Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2,282

Export CSV
CVE-2026-123460

WordPress WordPress File Upload plugin <= 5.2.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nickboss WordPress File Upload wp-file-upload allows Stored XSS.This issue affects WordPress File Upload: from n/a through 5.2.2.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Nickboss Wordpress-extensions
Products
Wordpress File Upload Wordpress File Upload
CVE-2026-122661

WordPress Directorist plugin <= 8.10.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Directorist directorist allows Stored XSS.This issue affects Directorist: from n/a through 8.10.7.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Wpwax
Products
Directorist Directorist
CVE-2026-119504

WordPress Frontend Admin by DynamiApps plugin <= 3.30.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DynamiApps Frontend Admin by DynamiApps acf-frontend-form-element allows Stored XSS.This issue affects Frontend Admin by DynamiApps: from n/a through 3.30.1.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Dynamiapps Wordpress-extensions
Products
Frontend Admin By Dynamiapps Frontend Admin By Dynamiapps
CVE-2026-119497

WordPress Directorist plugin <= 8.10.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Directorist directorist allows Stored XSS.This issue affects Directorist: from n/a through 8.10.6.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Wpwax
Products
Directorist Directorist
CVE-2026-119483

WordPress Form Maker by 10Web plugin <= 1.15.50 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Maker by 10Web form-maker allows Stored XSS.This issue affects Form Maker by 10Web: from n/a through 1.15.50.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
10web Wordpress-extensions
Products
Form Maker By 10web Form Maker By 10web
CVE-2026-123483

WordPress JetFormBuilder plugin <= 3.6.8 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through 3.6.8.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Crocoblock Wordpress-extensions
Products
Jetformbuilder Jetformbuilder
CVE-2026-123470

WordPress HivePress plugin <= 1.8.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in HivePress HivePress hivepress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress: from n/a through 1.8.1.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hivepress Wordpress-extensions
Products
Hivepress Hivepress
CVE-2026-97194

Secure Custom Fields < 6.9.8 - Contributor+ Unpublished Post Title and Status Disclosure via Relational Fields

The Secure Custom Fields WordPress plugin before 6.9.8 does not perform a read-permission check when it renders and formats the values of its relational fields, allowing users with post-editing access (Contributor and above) to disclose the titles and non-public statuses of other users' unpublished posts.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Secure Custom Fields
CVE-2026-96963

Pie Register <= 3.8.4.15 - Contributor+ Invitation Code Modification

The Pie Register WordPress plugin through 3.8.4.15 does not perform an authorisation check in one of its AJAX actions, allowing users with a role as low as contributor to modify existing administrator-created invitation-code records.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Pie Register
CVE-2026-122060

WP Recipe Maker < 10.9.2 - Unauthenticated Password-Protected Recipe Disclosure

The WP Recipe Maker WordPress plugin before 10.9.2 does not check whether the post a recipe is embedded in is password protected before returning the recipe through its REST API and structured data output, allowing unauthenticated users to read the full content of recipes in password-protected posts.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Wp Recipe Maker
CVE-2026-97195

Secure Custom Fields < 6.9.8 - Admin+ Stored XSS via HTML Attribute Name Injection into Field Definition

The Secure Custom Fields WordPress plugin before 6.9.8 does not sanitize a persisted field definition before emitting part of it as an HTML attribute name, allowing a user able to configure its fields to store a payload that executes as JavaScript in the browser of any user who views a page rendering the affected field, which on multisite lets a site administrator who lacks the unfiltered_html capability inject script into other users' sessions.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Secure Custom Fields
CVE-2026-97193

Secure Custom Fields < 6.9.8 - Contributor+ Relationship Field Update on Arbitrary Objects via IDOR

The Secure Custom Fields WordPress plugin before 6.9.8 does not verify that a user is allowed to edit the target object before writing to it during bidirectional relationship synchronization, allowing users with contributor-level access and above to add or remove a reference to their own object on arbitrary posts, users, or terms they cannot otherwise edit.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Secure Custom Fields
CVE-2026-97192

Secure Custom Fields < 6.9.8 - Contributor+ Admin-Restricted Custom Field Update via Post Save Path

The Secure Custom Fields WordPress plugin before 6.9.8 does not re-apply its field-group location rules when persisting values submitted through the post editor save path, allowing users with contributor-level access and above to write custom fields the site restricted to administrators onto their own posts.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Secure Custom Fields
CVE-2026-96961

Pie Register <= 3.8.4.15 - Unauthenticated Plugin Settings Reset and Redirect Data Destruction

