Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2,282

Export CSV
CVE-2026-106466

JWT Auth <= 3.0.2 - Unauthenticated Account Access Persistence via Insufficient Refresh Token Revocation

The JWT Auth WordPress plugin through 3.0.2 does not invalidate previously issued refresh tokens when a user changes or resets their password or removes a connected device, allowing an attacker who obtained a refresh token before such an event to keep issuing valid access tokens and retain authenticated access to the account, up to Administrator.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Jwt Auth
CVE-2026-115252

Confection 0.4.0 - 0.4.7 - Unauthenticated RCE via Write Key Option

The Confection WordPress Cable WordPress plugin from 0.4.0 to 0.4.7 does not perform any capability or nonce checks before saving its settings and writing one of them, unmodified, into a standalone PHP file that it then serves, allowing unauthenticated users to execute arbitrary PHP code on the server.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Confection
CVE-2026-106008

FraudLabs Pro SMS Verification 1.11.2 - 1.12.1 - Unauthenticated SMS Verification Bypass via wc_sms_action_verified

The FraudLabs Pro SMS Verification WordPress plugin from 1.11.2 to 1.12.1 does not perform authorisation or validity checks before marking a WooCommerce order's SMS verification as completed, allowing unauthenticated users to forge the verified state of an order and bypass the plugin's SMS verification control.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Fraudlabs Pro Sms Verification
CVE-2026-121570

WordPress RSVP and Event Management plugin <= 2.7.17 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill RSVP and Event Management rsvp allows Stored XSS.This issue affects RSVP and Event Management: from n/a through 2.7.17.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Wpchill
Products
Rsvp And Event Management Rsvp And Event Management
CVE-2026-120855

WordPress TI WooCommerce Wishlist plugin <= 2.14.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TemplateInvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Stored XSS.This issue affects TI WooCommerce Wishlist: from n/a through 2.14.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Templateinvaders Wordpress-extensions
Products
Ti Woocommerce Wishlist Ti Woocommerce Wishlist
CVE-2026-119524

WordPress WP Customer Area plugin <= 8.4.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aguila Technologies WP Customer Area customer-area allows Stored XSS.This issue affects WP Customer Area: from n/a through 8.4.3.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Aguilatechnologies Wordpress-extensions
Products
Wp Customer Area Wp Customer Area
CVE-2026-120856

WordPress Invoice Gateway for WooCommerce – Invoice Payment Gateway plugin <= 1.1.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rymera Web Co Invoice Gateway for WooCommerce – Invoice Payment Gateway invoice-gateway-for-woocommerce allows Reflected XSS.This issue affects Invoice Gateway for WooCommerce – Invoice Payment Gateway: from n/a through 1.1.6.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Rymera Web Co Wordpress-extensions
Products
Invoice Gateway For Woocommerce – Invoice Payment Gateway Invoice Gateway For Woocommerce – Invoice Payment Gateway
CVE-2026-120854

WordPress iubenda plugin <= 3.13.6 - Denial of Service Attack vulnerability

Allocation of Resources Without Limits or Throttling vulnerability in iubenda iubenda iubenda-cookie-law-solution allows HTTP DoS.This issue affects iubenda: from n/a through 3.13.6.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Iubenda Wordpress-extensions
Products
Iubenda Iubenda
CVE-2026-122673

WordPress ShopEngine plugin <= 4.9.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet ShopEngine shopengine allows Stored XSS.This issue affects ShopEngine: from n/a through 4.9.8.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Wpmet
Products
Shopengine Shopengine
CVE-2026-111833

WordPress weForms plugin <= 1.6.28 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bold Grid weForms weforms allows Path Traversal.This issue affects weForms: from n/a through 1.6.28.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Boldgrid Wordpress-extensions
Products
Weforms Weforms
CVE-2026-112359

WordPress WPMobile.App plugin <= 11.86 - Broken Access Control vulnerability

Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPMobile.App: from n/a through 11.86.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Amauri Wordpress-extensions
Products
Wpmobile.app Wpmobile.app
CVE-2026-115204

AZEXO Store Locator <= 1.4 - Subscriber+ Arbitrary File Write via azt_items_import

The AZEXO Store Locator WordPress plugin through 1.4 does not perform capability or nonce checks on its AJAX actions and does not sanitise a request header used to build a file path, allowing any authenticated user such as a subscriber to write a file with an arbitrary name, location, and content, leading to remote code execution.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Azexo Store Locator
CVE-2026-123482

WordPress JetFormBuilder plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Stored XSS.This issue affects JetFormBuilder: from n/a through 3.6.8.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Crocoblock Wordpress-extensions
Products
Jetformbuilder Jetformbuilder
CVE-2026-118054

LearnPress <= 4.2.2 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'review_title' Parameter

The LearnPress – Course Review plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'review_title (inside `data.args.review_title`)' parameter in all versions up to, and including, 4.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload only executes after an administrator approves the submitted review, though sites with comment_previously_approved auto-approval configured may bypass manual moderation.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Thimpress Wordpress-extensions
Products
Learnpress – Course Review Learnpress
CVE-2026-119510

WordPress MC Woocommerce Wishlist plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saeed MC Woocommerce Wishlist smart-wishlist-for-more-convert allows Stored XSS.This issue affects MC Woocommerce Wishlist: from n/a through 2.0.3.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Saeed Wordpress-extensions
Products
Mc Woocommerce Wishlist Mc Woocommerce Wishlist
CVE-2026-119511

WordPress MC Woocommerce Wishlist plugin <= 2.0.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Saeed MC Woocommerce Wishlist smart-wishlist-for-more-convert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MC Woocommerce Wishlist: from n/a through 2.0.3.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Saeed Wordpress-extensions
Products
Mc Woocommerce Wishlist Mc Woocommerce Wishlist
CVE-2026-119503

WordPress Welcart e-Commerce plugin <= 2.12.6 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Welcart Welcart e-Commerce usc-e-shop allows Code Injection.This issue affects Welcart e-Commerce: from n/a through 2.12.6.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Welcart Wordpress-extensions
Products
Welcart E-commerce Welcart E-commerce
CVE-2026-123484

WordPress JetFormBuilder plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetFormBuilder jetformbuilder allows DOM-Based XSS.This issue affects JetFormBuilder: from n/a through 3.6.8.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Crocoblock Wordpress-extensions
Products
Jetformbuilder Jetformbuilder
CVE-2026-54863

WordPress Review Schema plugin <= 3.1.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mamunur Rashid Review Schema review-schema allows Reflected XSS.This issue affects Review Schema: from n/a through 3.1.4.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Mamunur Rashid Wordpress-extensions
Products
Review Schema Review Schema
CVE-2026-123475

WordPress MapSVG plugin <= 8.16.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MapSVG: from n/a through 8.16.3.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Pt Norther Lights Production Wordpress-extensions
Products
Mapsvg Mapsvg