Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16,394

Export CSV
CVE-2026-14225

Easy Appointments < 3.12.28 - Contributor+ Shortcode Allowlist Bypass

The Easy Appointments WordPress plugin before 3.12.28 does not correctly validate shortcode input in one of its block-rendering actions, checking only the first tag of the supplied string against an allowlist while rendering the entire string, allowing users with contributor-level access to execute arbitrary registered shortcodes.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Easy-appointments Wordpress
Products
Easy Appointments Wordpress
CVE-2026-16590

WP Directory Kit < 1.5.5 - Subscriber+ Contact Message and User Data Disclosure

The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to retrieve stored contact messages and associated user data belonging to other users.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpdirectorykit
Products
Wordpress Wp Directory Kit
CVE-2026-18464

WP Maps Pro < 6.1.3 - Unauthenticated Denial of Service

The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not restrict the operation it dispatches, allowing unauthenticated attackers to trigger uncontrolled recursion that exhausts server resources, resulting in a Denial of Service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Wordpress Wp Maps Pro
Products
Wordpress Wp Maps Pro
CVE-2026-16535

Link Library < 7.9.4 - Reflected XSS via Thumbs-Rating likelabel

The Link Library WordPress plugin before 7.9.4 does not sanitise and escape a parameter before reflecting it back in a response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who can be tricked into performing an action.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Link Library Project Wordpress
Products
Link Library Wordpress
CVE-2026-14224

Easy Appointments < 3.12.28 - Subscriber+ Cross-User Appointment Data Modification via IDOR

The Easy Appointments WordPress plugin before 3.12.28 does not verify that the appointment targeted by its customer-data update action belongs to the current user; the action only checks a shared nonce that any authenticated user can obtain from their own appointment's edit form. A subscriber-level user with an appointment of their own can therefore reuse that nonce to overwrite the customer metadata (email, name, phone, description) of another user's appointment. Because the Easy Appointments WordPress plugin before 3.12.28 then treats that metadata as the appointment's contact data, a subsequent administrator status change with customer notifications enabled delivers the victim's appointment notification to the attacker-controlled email address.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Easy-appointments Wordpress
Products
Easy Appointments Wordpress
CVE-2026-14221

Easy Appointments <= 4.0 - Contributor+ Appointment Data Disclosure & Modification via Missing Authorization

The Easy Appointments WordPress plugin through 4.0 does not perform capability checks in several of its appointment-management actions, relying only on a nonce that any authenticated user can obtain, allowing users with contributor-level access to read all customers' appointment details and to create, modify, and delete bookings.

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed
Vendors
Easy-appointments Wordpress
Products
Easy Appointments Wordpress
CVE-2026-14188

Easy Appointments < 3.12.28 - Contributor+ Customer Data Disclosure

The Easy Appointments WordPress plugin before 3.12.28 does not perform a per-request capability or nonce check on one of its customer-listing handlers, allowing authenticated users with contributor-level access to read every stored customer's personal information.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Easy-appointments Wordpress
Products
Easy Appointments Wordpress
CVE-2026-13692

PayU CommercePro < 3.9.0 - Unauthenticated Order Tampering

The PayU CommercePro Plugin WordPress plugin before 3.9.0 does not verify the payment-gateway signature before applying order modifications, allowing unauthenticated attackers to tamper with the totals, shipping and metadata of arbitrary WooCommerce orders.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Payu Wordpress
Products
Payu Commercepro Plugin Wordpress
CVE-2026-14223

Easy Appointments < 3.12.28 - Subscriber+ Customer PII Disclosure via IDOR

The Easy Appointments WordPress plugin before 3.12.28 does not verify ownership or capability when returning stored customer details, allowing users with subscriber-level access to read any customer's personal information by iterating an identifier.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Easy-appointments Wordpress
Products
Easy Appointments Wordpress
CVE-2026-14222

Easy Appointments < 3.12.28 - Contributor+ Connection Deletion via Missing Authorization

The Easy Appointments WordPress plugin before 3.12.28 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users with contributor-level access to delete the booking configuration and disable the booking system.

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed
Vendors
Easy-appointments Wordpress
Products
Easy Appointments Wordpress
CVE-2026-48093

Code Embed - Contributor Stored Cross-Site Scripting via Remote URL Embed

The Code Embed WordPress plugin prior to version 2.6.1 is vulnerable to stored Cross-Site Scripting (XSS) through the external URL embed feature in post content. The vulnerable code scans rendered content for URL embed tokens, fetches the remote URL, and inserts the remote response body into the page without output sanitization or an `unfiltered_html` capability check. This allows a Contributor attacker to submit a pending post containing an inert-looking URL token that executes attacker-controlled JavaScript when an Administrator or Editor previews or reviews the post. This is distinct from CVE-2026-2512, which affected custom field meta values up to version 2.5.1. This vector affects version 2.6 and uses the documented external URL embed feature in post content. This particular issue is patched in version 2.6.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Davidartiss Wordpress
Products
Code Embed Wordpress
CVE-2026-18933

wp-downloadmanager - Unrestricted File Upload via Missing Extension/MIME Validation and Path Traversal

The wp-downloadmanager WordPress plugin, in version 1.68.11 (also affecting the 6.9.4 release line), allows an admin-privileged user (current_user_can('manage_downloads')) to upload arbitrary files via download-add.php with no extension or MIME-type validation of any kind - no wp_check_filetype_and_ext, no validate_file, and no extension blocklist exist anywhere in the upload handler.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpdownloadmanager
Products
Wordpress Download Manager
CVE-2026-14226

Easy Appointments < 3.12.28 - Subscriber+ Sensitive Information Disclosure via REST Appointments Listing

The Easy Appointments WordPress plugin before 3.12.28 does not require a sufficient capability on one of its appointment-listing REST endpoints, restricting it only to a capability that every authenticated user holds, allowing users with subscriber-level access to read all bookings on the site, including customer names, schedules, and statuses.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Easy-appointments Wordpress
Products
Easy Appointments Wordpress
CVE-2026-11361

Formidable Forms < 6.32.1 - Unauthenticated Payment Bypass via PayPal APPROVAL_PENDING Subscription Status

The Formidable Forms WordPress plugin before 6.32.1 does not properly validate the status of a PayPal subscription payment before marking it complete, allowing unauthenticated users to bypass payment and trigger paid form actions — such as digital content access, license delivery, and membership activation — without being charged.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Formidableforms Wordpress
Products
Formidable Wordpress
CVE-2026-13399

Payment Plugins for PayPal WooCommerce < 2.0.20 - Unauthenticated Payment Bypass via Reuse of a Completed PayPal Order

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.20 does not have proper authorization checks on a REST endpoint, allowing unauthenticated users to bypass payments

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Payment Plugins Wordpress
Products
Payment Plugins For Paypal Woocommerce Wordpress