121515

FV Flowplayer Video Player <= 7.5.56.7212 - Unauthenticated Stored Cross-Site Scripting via Comment Content

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 7.5.56.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the 'Parse Vimeo and YouTube links' option to be enabled, and the injected comment must be approved before the script executes for site visitors.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Foliovision Wordpress-extensions
Products
Fv Flowplayer Video Player Fv Flowplayer Video Player
CVE-2026-119175

Flying Images: Optimize and Lazy Load Images for Faster Page Speed <= 2.4.15 - Unauthenticated Stored Cross-Site Scripting via Comment Content

The Flying Images: Optimize and Lazy Load Images for Faster Page Speed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.4.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A first-time commenter's submission requires a single administrator approval under the default comment_previously_approved setting; however, once approved, all subsequent comments from the same name and email pair bypass moderation, and the injected script executes for every visitor — including administrators viewing the post from the front end.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Gijo Wordpress-extensions
Products
Flying Images: Optimize And Lazy Load Images For Faster Page Speed Flying Images
CVE-2026-121516

QODE Wishlist for WooCommerce <= 1.2.9 - Unauthenticated Stored Cross-Site Scripting via 'table_title' Shared Wishlist Field via Guest Cookie

The QODE Wishlist for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qode_wishlist_for_woocommerce_guests_items' parameter in all versions up to, and including, 1.2.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by guests because the required wp_rest nonce is publicly emitted to unauthenticated visitors on the /wishlist/ page, and the attacker controls the transient key, meaning the payload is stored site-wide and only requires a victim to open a crafted share URL and click the injected title link. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Qodeinteractive Wordpress-extensions
Products
Qode Wishlist For Woocommerce Qode Wishlist For Woocommerce
CVE-2026-124815

Clockinator Lite < 1.1.0 - Unauthenticated SQLi via Record Deletion Actions

The Clockinator Lite WordPress plugin before 1.1.0 does not restrict access to several of its record deletion actions, and uses a user-supplied table name in a SQL query without validating or escaping it, allowing unauthenticated users to perform SQL injection attacks, deleting data from any database table and extracting sensitive information such as password hashes.

CVSS 3.1 · 10.0 Critical EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Clockinator Lite
CVE-2026-93902

Soledad <= 8.7.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Social Profile Fields

The Soledad theme for WordPress is vulnerable to Stored Cross-Site Scripting via Social Profile Fields in all versions up to, and including, 8.7.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is scoped to the attacker's own user meta but is exposed publicly on their author archive page at /author/<slug>/, which is accessible to unauthenticated visitors regardless of whether the attacker has published any posts.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Pencidesign Wordpress-extensions
Products
Soledad Soledad
CVE-2026-120477

Stop Spammers Classic <= 2026.6 - Unauthenticated Stored Cross-Site Scripting via 'author' Parameter

The Stop Spammers Classic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' POST parameter in versions up to, and including, 2026.6. An unauthenticated POST handled on init stores the attacker-supplied author field (after sanitize_text_field, which does not escape single quotes) into the ss_stop_sp_reg_stats option history. The Log Report admin page then renders that stored value inside a single-quoted JavaScript string within a double-quoted onclick attribute using esc_js(); because esc_js() uses _wp_specialchars with ENT_COMPAT it does not escape single quotes, allowing the stored value to break out of the JS string literal and inject arbitrary JavaScript. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute whenever an administrator with manage_options access clicks the 'Report to SFS' link on an attacker-poisoned log row (the StopForumSpam API key must be configured for that link to be rendered — the field is empty by default). Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Webguyio Wordpress-extensions
Products
Stop Spammers Classic Stop Spammers Classic
CVE-2026-97190

Advanced Custom Fields 6.2.0 - 6.8.10 - Contributor+ Relationship Field Update on Arbitrary Objects via IDOR

The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not verify that a user is allowed to edit the target object before writing to it during bidirectional relationship synchronization, allowing users with contributor-level access and above to add or remove a reference to their own object on arbitrary posts, users, or terms they cannot otherwise edit.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Advanced Custom Fields
CVE-2026-97191

Advanced Custom Fields < 6.8.11 - Contributor+ Admin-Restricted Custom Field Update via Post Save Path

The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not re-apply its field-group location rules when persisting values submitted through the post editor save path, allowing users with contributor-level access and above to write custom fields the site restricted to administrators onto their own posts.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Advanced Custom Fields
CVE-2025-15708

Live Composer < 2.1.23 - Admin+ Stored XSS via Partner Slug

The Live Composer WordPress plugin before 2.1.23 does not sanitise and escape some of its custom post type slug settings before using them in front-end links, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in a multisite setup).

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Live Composer
CVE-2026-117588

WP Google Review Slider < 18.11 - Google API Settings Update via CSRF

The WP Google Review Slider WordPress plugin before 18.11 does not perform nonce validation when updating its active Google Places configuration, allowing attackers to alter or destroy that configuration via a forged request, provided they can trick a site administrator into following a crafted link.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Wp Google Review Slider
CVE-2026-119073

Live Composer < 2.1.23 - Contributor+ Stored XSS via Post Module Pagination

The Live Composer WordPress plugin before 2.1.23 does not escape a pagination setting supplied through its post-listing module shortcodes before outputting it in an HTML attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Live Composer
CVE-2026-121379

Tournamatch < 4.7.1 - Subscriber+ Arbitrary File Deletion

The Tournamatch WordPress plugin before 4.7.1 does not validate or restrict the path of a previously stored profile or team image before deleting it when a new image is uploaded, allowing users with a role as low as Subscriber to delete arbitrary files on the server, such as wp-config.php, which can lead to a full site takeover.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Tournamatch
CVE-2026-121380

Tournamatch < 4.7.1 - Unauthenticated Team Invitation Email Disclosure via REST API

The Tournamatch WordPress plugin before 4.7.1 does not restrict access to its team invitation listing, allowing unauthenticated users to retrieve the email addresses of people invited to join teams.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Tournamatch
CVE-2026-121491

Fiber Admin 3.1.0 - 4.0.0 - Unauthenticated RCE via Host Header

The Fiber Admin WordPress plugin before 4.0.1 does not validate or escape a request header before writing it into a PHP file it regenerates on an unprotected admin hook, allowing unauthenticated attackers to execute arbitrary code when its custom database error page is enabled and they win a race against an administrator saving its settings.

CVSS 3.1 · 9.0 Critical EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Fiber Admin