Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16,307

Export CSV
CVE-2026-14872

Database for Contact Form 7, WPforms, Elementor forms < 1.5.5 - Authenticated SQL Injection via id Parameter

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by users granted a specific capability which is limited to administrators by default but can be delegated to lower privileged roles.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Crmperks Wordpress
Products
Database For Contact Form 7, Wpforms, Elementor Forms Wordpress
CVE-2026-15233

Nested Pages < 3.2.15 - Editor+ Stored XSS via Post Title

The Nested Pages WordPress plugin before 3.2.15 does not properly escape post titles before outputting them into HTML attributes on an administrative listing screen, allowing users with the Editor role (or Contributor/Author when the Nested Pages WordPress plugin before 3.2.15 is enabled for the post type) to inject arbitrary JavaScript that executes in the session of any higher-privileged user who views that screen.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Nested Pages Project Wordpress
Products
Nested Pages Wordpress
CVE-2026-16035

miniOrange 2FA < 6.2.7 - Subscriber+ Arbitrary-Recipient OTP Send

The miniOrange 2FA WordPress plugin before 6.2.7 does not restrict who can trigger its second-factor configuration OTP send, nor bind the OTP recipient to the enrolling user's own address, allowing a low-privileged user to send one-time-passcode emails to arbitrary recipients and to exhaust the site's metered OTP allowance, preventing legitimate users from receiving their second-factor codes.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Miniorange Wordpress
Products
Miniorange 2fa Wordpress
CVE-2026-16293

Blubrry PowerPress < 11.16.11 - Contributor+ Stored XSS via Podcast Episode Chapters URL

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.16.11 does not sanitise and escape some of its Podcast Episode settings, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Blubrry Wordpress
Products
Powerpress Podcasting Plugin By Blubrry Wordpress
CVE-2026-65512

WordPress WP Activity Log and WP Activity Log Premium plugins <= 5.6.4 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site request forgery (CSRF) vulnerability in Melapress WP Activity Log and Melapress WP Activity Log Premium allows Cross Site Request Forgery. This issue affects WP Activity Log: through 5.6.4; WP Activity Log Premium: through 5.6.4.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Melapress Wordpress
Products
Wp Activity Log Wordpress
CVE-2026-16563

Academy LMS < 3.8.3 - Subscriber+ Arbitrary Lesson Content Disclosure via lessons REST Endpoint

The Academy LMS WordPress plugin before 3.8.3 does not verify course enrollment or lesson publication status when returning a single lesson through its REST API, allowing users with a self-service student (Subscriber-level) account to disclose the content of arbitrary lessons, including lessons of paid courses they are not enrolled in and unpublished (draft, pending, private) lessons.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Academylms Wordpress
Products
Academy Lms Wordpress
CVE-2026-11962

FileOrganizer < 1.2.0 - Authenticated Arbitrary File Upload via elFinder File Operations

The FileOrganizer WordPress plugin before 1.2.0 does not validate the file type on several of its file-management operations, allowing authenticated users who have been granted file-manager access — which its premium add-on can extend to sub-administrator roles — to upload arbitrary PHP files and achieve remote code execution. This is an incomplete fix of CVE-2024-7985, which only added file-type validation to the upload operation.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Fileorganizer Wordpress
Products
Fileorganizer Wordpress
CVE-2026-16292

Frontend File Manager Plugin <= 23.6 - File Metadata Update via CSRF

The Frontend File Manager Plugin WordPress plugin through 23.6 does not perform nonce validation on one of its file-metadata update actions, allowing an attacker to modify the metadata of a logged-in user's uploaded file via a CSRF attack, which can be leveraged to download that file. When guest uploads are enabled, the same action is reachable unauthenticated against any user's file.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Frontend File Manager Plugin Wordpress
Products
Frontend File Manager Plugin Wordpress
CVE-2026-8155

BuddyPress < 14.5.0 - Subscriber+ Private Messages Disclosure via IDOR

The BuddyPress WordPress plugin before 14.5.0 does not properly enforce authorization on its private messaging endpoints, allowing any authenticated user (Subscriber+) to read, modify, or delete other users' private messages.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Buddypress Wordpress
Products
Buddypress Wordpress
CVE-2026-13389

WebToffee Cookie Consent < 3.5.3 - Consent Log Disclosure/Deletion, Page Creation & License Deactivation via Unprotected REST Routes

The webtoffee-cookie-consent WordPress plugin before 3.5.3 does not perform authorization checks on several of its REST API routes, allowing unauthenticated attackers to export and delete stored visitor consent records, create posts, and modify the webtoffee-cookie-consent WordPress plugin before 3.5.3's licensing state.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Webtoffee Wordpress
Products
Gdpr Cookie Consent Wordpress
CVE-2026-15236

