Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2,278

Export CSV
CVE-2026-105322

Magee Shortcodes <= 2.1.1 - Unauthenticated Mail Relay via Contact Form

The Magee Shortcodes WordPress plugin through 2.1.1 does not restrict the recipient of some of its unauthenticated contact-form actions, allowing unauthenticated users to send arbitrary emails to any address through the site (mail relay).

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Magee Shortcodes
CVE-2026-82211

Nexi XPay Build <= 7.6.2 - Unauthenticated Payment Completion and Order Key Disclosure

The Nexi XPay Build WordPress plugin through 7.6.2 does not verify the payment result supplied to several of its unauthenticated routes, allowing attackers to mark arbitrary orders as paid or failed, to cancel them, and to obtain order keys which expose guest buyers' details.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Nexi Xpay Build
CVE-2026-82212

Nexi XPay Build <= 7.6.2 - Unauthenticated Payment Bypass via NPG Notification Handler

The Nexi XPay Build WordPress plugin through 7.6.2 does not correctly validate the security token on its payment notification route, accepting the request when the target order has no stored token, which allows unauthenticated attackers to mark arbitrary orders as paid, or to mark genuinely paid orders as failed.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Nexi Xpay Build
CVE-2026-89417

OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. <= 6.3.10 - Unauthenticated Stored Cross-Site Scripting via 's' Search Parameter in comments-atom Feed

The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 's' Search Parameter via comments-atom Feed in all versions up to, and including, 6.3.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires that the front-end server serves the retained .tmp file without a Content-Type or X-Content-Type-Options header, enabling MIME-sniffing browsers such as Chromium to execute the injected script — a condition present by default on many Apache and nginx/php-fpm deployments.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Daanvandenbergh Wordpress-extensions
Products
Omgf Omgf
CVE-2026-42721

WordPress affiliate-toolkit plugin <= 3.9.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SERVIT Software Solutions affiliate-toolkit affiliate-toolkit-starter allows Blind SQL Injection.This issue affects affiliate-toolkit: from n/a through 3.9.1.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Servit Software Solutions Wordpress-extensions
Products
Affiliate-toolkit Affiliate-toolkit
CVE-2026-42720

WordPress Dynamic User Directory plugin <= 2.4 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sarah Giles Dynamic User Directory dynamic-user-directory allows Blind SQL Injection.This issue affects Dynamic User Directory: from n/a through 2.4.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Sarah Giles Wordpress-extensions
Products
Dynamic User Directory Dynamic User Directory
CVE-2026-42714

WordPress Pix por Piggly (para Woocommerce) plugin <= 2.1.2 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Piggly Dev Pix por Piggly (para Woocommerce) pix-por-piggly allows Blind SQL Injection.This issue affects Pix por Piggly (para Woocommerce): from n/a through 2.1.2.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Piggly Dev Wordpress-extensions
Products
Pix Por Piggly (para Woocommerce) Pix Por Piggly (para Woocommerce)
CVE-2026-42713

WordPress Post title marquee scroll plugin <= 9.9 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Gopiplus Post title marquee scroll post-title-marquee-scroll allows Blind SQL Injection.This issue affects Post title marquee scroll: from n/a through 9.9.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Gopiplus Wordpress-extensions
Products
Post Title Marquee Scroll Post Title Marquee Scroll
CVE-2026-42710

WordPress Slider by 10Web plugin <= 1.2.63 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 10Web Slider by 10Web slider-wd allows Blind SQL Injection.This issue affects Slider by 10Web: from n/a through 1.2.63.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
10web Wordpress-extensions
Products
Sliderby10web Slider By 10web
CVE-2026-42708

WordPress WP Post Author plugin <= 4.0.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AF themes WP Post Author wp-post-author allows Blind SQL Injection.This issue affects WP Post Author: from n/a through 4.0.0.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Afthemes Wordpress-extensions
Products
Wp Post Author Wp Post Author
CVE-2026-94662

WordPress Unlimited Elements For Elementor plugin <= 2.0.19 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Stored XSS. This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.19.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Unlimited-elements Wordpress-extensions
Products
Unlimited Elements For Elementor (free Widgets, Addons, Templates) Unlimited Elements For Elementor
CVE-2026-94670

WordPress Everest Forms plugin <= 3.6.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Everest Forms allows Reflected XSS. This issue affects Everest Forms: from n/a through 3.6.1.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Wpeverest
Products
Everest Forms Everest Forms
CVE-2026-95534

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.19 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Object Injection. This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.19.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Unlimited-elements Wordpress-extensions
Products
Unlimited Elements For Elementor (free Widgets, Addons, Templates) Unlimited Elements For Elementor
CVE-2026-95595

WordPress Disable and Remove Google Fonts | GDPR & DSGVO friendly plugin <= 2.0.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fontsplugin Disable and Remove Google Fonts | GDPR & DSGVO friendly disable-remove-google-fonts allows Reflected XSS. This issue affects Disable and Remove Google Fonts | GDPR &amp; DSGVO friendly: from n/a through 2.0.2.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Fontsplugin Wordpress-extensions
Products
Disable And Remove Google Fonts Gdpr Dsgvo Friendly Disable And Remove Google Fonts Gdpr Dsgvo Friendly
CVE-2026-95605

WordPress WP Data Access plugin <= 5.5.82 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Passionate Programmer Peter WP Data Access allows Blind SQL Injection. This issue affects WP Data Access: from n/a through 5.5.82.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Passionate Programmer Peter Wordpress-extensions
Products
Wp Data Access Wp Data Access
CVE-2026-96335

WordPress Forminator plugin <= 1.57.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in WPMU DEV Forminator allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Forminator: from n/a through 1.57.2.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Wpmudev
Products
Forminator Forminator Forms
CVE-2026-94154

Aurora Heatmap <= 1.7.2 - Unauthenticated Stored Cross-Site Scripting via 'url' Parameter

The Aurora Heatmap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 1.7.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an admin user clicks the injected heatmap link.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
R3098 Wordpress-extensions
Products
Aurora Heatmap Aurora Heatmap
CVE-2026-82627

Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included <= 7.6.1.1 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion

The Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.6.1.1 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object when a third-party integration plugin (such as PeepSo, MailPoet, WPForms, etc) is installed and a recipe is configured that stores attacker-controlled data as trigger meta. The additional presence of a POP chain within Uncanny Automator allows attackers to delete arbitrary files on the server.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Uncannyowl Wordpress-extensions
Products
Uncanny Automator Uncanny Automator
CVE-2026-17196

Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File Upload via 'extensions' Form Element Attribute

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 6.3.316 via the upload_files function. This is due to missing file type validation in the upload_files function, which reads and applies an attacker-controlled extensions string from _super_elements post meta verbatim as the allowed MIME type map. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. The attack requires a preceding step: poisoning the _super_elements post meta via the super_save_form AJAX handler, which lacks a capability and nonce check but requires the attacker to be authenticated as at minimum a Subscriber-level user; the subsequent file upload via super_upload_files requires no authentication at all.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Webrehab Wordpress-extensions
Products
Super Forms – Drag & Drop Form Builder Super Forms