Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16,307

Export CSV
CVE-2026-2631

Datalogics Ecommerce Delivery < 2.6.60 - Unauthenticated Privilege Escalation

The Datalogics Ecommerce Delivery WordPress plugin before 2.6.60 exposes an unauthenticated REST endpoint that allows any remote user to modify the option `datalogics_token` without verification. This token is subsequently used for authentication in a protected endpoint that allows users to perform arbitrary WordPress `update_option()` operations. Attackers can use this to enable registartion and to set the default role as Administrator.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Datalogics Ecommerce Delivery Wordpress
Products
Datalogics Ecommerce Delivery Wordpress
CVE-2026-1753

Gutena Forms < 1.6.1 - Contributor+ Arbitrary Limited Options Update

The Gutena Forms WordPress plugin before 1.6.1 does not validate option to be updated, which could allow contributors and above role to update arbitrary boolean and array options (such as users_can_register).

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Gutena Forms Wordpress
Products
Gutena Forms Wordpress
CVE-2026-2343

PeproDev Ultimate Invoice <= 2.2.5 - Unauthenticated Invoice Archive Download

The PeproDev Ultimate Invoice WordPress plugin through 2.2.5 has a bulk download invoices action that generates ZIP archives containing exported invoice PDFs. The ZIP files are named predictably making it possible to brute force and retreive PII.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Peprodev Ultimate Invoice Wordpress
Products
Peprodev Ultimate Invoice Wordpress
CVE-2026-3881

Performance Monitor <= 1.0.6 - Unauthenticated Blind SSRF

The Performance Monitor WordPress plugin through 1.0.6 does not validate a parameter before making a request to it, which could allow unauthenticated users to perform SSRF attacks

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Performance Monitor Wordpress
Products
Performance Monitor Wordpress
CVE-2026-3830

Product Filter for WooCommerce by WBW < 3.1.3 - Unauthenticated SQLi

The Product Filter for WooCommerce by WBW WordPress plugin before 3.1.3 does not sanitize and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Wbw Wordpress
Products
Product Filter For Woocommerce Wordpress
CVE-2026-4432

YITH WooCommerce Wishlist < 4.13.0 - Unauthenticated Arbitrary Wishlist Renaming via IDOR

The YITH WooCommerce Wishlist WordPress plugin before 4.13.0 does not properly validate wishlist ownership in the save_title() AJAX handler before allowing wishlist renaming operations. The function only checks for a valid nonce, which is publicly exposed in the page source of the /wishlist/ page, making it possible for unauthenticated attackers to rename any wishlist belonging to any user on the site.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress Yithemes
Products
Wordpress Yith Woocommerce Wishlist
CVE-2025-14545

YML for Yandex Market < 5.0.26 - Shop Manager+ RCE via Feed Generation

The YML for Yandex Market WordPress plugin before 5.0.26 is vulnerable to Remote Code Execution via the feed generation process.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Icopydoc Wordpress
Products
Yml For Yandex Market Wordpress
CVE-2025-15363

Get Use APIs < 2.0.10 - Contributor+ Stored XSS

The Get Use APIs WordPress plugin before 2.0.10 executes imported JSON, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks under certain server configurations.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Berkux Wordpress
Products
Get Use Apis Wordpress
CVE-2025-15445

Restaurant Cafeteria <= 0.4.6 - Subscriber+ Arbitrary Plugin Installation/Activation

The Restaurant Cafeteria WordPress theme through 0.4.6 exposes insecure admin-ajax actions without nonce or capability checks, allowing any logged-in user, like subscriber, to perform privileged operations. An attacker can install and activate a from a user-supplied URL, leading to arbitrary PHP code execution, and also import demo content that rewrites site configuration, including Restaurant Cafeteria WordPress theme through 0.4.6_mods, pages, menus, and front page settings.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Restaurant Cafeteria Wordpress
Products
Restaurant Cafeteria Wordpress
CVE-2025-15488

Responsive Plus < 3.4.3 - Unauthenticated Arbitrary Shortcode Execution

The Responsive Plus WordPress plugin before 3.4.3 is vulnerable to arbitrary shortcode execution due to the software allowing unauthenticated users to execute the update_responsive_woo_free_shipping_left_shortcode AJAX action that does not properly validate the content_rech_data parameter before processing it as a shortcode.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Responsive Wordpress
Products
Responsive Menu Wordpress
CVE-2025-15473