Gallery for Google Photos < 1.2.1 - Unauthenticated Google OAuth Token Disclosure

The Gallery for Google Photos WordPress plugin before 1.2.1 does not properly restrict access to the stored third-party OAuth credentials of the connected account, exposing the persistent access and refresh tokens to unauthenticated users and allowing long-term compromise of the linked account.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Gallery For Google Photos Wordpress
Products
Gallery For Google Photos Wordpress
CVE-2025-15673

Import and export users and customers < 2.4.3 - Admin+ Arbitrary File Read

The Import and export users and customers WordPress plugin before 2.4.3 does not restrict the path of a file it reads and displays during a CSV import, allowing high-privileged users to read arbitrary files on the server.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Carazo Wordpress
Products
Import And Export Users And Customers Wordpress
CVE-2026-15930

Simple Membership < 4.7.8 - Unauthenticated Administrator Account Takeover via Registration Username Collision

The Simple Membership WordPress plugin before 4.7.8 does not verify whether user creation failed during registration before using the returned value as a user ID to update an account, allowing unauthenticated attackers to overwrite the primary administrator's account data (including the email address) and take over that account through the password reset flow.

CVSS 3.1 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Simple-membership-plugin Wordpress
Products
Simple Membership Wordpress
CVE-2026-11366

MonsterInsights < 11.1.0 - Unauthenticated Measurement Protocol Secret Update via Empty-Key HMAC Bypass

The MonsterInsights WordPress plugin before 11.1.0 does not correctly validate the signature on one of its unauthenticated AJAX actions: when the MonsterInsights WordPress plugin before 11.1.0 is not connected to Google Analytics the HMAC signing key is empty, which lets unauthenticated attackers forge a valid signature and overwrite a MonsterInsights WordPress plugin before 11.1.0 configuration value, disrupting the MonsterInsights WordPress plugin before 11.1.0's server-side analytics in Manual GA4 mode.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Monsterinsights Wordpress
Products
Monsterinsights Wordpress
CVE-2026-16539

SM Page Duplicator <= 1.0.0 - Editor+ SQL Injection via Page Duplication

The sm page duplicator WordPress plugin through 1.0.0 does not sanitise and escape a stored value before using it in a SQL statement when duplicating a page, allowing users with the Editor role and above to perform SQL Injection attacks.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Shail Mehta Wordpress
Products
Sm Page Duplicator Wordpress
CVE-2026-16565

Dokan < 5.0.9 - Vendor+ Cross-Vendor Product Attribute Modification via Product Attribute REST API

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.9 does not verify product ownership on its product-attribute REST write endpoints, allowing users with a Dokan vendor account to modify the product attributes and default attributes of any other vendor's products on the marketplace.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Dokan Wordpress
Products
Ai Powered Woocommerce Multivendor Marketplace Solution Wordpress
CVE-2026-16572

LogMyTrip <= 1.9 - Unauthenticated SQL Injection via 'tid' Cookie

The LogMyTrip WordPress plugin through 1.9 does not sanitize and escape a value taken from a cookie before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks on any page that renders one of the LogMyTrip WordPress plugin through 1.9's shortcodes.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Ajohnwaters Wordpress
Products
Logmytrip Wordpress
CVE-2026-16056

Contest Gallery < 30.0.7 - Subscriber+ OpenAI Prompt History Disclosure via post_cg_get_openai_prompts

The Contest Gallery WordPress plugin before 30.0.7 does not perform any capability or nonce check in one of its handlers, allowing any authenticated user down to Subscriber to read the site's entire stored OpenAI prompt history.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Contest-gallery Wordpress
Products
Contest Gallery Wordpress
CVE-2026-16295

Clearfy < 2.4.3 - Subscriber+ Sensitive Information Disclosure via Factory Page-Action Dispatcher

The Clearfy Cache WordPress plugin before 2.4.3 does not perform a capability check in one of its admin-page dispatch paths, allowing any authenticated user such as a Subscriber to render admin-only settings pages and disclose their contents, including administrative nonces, while the canonical page URL correctly restricts access.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Clearfy Cache Wordpress
Products
Clearfy Cache Wordpress
CVE-2026-16070

Brizy - Page Builder < 2.8.19 - Contributor+ Template Type Update via IDOR

The Brizy WordPress plugin before 2.8.19 does not properly verify authorization on the object being modified before updating a template's type meta, validating a request parameter that is different from the one used in the write operation, allowing users with Contributor-level access and above to change the template-type assignment of templates owned by other users.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Brizy Wordpress
Products
Brizy Wordpress