Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5

Export CSV
CVE-2026-65525

WordPress Civi Framework plugin <= 2.2.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Civi Framework <= 2.2.0 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Uxper Wordpress
Products
Civi Framework Wordpress
CVE-2026-65476

WordPress Civi theme <= 2.2.4 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Civi <= 2.2.4 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Uxper Wordpress
Products
Civi Wordpress
CVE-2024-13771

Civi - Job Board & Freelance Marketplace WordPress Theme <= 2.1.4 - Authentication Bypass via Password Update

The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.1.4. This is due to a lack of user validation before changing a password. This makes it possible for unauthenticated attackers to change the password of arbitrary users, including administrators, if the attacker knows the username of the victim.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Uxper
Products
Civi
CVE-2024-13773

Civi - Job Board & Freelance Marketplace WordPress Theme <= 2.1.4 - Sensitive Information Exposure

The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 via hard-coded credentials. This makes it possible for unauthenticated attackers to extract sensitive data including LinkedIn client and secret keys.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Uxper
Products
Civi
CVE-2024-13772

Civi - Job Board & Freelance Marketplace WordPress Theme <= 2.1.6.1 - Authentication Bypass

The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.1.6.1. This is due to a lack of password randomization and user validation through the fb_ajax_login_or_register and google_ajax_login_or_register actions. This makes it possible for unauthenticated attackers to login as any user as long as they have access to the email.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed
Vendors
Uxper
Products
Civi