The Pie Register WordPress plugin through 3.8.4.15 does not perform any capability, nonce or authentication check on one of its request handlers, allowing unauthenticated attackers to reset the Pie Register WordPress plugin through 3.8.4.15's settings to their defaults (disabling registration security controls such as new-user email verification) and to destroy a Pie Register WordPress plugin through 3.8.4.15 data table.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Pie Register
CVE-2026-95870

wpForo Forum <= 3.2.1 - Unauthenticated SQL Injection via 'data' Parameter

The wpForo Forum plugin for WordPress is vulnerable to generic SQL Injection via the 'data' parameter in all versions up to, and including, 3.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires that a searchable topic form field of type checkbox, or a select/autocomplete field with isMultiChoice enabled, is registered in the forum configuration.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Tomdever Wordpress-extensions
Products
Wpforo Forum Wpforo Forum
CVE-2026-93779

Tutor LMS <= 4.1.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via REST API Endpoints

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.2 via the init_routes due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to read paid course lesson and topic content without enrollment, retrieve quiz answer keys including the is_correct field before attempting a quiz, and enumerate the email addresses, usernames, and registration data of other users including instructors and administrators. Exploitation requires that the attacker hold a valid Tutor LMS API key/secret pair, which is issued to subscriber-level users through the plugin's API key management feature.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Themeum Wordpress-extensions
Products
Tutor Lms – Elearning And Online Course Solution Tutor Lms
CVE-2026-123860

WordPress JetFormBuilder plugin <= 3.6.8 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through 3.6.8.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Crocoblock Wordpress-extensions
Products
Jetformbuilder Jetformbuilder
CVE-2026-120538

Easy Digital Downloads <= 3.7.2 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Guest Checkout Email Binding at PayPal Capture

The Easy Digital Downloads plugin for WordPress is vulnerable to authentication bypass leading to administrator account takeover in all versions up to, and including, 3.7.2. During a PayPal guest checkout, the email address entered in the guest-checkout field is trusted as proof of identity: edd_get_purchase_form_user() binds the new guest order to an existing WordPress user purely on an email-address match, rewriting the order's user_id to that user's ID. The PayPal capture sink PurchaseUser::maybe_log_in_after_capture() then looked the user up by the order email (get_user_by( 'email', $order->email )) and, when $order->user_id equalled that user's ID (which the email-binding step guarantees), issued an authenticated session with wp_set_auth_cookie(). An unauthenticated attacker who starts a guest checkout using an administrator's email address (where that administrator has no existing EDD customer record) and completes the PayPal purchase flow therefore receives an authenticated session as that administrator — a full account takeover. The same sink is reachable through the standard PayPal checkout and the REST UnbrandedCard and Fastlane flows.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Smub Wordpress-extensions
Products
Easy Digital Downloads Easy Digital Downloads
CVE-2026-120520

Greenshift <= 13.2.2 - Unauthenticated Sensitive Information Exposure in Nested {{COOKIE:}} Placeholder via {{GET:}} Parameter

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 13.2.2 via the 'img (or any key the publisher references in {{GET:key}})' parameter. This makes it possible for unauthenticated attackers to extract authenticated users' HttpOnly WordPress session cookies, specifically wordpress_logged_in_* tokens, by injecting a nested {{COOKIE:}} placeholder via a GET parameter that causes the victim's browser to transmit the cookie value to an attacker-controlled host as an image src URL. Exploitation requires that a site publisher has configured a public GreenShift Element image block whose src attribute contains a {{GET:}} placeholder, and that a logged-in user can be induced to open the attacker's crafted link — neither condition is part of the plugin's default state.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Wpsoul
Products
Greenshift Greenshift
CVE-2026-119164

wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Privilege Escalation to 'data[secondary_groupids]' CSV Parameter

The wpForo Forum plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.2.2 via the `data[secondary_groupids]` parameter of the `wpforo_action_profile_update` POST handler. This is due to a type-confusion flaw in the secondary_groupids authorization guard within the `Members::update()` function in `classes/Members.php`, where casting a scalar CSV string (e.g. `"0,1"`) with `(array)` before `array_map('intval', …)` and `array_filter()` produces an empty array — causing the guard's outer conditional, and the else-branch that would otherwise strip the field from the update, to be bypassed entirely — while `encode()`/`decode()` downstream correctly explodes the original CSV and persists the attacker-supplied group IDs to `wp_wpforo_profiles.secondary_groupids`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to escalate their forum privileges to wpForo Administrator by injecting the privileged Admin group ID, granting access to the Forum Accesses editor and the ability to rewrite forum-wide capability policies for all members and edit arbitrary content owned by other users. Exploitation requires the attacker to have at least 3 approved wpForo posts to satisfy the plugin's default `min_number_posts_to_edit_account` antispam gate, along with a valid wpforo nonce obtained from their own account profile form.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Tomdever Wordpress-extensions
Products
Wpforo Forum Wpforo Forum