Timetics < 1.0.52 - Unauthenticated Payment/Booking Status Update

The Timetics WordPress plugin before 1.0.52 does not have authorization in a REST endpoint, allowing unauthenticated users to arbitrarily change a booking's payment status and post status for the "timetics-booking" custom post type.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Timetics Wordpress
Products
Timetics Wordpress
CVE-2025-15484

Order Notification for WooCommerce < 3.6.3 - Unauthenticated WooCommerce REST Permission Bypass

The Order Notification for WooCommerce WordPress plugin before 3.6.3 overrides WooCommerce's permission checks to grant full access to all unauthenticated requests, enabling complete read/write access to store resources like products, coupons, and customers.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Order Notification For Woocommerce Wordpress
Products
Order Notification For Woocommerce Wordpress
CVE-2025-15441

Form Maker < 1.15.38 - SQL Injection

The Form Maker by 10Web WordPress plugin before 1.15.38 does not properly prepare SQL queries when the "MySQL Mapping" feature is in use, which could make SQL Injection attacks possible in certain contexts.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
10web Wordpress
Products
Form Maker Wordpress
CVE-2025-15433

Shared Files < 1.7.58 - Contributor+ Arbitrary File Download

The Shared Files WordPress plugin before 1.7.58 allows users with a role as low as Contributor to download any file on the web server (such as wp-config.php) via a path traversal vector

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Sharedfilespro Wordpress
Products
Shared Files Wordpress
CVE-2026-34424

Smart Slider 3 Pro 3.5.1.35 Supply Chain Attack Remote Access Toolkit

Smart Slider 3 Pro version 3.5.1.35 for WordPress and Joomla contains a multi-stage remote access toolkit injected through a compromised update system that allows unauthenticated attackers to execute arbitrary code and commands. Attackers can trigger pre-authentication remote shell execution via HTTP headers, establish authenticated backdoors accepting arbitrary PHP code or OS commands, create hidden administrator accounts, exfiltrate credentials and access keys, and maintain persistence through multiple injection points including must-use plugins and core file modifications.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Nextendweb Wordpress
Products
Smart Slider 3 Wordpress
CVE-2023-54358

WordPress adivaha Travel Plugin 2.3 Reflected XSS via isMobile

WordPress adivaha Travel Plugin 2.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating the isMobile parameter. Attackers can craft malicious URLs containing JavaScript payloads in the isMobile GET parameter at the /mobile-app/v3/ endpoint to execute arbitrary code in victims' browsers and steal session tokens or credentials.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Adivaha Wordpress
Products
Wordpress Adivaha Travel Plugin Wordpress
CVE-2023-54359

WordPress adivaha Travel Plugin 2.3 SQL Injection via pid

WordPress adivaha Travel Plugin 2.3 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'pid' GET parameter. Attackers can send requests to the /mobile-app/v3/ endpoint with crafted 'pid' values using XOR-based payloads to extract sensitive database information or cause denial of service.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Adivaha Wordpress
Products
Wordpress Adivaha Travel Plugin Wordpress
CVE-2024-2109

Booster Extension <= 1.2.0 - Basic Information Exposure via booster_extension_authorbox_shortcode_display

The Booster Extension plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.0 via the 'booster_extension_authorbox_shortcode_display' function. This makes it possible for unauthenticated attackers to extract sensitive data including user emails

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Themeinwp Wordpress
Products
Booster Extension Wordpress
CVE-2011-10033

WordPress Plugin is-human <= v1.4.2 Eval Injection RCE

The WordPress plugin is-human <= v1.4.2 contains an eval injection vulnerability in /is-human/engine.php that can be triggered via the 'type' parameter when the 'action' parameter is set to 'log-reset'. The root cause is unsafe use of eval() on user-controlled input, which can lead to execution of attacker-supplied PHP and OS commands. This may result in arbitrary code execution as the webserver user, site compromise, or data exfiltration. The is-human plugin was made defunct in June 2008 and is no longer available for download. This vulnerability was exploited in the wild in March 2012.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Disable Wordpress Update Notifications And Auto-update Email Notifications Project Is-human Wordpress
Products
Is-human Plugin Is-human Wordpress Plugin Wordpress
CVE-2011-10041

Uploadify <= 1.0 Unauthenticated Arbitrary File Upload

Uploadify WordPress plugin versions up to and including 1.0 contain an arbitrary file upload vulnerability in process_upload.php due to missing file type validation. An unauthenticated remote attacker can upload arbitrary files to the affected WordPress site, which may allow remote code execution by uploading executable content to a web-accessible location.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress