Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2,282

Export CSV
CVE-2026-94272

Snap Finance 1.0.8 - 3.11.0 - Unauthenticated Arbitrary Order Status Change via Multiple AJAX Actions

The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to fail.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Snap Finance
CVE-2026-94294

App Builder 3.8.4 - 5.7.0 - Unauthenticated Option Write and Redirect via includes/pure.php

The App Builder WordPress plugin before 5.7.1 does not require authentication or authorisation before writing attacker-supplied data to one of its options and, on a separate unauthenticated request, redirecting the visitor's browser to a URI built from that stored data.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
App Builder
CVE-2026-111406

WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through 8.16.1.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Pt Norther Lights Production Wordpress-extensions
Products
Mapsvg Mapsvg
CVE-2026-110379

WordPress Quiz Maker plugin <= 6.7.1.91 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Quiz Maker quiz-maker allows Reflected XSS.This issue affects Quiz Maker: from n/a through 6.7.1.91.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Ays-pro Wordpress-extensions
Products
Quiz Maker Quiz Maker
CVE-2026-111398

WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Path Traversal.This issue affects MapSVG: from n/a through 8.16.1.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Pt Norther Lights Production Wordpress-extensions
Products
Mapsvg Mapsvg
CVE-2026-110887

WordPress HivePress plugin <= 1.7.32 - Remote Code Execution (RCE) vulnerability

Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Remote Code Inclusion.This issue affects HivePress: from n/a through 1.7.32.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Hivepress Wordpress-extensions
Products
Hivepress Hivepress
CVE-2026-112199

WordPress YITH WooCommerce Wishlist plugin <= 4.18.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Wishlist yith-woocommerce-wishlist allows Stored XSS.This issue affects YITH WooCommerce Wishlist: from n/a through 4.18.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Yithemes
Products
Yith Woocommerce Wishlist Yith Woocommerce Wishlist
CVE-2026-111839

WordPress Broadcast Live Video plugin <= 7.3.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadcast Live Video: from n/a through 7.3.7.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Videowhisper Wordpress-extensions
Products
Broadcast Live Video Broadcast Live Video
CVE-2026-111410

WordPress e2pdf plugin <= 1.32.57 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E2Pdf.com e2pdf e2pdf allows Stored XSS.This issue affects e2pdf: from n/a through 1.32.57.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
E2pdf Wordpress-extensions
Products
E2pdf E2pdf
CVE-2026-111414

WordPress JetElements For Elementor plugin <= 2.9.2.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.4.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Crocoblock Wordpress-extensions
Products
Jetelements For Elementor Jetelements For Elementor
CVE-2026-111836

WordPress FluentCommunity plugin <= 2.11.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP ManageNinja LLC FluentCommunity fluent-community allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentCommunity: from n/a through 2.11.0.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Wpmanageninja
Products
Fluentcommunity Fluentcommunity
CVE-2026-111831

WordPress FluentForm plugin <= 6.2.15 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP ManageNinja LLC FluentForm fluentform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentForm: from n/a through 6.2.15.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Wpmanageninja
Products
Fluentform Fluent Forms
CVE-2026-111845

WordPress YITH WooCommerce Product Bundles plugin <= 2.29.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Product Bundles: from n/a through 2.29.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Yithemes
Products
Yith Woocommerce Product Bundles Yith Woocommerce Product Bundles
CVE-2026-110902

WordPress Event Tickets plugin <= 5.30.1 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.1.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Liquid Web / Stellarwp Wordpress-extensions
Products
Event Tickets Event Tickets
CVE-2026-112222

WordPress Surfer plugin <= 1.8.0.744 - Broken Access Control vulnerability

Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Surfer: from n/a through 1.8.0.744.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Surfer Wordpress-extensions
Products
Surfer Surfer
CVE-2026-111828

WordPress Classified Listing plugin <= 6.1.5 - Direct static code injection vulnerability

Improper Validation of Specified Quantity in Input vulnerability in Mamunur Rashid Classified Listing classified-listing allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Classified Listing: from n/a through 6.1.5.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mamunur Rashid Wordpress-extensions
Products
Classified Listing Classified Listing
CVE-2026-93300

EventON - Subscriber <= 1.4.5 - Unauthenticated SQL Injection via 'email' Parameter

The EventON - Subscriber plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all versions up to, and including, 1.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Eventon Wordpress-extensions
Products
Eventon - Subscriber Eventon
CVE-2026-96902

Easy Property Listings < 3.5.28 - Unauthenticated Hidden Listing Details Disclosure via REST API

The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public REST API output, allowing unauthenticated users to read details a site has chosen to hide on published listings, such as the asking price, sold price, street address and exact map coordinates.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Easy Property Listings
CVE-2026-96903

Easy Property Listings < 3.5.27 - Subscriber+ Sensitive Data Disclosure via Contact CRM AJAX Handlers

The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contact-management read AJAX actions, allowing any authenticated user with a role as low as subscriber to read other users' CRM contact and lead records, including their private activity notes.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Easy Property Listings