Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16,394

Export CSV
CVE-2026-74927

MultiVendorX 5.0.13 - 5.0.14 - Unauthenticated Vendor PII and Payout Data Disclosure via stores REST Endpoint

The MultiVendorX WordPress plugin before 5.0.15 does not have proper authorisation controls on one of its REST API listing routes, allowing unauthenticated users to retrieve vendor contact and payout details, pending payout amounts, and administrative notes attached to store applications.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Multivendorx Wordpress
Products
Multivendorx Wordpress
CVE-2026-19251

Ultimate Member < 2.13.0 - Unauthenticated Unapproved Comment Disclosure via Profile Activity

The Ultimate Member WordPress plugin before 2.13.0 does not check whether a comment has been approved, or whether the profile it belongs to is private, before returning profile activity to unauthenticated visitors, allowing them to read the content of comments still awaiting moderation.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ultimatemember Wordpress
Products
Ultimate Member Wordpress
CVE-2026-19453

JetBackup 3.1.7.9 - 3.1.23.3 - Subscriber+ Privilege Escalation via Restore Admin User Selection

The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capabilities of the account it preserves across a restore or migration before granting it administrator privileges, allowing a subscriber-level user to gain administrator access after the site owner restores or migrates the site.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Jetbackup Wordpress
Products
Jetbackup Wordpress
CVE-2026-77783

Rank Math SEO < 1.0.277 - Unauthenticated Non-Public Post Schema and Content Disclosure

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the post whose schema it renders on the front end is publicly viewable, allowing unauthenticated visitors to disclose the schema and associated content of draft, pending, private, scheduled and password-protected posts.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Rank Math Seo Wordpress
Products
Rank Math Seo Wordpress
CVE-2026-77784

Rank Math SEO < 1.0.277 - Author+ Robots and Pillar Content Meta Update on Non-Owned Objects via mark_page_as

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that a user is allowed to edit the object being modified before updating its SEO indexing metadata, allowing users with the Author role and above to alter that metadata on content, taxonomy terms and user profiles they do not own, and to remove other users' content from the site's sitemap and search engine index.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Rank Math Seo Wordpress
Products
Rank Math Seo Wordpress
CVE-2026-77788

Rank Math SEO < 1.0.277 - Author+ Arbitrary Post and User Metadata Overwrite via updateSchemas

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the metadata row being updated belongs to the object the user was authorised against, allowing users with the Author role and above to overwrite arbitrary post and user metadata, including that belonging to higher-privileged users.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Rank Math Seo Wordpress
Products
Rank Math Seo Wordpress
CVE-2026-75528

Broken Link Checker <= 2.4.13 - Unauthenticated Stored Cross-Site Scripting via Comment Author URL / Link Log

The Broken Link Checker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author URL / Link Log in all versions up to, and including, 2.4.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to perform the plugin's standard dismiss-and-recheck workflow on a link submitted by the attacker via the WordPress comment author URL field, after which the attacker's HTTP server issues a redirect to a URL containing an HTML/JavaScript payload that is stored verbatim in the link log.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpmudev
Products
Wordpress Broken Link Checker
CVE-2026-16983

Gutentor < 4.0.6 - Subscriber+ Password Protected Post Password Disclosure via REST API

The Gutentor WordPress plugin before 4.0.6 does not apply the correct context restriction to one of its REST endpoints, exposing the plaintext passwords of password-protected posts to any authenticated user with at least the Subscriber role.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gutentor Wordpress
Products
Gutentor Wordpress
CVE-2026-78657

SigmaForms Pro <= 1.4.11 - Unauthenticated Arbitrary File Deletion via Path Traversal in File Upload Field

The SigmaForms Pro – AI Generated Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_submission_files function in all versions up to, and including, 1.4.11. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The malicious path traversal URL is submitted via form upload field and stored in the database, with deletion triggered when an administrator deletes the submission record from the admin panel.

CVSS 3.1 · 9.8 Critical EPSS 1.0% KEV · Not listed
Vendors
Bdthemes Wordpress
Products
Sigmaforms Pro – Ai Generated Forms Wordpress
CVE-2026-77792

RegistrationMagic < 6.0.9.9 - Unauthenticated Stored XSS via Rating Field

The RegistrationMagic WordPress plugin before 6.0.9.9 does not escape a registration form field value before outputting it in an HTML attribute on an administrative page, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against high privilege users such as admin.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Registrationmagic Wordpress
Products
Registrationmagic Wordpress
CVE-2026-77787

Rank Math SEO < 1.0.277 - Author+ Term Metadata Update and Cross-Object Post Title Overwrite via updateMetaBulk

The Rank Math SEO WordPress plugin before 1.0.277 does not perform a capability check when bulk metadata updates target taxonomy terms, and reuses the supplied object identifier across object types, allowing users with the Author role and above to modify the SEO metadata of terms they cannot edit and to overwrite the titles of posts belonging to other users.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Rank Math Seo Wordpress
Products
Rank Math Seo Wordpress
CVE-2026-77785

Rank Math SEO < 1.0.277 - Author+ Non-Public Post Content Disclosure via Abilities API

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the requesting user is permitted to read the specific post referenced in a request before returning its content and SEO metadata, allowing users with the Author role and above to read the title, body and metadata of other users' non-public posts.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Rank Math Seo Wordpress
Products
Rank Math Seo Wordpress
CVE-2026-77782

Rank Math SEO < 1.0.277.1 - Unauthenticated Password-Protected Post Content Disclosure via Post Metadata and llms.txt

The Rank Math SEO WordPress plugin before 1.0.277.1 does not check whether a post is password protected before using its content to build publicly generated SEO metadata, allowing unauthenticated users to read the content of password-protected posts.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Rank Math Seo Wordpress
Products
Rank Math Seo Wordpress
CVE-2026-77764

GamiPress < 7.9.9.6 - Subscriber+ Arbitrary User Points and Achievement Award via Watch-Video Listeners

The GamiPress WordPress plugin before 7.9.9.6 does not properly restrict its video watch-tracking functionality, allowing users with a role as low as Subscriber to award the configured gamification points, achievements and ranks to arbitrary users including administrators, and to accrue them without limit.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gamipress Wordpress
Products
Gamipress Wordpress
CVE-2026-24370

WordPress The Grid plugin <= 2.8.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeOne The Grid allows Stored XSS. This issue affects The Grid: from n/a through 2.8.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Theme-one Wordpress
Products
The Grid Wordpress
CVE-2026-78363

MW WP Form < 5.1.5 - Unauthenticated Arbitrary Shortcode Execution via Completion Message Merge Tags

The MW WP Form WordPress plugin before 5.1.5 does not prevent shortcodes in user-submitted values from being executed when it merges those values into a message that it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site. Exploitation requires the site to have been configured to echo a submitted value back to the visitor after submission.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Mw Wp Form Project Wordpress
Products
Mw Wp Form Wordpress