Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2,272

Export CSV
CVE-2026-87959

WPBot 8.7.2 - 8.7.5 - Subscriber+ Claude AI Settings Update

The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI provider settings, allowing users with subscriber-level access to overwrite those settings, including the API key used for the WPBot WordPress plugin before 8.7.6's outgoing AI requests.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Wpbot
CVE-2026-88910

KBoard < 6.7 - Unauthenticated Board Media Deletion via IDOR

The kboard WordPress plugin before 6.7 does not verify ownership or context before deleting board media, allowing unauthenticated attackers to permanently delete its uploaded media files and their database records by iterating identifiers.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Kboard
CVE-2026-125455

WordPress Bold Page Builder plugin <= 5.9.11 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Themes Bold Page Builder bold-page-builder allows Stored XSS.This issue affects Bold Page Builder: from n/a through 5.9.11.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Bold-themes Wordpress-extensions
Products
Bold Page Builder Bold Page Builder
CVE-2026-124269

WordPress Happy Addons for Elementor plugin <= 3.51.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Happy Addons for Elementor: from n/a through 3.51.0.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wedevs Wordpress-extensions
Products
Happy Addons For Elementor Happy Addons For Elementor
CVE-2026-125777

WordPress Profile Builder plugin <= 4.0.6 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Cozmoslabs Profile Builder profile-builder allows Retrieve Embedded Sensitive Data.This issue affects Profile Builder: from n/a through 4.0.6.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Cozmoslabs Wordpress-extensions
Products
Profile Builder Profile Builder
CVE-2026-88813

YITH WooCommerce Gift Cards <= 4.39.0 - Unauthenticated Gift Card Balance Inflation via Discounted Purchase

The YITH WooCommerce Gift Cards WordPress plugin through 4.39.0 does not reconcile the value of a gift card it issues against the amount actually paid for it, instead crediting the new card with the item's pre-discount price, which allows customers to apply an ordinary store coupon at checkout and receive a gift card worth more than they paid.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Yith Woocommerce Gift Cards
CVE-2026-92408

WPS Bookings for WooCommerce < 3.13.1 - Unauthenticated Price Manipulation via booking_price

The WPS Bookings for WooCommerce WordPress plugin before 3.13.1 does not validate a price value taken from user input before using it to set the product price, allowing unauthenticated users to purchase bookable services at a price of their choosing, including zero.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Wps Bookings For Woocommerce
CVE-2026-124408

WordPress WPCafe plugin <= 3.0.22 - Broken Access Control vulnerability

Missing Authorization vulnerability in Arraytics WPCafe wp-cafe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCafe: from n/a through 3.0.22.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Arraytics Wordpress-extensions
Products
Wpcafe Wpcafe
CVE-2026-125784

WordPress RestroPress plugin <= 3.4.11 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Magnigenie RestroPress restropress allows Cross Site Request Forgery.This issue affects RestroPress: from n/a through 3.4.11.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Magnigenie Wordpress-extensions
Products
Restropress Restropress
CVE-2026-125763

WordPress SureForms plugin <= 2.13.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureForms: from n/a through 2.13.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Brainstormforce Wordpress-extensions
Products
Sureforms Sureforms
CVE-2026-125708

WordPress Element Pack Elementor Addons plugin <= 10.0.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 10.0.4.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Bdthemes Wordpress-extensions
Products
Element Pack Elementor Addons Element Pack Elementor Addons
CVE-2026-127050

Backup Migration before 2.1.8 Path Traversal via PclZip Restore Fallback

Backup Migration before 2.1.8 for WordPress contains a path traversal vulnerability in its PclZip restore fallback that allows an attacker to achieve arbitrary file write when an administrator restores a malicious backup archive on a server lacking the PHP zip extension. Attackers can craft a zip archive with entry names containing ".." sequences, which PclZip's extract() processes without the PCLZIP_OPT_EXTRACT_DIR_RESTRICTION option, writing a PHP file outside the intended extraction directory into the web-servable tree to achieve remote code execution.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Inisev Wordpress-extensions
Products
Backup Migration Backup Migration
CVE-2026-125787

WordPress Quiz And Survey Master plugin <= 11.3.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through 11.3.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Expresstech Wordpress-extensions
Products
Quiz And Survey Master Quiz And Survey Master
CVE-2026-125785

WordPress JetEngine plugin <= 3.9.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Stored XSS.This issue affects JetEngine: from n/a through 3.9.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Crocoblock Wordpress-extensions
Products
Jetengine Jetengine
CVE-2026-125836

WordPress Simple JWT Login plugin <= 3.6.8 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Nicu Micle Simple JWT Login simple-jwt-login allows Cross Site Request Forgery.This issue affects Simple JWT Login: from n/a through 3.6.8.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Nicu Micle Wordpress-extensions
Products
Simple Jwt Login Simple Jwt Login
CVE-2026-125444

WordPress King Addons for Elementor plugin <= 51.1.87 - Broken Access Control vulnerability

Missing Authorization vulnerability in King Addons King Addons for Elementor king-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects King Addons for Elementor: from n/a through 51.1.87.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Kingaddons Wordpress-extensions
Products
King Addons For Elementor King Addons For Elementor
CVE-2026-125434

WordPress RepairBuddy plugin <= 4.1235 - Broken Access Control vulnerability

Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RepairBuddy: from n/a through 4.1235.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Webful Creations Wordpress-extensions
Products
Repairbuddy Repairbuddy
CVE-2026-125680

WordPress Bold Page Builder plugin <= 5.9.11 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Themes Bold Page Builder bold-page-builder allows Stored XSS.This issue affects Bold Page Builder: from n/a through 5.9.11.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Bold-themes Wordpress-extensions
Products
Bold Page Builder Bold Page Builder
CVE-2026-124262

WordPress Ad Inserter plugin <= 2.8.19 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Igor Funa Ad Inserter ad-inserter allows Code Injection.This issue affects Ad Inserter: from n/a through 2.8.19.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Igorfuna Wordpress-extensions
Products
Ad Inserter Ad Inserter
CVE-2026-125776

WordPress Profile Builder plugin <= 4.0.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in Cozmoslabs Profile Builder profile-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Profile Builder: from n/a through 4.0.6.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Cozmoslabs Wordpress-extensions
Products
Profile Builder Profile Builder