Export limit exceeded: 16808 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16,394

Export CSV
CVE-2026-14240

Tourmaster < 5.4.9 - Unauthenticated Sensitive Data Disclosure via Order Export

The tourmaster WordPress plugin before 5.4.9 writes its order/booking export to a fixed, predictable file inside its publicly accessible directory with no access control, allowing unauthenticated users to download the exported customers' personal information once an administrator has run an export.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Tourmaster Wordpress
Products
Tourmaster Wordpress
CVE-2026-16290

ProfileGrid < 6.0.0.0 - Unauthenticated Group Member List Disclosure via pm_get_all_users_from_group

The ProfileGrid WordPress plugin before 6.0.0.0 does not perform authorization checks before returning a group's member list, and registers the handler for unauthenticated users, allowing any unauthenticated visitor to disclose the members and their identifiers of any group, including private or closed ones, bypassing the ProfileGrid WordPress plugin before 6.0.0.0's member-visibility setting.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Profilegrid Wordpress
Products
Profilegrid Wordpress
CVE-2026-66710

WordPress e2pdf plugin <= 1.32.40 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in e2pdf <= 1.32.40 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
E2pdf Wordpress
Products
E2pdf Wordpress
CVE-2026-32548

WordPress SureCart plugin <= 4.6.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in SureCart <= 4.6.2 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Surecart Wordpress
Products
Surecart Wordpress
CVE-2026-65545

WordPress AI Engine plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in AI Engine <= 3.6.8 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Jordy Meow Wordpress
Products
Ai-engine Wordpress
CVE-2026-6235

Sendmachine for WordPress <= 1.0.20 - Unauthenticated SMTP Hijack to Privilege Escalation via manage_admin_requests

The Sendmachine for WordPress plugin for WordPress is vulnerable to authorization bypass via the 'manage_admin_requests' function in all versions up to, and including, 1.0.20. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the plugin's SMTP configuration, which can be leveraged to intercept all outbound emails from the site (including password reset emails).

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Sendmachine Wordpress
Products
Sendmachine For Wordpress Wordpress
CVE-2025-14843

Wizit Gateway for WooCommerce <= 1.3.1 - Missing Authentication to Unauthenticated Arbitrary Order Cancellation

The Wizit Gateway for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Arbitrary Order Cancellation in all versions up to, and including, 1.3.1. This is due to a lack of authentication and authorization checks in the 'handle_checkout_redirecturl_response' function. This makes it possible for unauthenticated attackers to cancel arbitrary WooCommerce orders by sending a crafted request with a valid order ID.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wizit Woocommerce Wordpress
Products
Gateway For Woocommerce Woocommerce Wordpress