Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2,282

Export CSV
CVE-2026-109197

WP Directory Kit <= 1.6.0 - Unauthenticated SQL Injection via 'idfield' Parameter

The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'idfield' parameter in all versions up to, and including, 1.6.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Wpdirectorykit
Products
Wp Directory Kit Wp Directory Kit
CVE-2026-119699

WPGraphQL Smart Cache before 2.3.3 Unbounded Persisted Query Storage DoS

WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to persist unlimited query documents via the Automatic Persisted Query handler. Attackers can send distinct queries with matching SHA-256 queryId values, including batched operations, to grow the wp_posts table without bound and degrade database performance.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Wpgraphql
Products
Wpgraphql Smart Cache Wpgraphql Smart Cache
CVE-2026-112348

Kirki WordPress Plugin < 6.2.5 reCAPTCHA Bypass via Missing Token

Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vulnerability that allows unauthenticated attackers to submit frontend forms without valid verification by omitting the g-recaptcha-token field from POST requests to the form submission endpoint. Attackers can exploit the verify() method's early return on empty token values to submit unlimited forms, triggering notification emails, webhooks, and unbounded writes to the submissions table without completing reCAPTCHA validation.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Themeum Wordpress-extensions
Products
Kirki Kirki
CVE-2026-120554

Import and export users and customers <= 2.5.11 - Authenticated (Custom+) Privilege Escalation via Non-Atomic Cron Settings Save

The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.5.11 This is due to a non-atomic multi-option write sequence in the `ACUI_Cron::save_settings()` function, which persists `acui_cron_activated`, `acui_cron_configured_by`, `acui_cron_user_id`, and `acui_cron_path_to_file` before reaching the authorization gate that calls `wp_die()` when a non-promoter submits a role. This makes it possible for authenticated attackers holding a custom delegated role with `create_users` but without `promote_users` or `edit_users` to escalate their privileges to Administrator, provided a prior administrator cron-tab save exists and no successful save intervenes before the next unattended cron tick processes the attacker's repointed CSV file.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Carazo Wordpress-extensions
Products
Import And Export Users And Customers Import And Export Users And Customers
CVE-2026-105993

DT Directory Lite Addon <= 1.1 - Unauthenticated Plugin Settings Update

The DT Directory Lite Addon WordPress plugin through 1.1 does not perform nonce or capability checks on its settings handlers, allowing unauthenticated attackers to modify the DT Directory Lite Addon WordPress plugin through 1.1's configuration and skin options.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Dt Directory Lite Addon
CVE-2026-115205

AZEXO Store Locator <= 1.4 - Subscriber+ Arbitrary Post Deletion via azt_delete_item

The AZEXO Store Locator WordPress plugin through 1.4 does not have a capability check or any authorization control when deleting a post, allowing any authenticated user, such as a subscriber, to delete arbitrary posts and pages.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Azexo Store Locator
CVE-2026-106004

DT LMS <= 1.2 - Unauthenticated Arbitrary Course Completion Revocation

The DT LMS WordPress plugin through 1.2 does not perform capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to revoke any learner's course and class completion status.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Dt Lms
CVE-2026-118403

Premium Packages < 7.3.1 - Unauthenticated Guest Order Status Disclosure

The Premium Packages WordPress plugin before 7.3.1 does not verify that the requester owns a guest order before returning its details, allowing unauthenticated visitors who know a guest order's identifier to view its order status, payment status and total.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Premium Packages
CVE-2026-118404

Premium Packages < 7.3.1 - Unauthenticated Cross-User Saved Cart Disclosure via IDOR

The Premium Packages WordPress plugin before 7.3.1 does not verify ownership or session binding when loading a previously saved shopping cart, allowing any unauthenticated user who obtains another shopper's saved-cart identifier to load that shopper's cart contents, including selected products, quantities and buyer-entered custom field data, into their own session.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Premium Packages
CVE-2026-118407

Premium Packages < 7.3.1 - Subscriber+ Guest Order Takeover

The Premium Packages WordPress plugin before 7.3.1 does not verify that a user claiming a guest order is the original buyer, allowing any authenticated user to take ownership of any unclaimed guest order, and thereby read the buyer's billing details and download their purchased files, by supplying only the order identifier.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Premium Packages
CVE-2026-104648

weMail <= 2.1.6 - Editor+ API Key Disclosure

The weMail WordPress plugin through 2.1.6 does not restrict a site-wide third-party email-service API key to administrators, exposing it in an admin screen that users with the Editor role can reach by default, which allows them to obtain a reusable credential usable without a WordPress session to impersonate other users and sever the site's email-service connection.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Wemail
CVE-2026-57639

