Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16,394

Export CSV
CVE-2026-19858

JetFormBuilder < 3.6.5.2 - Unauthenticated Password Hash and Arbitrary Metadata Disclosure via Dynamic Preset

The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks when resolving request-derived data during page rendering, allowing unauthenticated users to read arbitrary user, post and term properties and metadata, including password hashes, private and draft content, and secrets other JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 store in metadata.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Jetmonsters Wordpress
Products
Jetformbuilder — Dynamic Blocks Form Builder Wordpress
CVE-2026-82846

Masteriyo LMS 1.18.0 - 2.3.3 - Instructor+ Stored XSS via Course Custom Fields

The Masteriyo LMS WordPress plugin before 3.4.0 does not sanitise and escape some course settings before outputting them in a page available to all visitors, allowing users with a course-author role to perform Stored Cross-Site Scripting attacks that run in the session of anyone viewing the course, including a logged-in administrator.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Masteriyo Wordpress
Products
Masteriyo Wordpress
CVE-2026-84745

The Events Calendar &lt; 6.17.3.1 - Contributor+ Non-Public Event, Venue and Organizer Content Disclosure via REST API

The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public REST archives, allowing users with a low-privilege role such as contributor to read the full contents of every unpublished record on the site, including other users'.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Theeventscalendar Wordpress
Products
The Events Calendar Wordpress
CVE-2026-84931

Joli Table Of Contents < 3.0.3 - Author+ Stored XSS via joli-toc Shortcode Theme Attribute

The Joli Table Of Contents WordPress plugin before 3.0.3 does not sanitise or escape a shortcode attribute value before outputting it inside an HTML element's attribute, allowing users with the Author role and above to inject arbitrary HTML attributes and JavaScript that execute in the browser of any user who views the post, including higher-privileged users such as administrators. This crosses a privilege boundary even on multisite, where such users are not permitted to post unfiltered HTML.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpjoli
Products
Wordpress Joli Table Of Contents
CVE-2026-84934

JCH Optimize < 6.0.1 - Subscriber+ Stored XSS via getcacheinfo Task Override

The JCH Optimize WordPress plugin before 6.0.1 does not perform a capability check on one of its authenticated AJAX actions and lets the request choose which internal action runs, allowing any authenticated users such as Subscribers to import arbitrary JCH Optimize WordPress plugin before 6.0.1 settings and store a script that executes in the browser of any visitor or administrator viewing the site.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed
Vendors
Jch Optimize Project Wordpress
Products
Jch Optimize Wordpress
CVE-2026-84901

Eventin < 4.1.22 - Contributor+ Site Homepage Hijack and Event Taxonomy Manipulation via Missing Authorization

The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing users with contributor-level access and above to change the site's front-page setting to an event they do not own and to create, edit and delete global event and speaker taxonomy terms they should not be able to manage.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Eventin Wordpress
Products
Eventin Wordpress
CVE-2026-82304

Music Store – WordPress eCommerce < 1.4.5 - Unauthenticated SQLi via paypal-data Handler

The Music Store WordPress plugin before 1.4.5 does not sanitise and escape user input before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Musicstore Wordpress
Products
Music Store Wordpress
CVE-2026-80439

Redirection for Contact Form 7 2.2.7 - 3.2.10 - Unauthenticated Arbitrary Shortcode Execution via Action Setting Mail-Tags

The Redirection for Contact Form 7 WordPress plugin from 2.2.7 before 3.2.11 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into an action's settings and then processes those settings for shortcodes, allowing unauthenticated users to run any shortcode registered on the site and read its output.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Redirection-for-contact-form7 Wordpress
Products
Redirection For Contact Form 7 Wordpress
CVE-2026-80437

Ninja Forms 3.14.10 - 3.15.1 - Unauthenticated Arbitrary Shortcode Execution via IP and Referer Merge Tags

The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent shortcodes in request-derived values from being executed when it substitutes them into content it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ninjaforms Wordpress
Products
Ninja Forms Wordpress
CVE-2026-18480

SureCart < 4.6.3 - Subscriber+ Administrator Account Takeover

The SureCart WordPress plugin before 4.6.3 does not ensure that the account affected by a customer update is the same account its permission check authorised, allowing users with a subscriber-level account to change another user's email address, including an administrator's, and take over that account via a password reset. It further allows an attacker-controlled customer record to be associated with an arbitrary user, and discloses customer identifiers and email addresses to any authenticated user, which together make the takeover reachable from a subscriber-level account alone.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Surecart Wordpress
Products
Surecart Wordpress
CVE-2026-84898

Eventin < 4.1.21 - Contributor+ LFI via Event Layout Meta

The Eventin WordPress plugin before 4.1.21 does not properly validate a template path value before using it to include a local file, allowing users with contributor-level access and above to include and execute arbitrary local PHP files.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Eventin Wordpress
Products
Eventin Wordpress
CVE-2026-84225

Kirki 6.0.0 - 6.2.5 - Authenticated Collaboration Comment Status Modification via IDOR

The Kirki WordPress plugin before 6.3.0 does not check that a user is allowed to act on a collaboration comment before changing its state, allowing users whom an administrator has granted content-level access to the page builder to modify comments left by other users, including on pages they cannot themselves open.

CVSS 3.1 · 2.2 Low EPSS < 1% KEV · Not listed
Vendors
Kirki Wordpress
Products
Kirki Wordpress
CVE-2026-84221

Kirki 6.0.0 - 6.2.5 - Editor+ SQLi via Content Manager Field ID

The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allowing users with editor-level access and above to append arbitrary SQL and read the contents of the database, including user credentials.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Kirki Wordpress
Products
Kirki Wordpress
CVE-2026-84219

Kirki 6.2.1 - 6.2.5 - Unauthenticated Stored XSS via HTML Entity Decoding

The Kirki WordPress plugin before 6.3.0 does not hold back every spelling of the HTML entities it decodes when rendering, allowing unauthenticated users to store JavaScript in a comment which then runs in the session of anyone viewing a page that displays it, including an administrator, and on every page of the site when its header or footer is built to show comments.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Kirki Wordpress
Products
Kirki Wordpress
CVE-2026-77826

RegistrationMagic 5.0.1.8 - 6.0.9.8 - Unauthenticated Authentication Bypass via Missing Facebook Token Audience Validation

The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of identity, allowing unauthenticated attackers to log in as an existing user whose token they can obtain, or to create and log into a new account even when user registration is disabled.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Registrationmagic Wordpress
Products
Registrationmagic Wordpress
CVE-2026-75793

SureCart < 4.7.0 - Unauthenticated Account Creation with Automatic Login

The SureCart WordPress plugin before 4.7.0 does not consult the site's user registration setting before creating WordPress accounts, allowing unauthenticated users to create an account and receive a logged-in session even when registration is disabled.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Surecart Wordpress
Products
Surecart Wordpress
CVE-2026-85309

WordPress Ultimate Maps by Supsystic plugin <= 1.5.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Supsystic Ultimate Maps by Supsystic allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Ultimate Maps by Supsystic: from n/a through 1.5.3.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Supsystic Wordpress
Products
Ultimate Maps By Supsystic Wordpress
CVE-2026-85305

WordPress SEOPress plugin <= 10.1 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery (SSRF) vulnerability in SEOPress allows Server Side Request Forgery. This issue affects SEOPress: from n/a through 10.1.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Seopress Wordpress
Products
Seopress Wordpress
CVE-2026-84774

WordPress WP Statistics plugin <= 14.16.11 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.11 versions.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Veronalabs Wordpress
Products
Wp Statistics Wordpress