WordPress WP Booking System plugin <= 2.1.0.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Roland Murg WP Booking System wp-booking-system allows Reflected XSS.This issue affects WP Booking System: from n/a through 2.1.0.6.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Roland Murg Wordpress-extensions
Products
Wp Booking System Wp Booking System
CVE-2026-119477

WordPress WP Photo Album Plus plugin <= 9.3.05.003 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jacob N. Breetvelt WP Photo Album Plus wp-photo-album-plus allows Stored XSS.This issue affects WP Photo Album Plus: from n/a through 9.3.05.003.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Jacob N. Breetvelt Wordpress-extensions
Products
Wp Photo Album Plus Wp Photo Album Plus
CVE-2026-103327

CryptoCloud - Crypto Payment Gateway 3.0.0 - 3.0.1 - Unauthenticated Arbitrary Order Payment Forgery via Empty-Default Webhook Secret

The CryptoCloud WordPress plugin from 3.0.0 through 3.0.1 does not verify the authenticity of the payment notifications received by its gateway callback, as the integrity check is skipped while the webhook secret is left at its empty default, allowing unauthenticated attackers to mark arbitrary orders as paid or failed without any payment being made.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Cryptocloud
CVE-2026-119481

WordPress JetFormBuilder plugin <= 3.6.7.1 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Privilege Escalation.This issue affects JetFormBuilder: from n/a through 3.6.7.1.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Crocoblock Wordpress-extensions
Products
Jetformbuilder Jetformbuilder
CVE-2026-114431

Enable Media Replace < 4.2.3 - Author+ Stored XSS via SVG Upload

The Enable Media Replace WordPress plugin before 4.2.3 does not pass a replaced media file through the WordPress upload pipeline, so the upload prefilter that SVG-sanitizer Enable Media Replace WordPress plugin before 4.2.3 rely on never runs, allowing an authenticated user with upload access to store an SVG file containing script that executes when the file is opened directly. It requires an SVG-enabling Enable Media Replace WordPress plugin before 4.2.3 to be active, as the replace path otherwise rejects SVG uploads.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Enable Media Replace
CVE-2026-108041

SEOPress < 10.4 - Authenticated Stored XSS via Analytics Tracking Settings

The SEOPress WordPress plugin before 10.4 does not sanitise and escape some of its analytics tracking settings before outputting them in an inline script printed on every front-end page, allowing users granted a SEOPress WordPress plugin before 10.4 capability that an administrator can delegate to lower-privileged roles to perform Stored Cross-Site Scripting attacks that execute in the browser of any site visitor, including a logged-in administrator viewing the front end.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Seopress
CVE-2026-105967

Gallery for Social Photo <= 1.0.0.41 - Unauthenticated SSRF via next_url Parameter

The Gallery for Social Photo WordPress plugin through 1.0.0.41 does not validate a user-supplied URL before using it to perform a server-side request, allowing unauthenticated attackers to make the server issue requests to arbitrary internal hosts and read the responses.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ghozylab Wordpress-extensions
Products
Gallery For Social Photo Gallery For Social Photo
CVE-2026-104647

weMail <= 2.1.6 - Editor+ Incorrect Authorization via User::can()

The weMail WordPress plugin through 2.1.6 does not correctly verify user capabilities in its REST API permission checks, treating any user whose role is in the weMail WordPress plugin through 2.1.6's allowed-roles list (Editor and above by default) as authorised for every action, which allows such users to perform administrator-level actions including enumerating all registered users with their email addresses and modifying the weMail WordPress plugin through 2.1.6's own access-control configuration.

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Wemail
CVE-2026-103379

WATI Chat and Notification <= 1.1.8 - Unauthenticated Customer Order PII Disclosure via Leaked API Token

The WATI Chat and Notification WordPress plugin through 1.1.8 does not require a valid, non-empty secret on a public endpoint that returns its stored API token, which an unauthenticated attacker can then present to a second public endpoint to obtain the order-received URL of any WooCommerce order and read the customer's name, address, phone number and email address. The endpoints are reachable in the WATI Chat and Notification WordPress plugin through 1.1.8's default state and are closed only once a WATI account is connected.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Wati Chat And Notification