Export limit exceeded: 16394 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16,394

Export CSV
CVE-2017-20251

WordPress Insert PHP Plugin < 2.5.1 PHP Code Injection via REST API

WordPress Insert PHP plugin versions before 2.5.1 contain a PHP code injection vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by injecting malicious shortcodes through the WordPress REST API. Attackers can send POST requests to the wp-json/wp/v2/posts endpoint with crafted content containing insert_php shortcodes to include and execute remote PHP files on the server.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Cm-wp Wordpress
Products
Woody Code Snippets Wordpress
CVE-2026-62107

WordPress Masteriyo - LMS plugin <= 3.4.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeGrill Masteriyo - LMS learning-management-system allows Object Injection.This issue affects Masteriyo - LMS: from n/a through 3.4.0.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Masteriyo Wordpress
Products
Masteriyo Wordpress
CVE-2026-54825

WordPress wpDataTables plugin <= 7.4 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS wpDataTables wpdatatables allows Blind SQL Injection.This issue affects wpDataTables: from n/a through 7.4.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpdatatables
Products
Wordpress Wpdatatables
CVE-2025-15400

OpenPix < 2.13.6 - Subscriber+ Payment Gateway Settings Reset

The OpenPix for WooCommerce WordPress plugin before 2.13.6 allows any authenticated user to trigger AJAX actions that reset payment gateway configuration options without capability or nonce checks. This permits any authenticated users, such as subscribers to clear API credentials and webhook status, causing persistent disruption of OpenPix payment functionality.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Openpix Wordpress
Products
Pix Para Woocommerce Wordpress
CVE-2026-61949

WordPress Bookly plugin <= 27.7 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bookly Bookly bookly-responsive-appointment-booking-tool allows Blind SQL Injection.This issue affects Bookly: from n/a through 27.7.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Bookly Wordpress
Products
Bookly Wordpress
CVE-2026-75981

TranslatePress – Translate Multilingual sites with AI Translation <= 3.2.5 - Unauthenticated Stored Cross-Site Scripting

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting in versions up to and including 3.2.5. The special gettext markers '#!trpst#' and '#!trpen#' are unconditionally rewritten to '<' and '>' by translate_page() in includes/class-translation-render.php (lines 538-539). Because those markers are plain text with no HTML-special characters, an unauthenticated attacker can embed them in a comment; the markers survive wp_kses, and when the post is viewed in a secondary language the substitution turns the attacker's '#!trpst#img ... #!trpen#' into a real <img> tag. remove_tags_from_output() only strips <script>/<style>, so an <img onerror=...> executes in the visitor's browser.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Cozmoslabs Wordpress
Products
Translatepress – Translate Multilingual Sites With Ai Translation Wordpress
CVE-2026-18777

TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Arbitrary Appointment Status Change via update_appointment_status

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to change the status of arbitrary appointments, as well as to trigger notification emails to the affected customers.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Truebooker Wordpress
Products
Truebooker Wordpress
CVE-2026-18776

TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Account Takeover via Multiple AJAX Actions

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the email address of arbitrary users, including administrators, and subsequently take over their account via the password reset flow.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Truebooker Wordpress
Products
Truebooker Wordpress
CVE-2026-18466

WP Maps < 4.9.8 - Subscriber+ Unlimited Autoloaded Option Creation

The WP Maps WordPress plugin before 4.9.8 does not perform a capability check, nor validate a nonce, in one of its AJAX actions, allowing users with a Subscriber account to create an unlimited number of options in the database, each of which is loaded on every page request.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress Wp Maps
Products
Wordpress Wp Maps
CVE-2026-19598

Pods <= 3.3.9 - Unauthenticated Privilege Escalation via Authorization Bypass to Admin Methods via 'pods_admin' AJAX Router

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization Bypass in all versions up to, and including, 3.3.9. The vulnerability exists because the pods_admin AJAX router funnels every access check — including the method allowlist, nonce verification, login enforcement, and capability gate — through pods_error(), which under the JSON meta-box-loader compatibility path only writes failures to the PHP error log and returns false instead of terminating the request, rendering all guards ineffective. This makes it possible for unauthenticated attackers to escalate their privileges to Administrator or overwrite the password of any user account, including the site owner's, enabling complete site takeover, or perform another administrator action.

CVSS 3.1 · 9.8 Critical EPSS 3.5% KEV · Not listed
Vendors
Sc0ttkclark Wordpress
Products
Pods – Custom Content Types And Fields Wordpress
CVE-2025-68040

WordPress WP Project Manager plugin <= 3.0.1 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in weDevs WP Project Manager wedevs-project-manager allows Retrieve Embedded Sensitive Data.This issue affects WP Project Manager: from n/a through 3.0.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wedevs Wordpress
Products
Wp Project Manager Wordpress
CVE-2026-27541

WordPress Wholesale Suite plugin <= 2.2.6 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in Josh Kohlbach Wholesale Suite allows Privilege Escalation. This issue affects Wholesale Suite: through 2.2.6.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Josh Kohlbach Wordpress
Products
Wholesale Suite Wordpress
CVE-2026-27542

WordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture allows Privilege Escalation. This issue affects Woocommerce Wholesale Lead Capture: through 2.0.3.1.

CVSS 3.1 · 9.8 Critical EPSS 1.8% KEV · Not listed
Vendors
Rymera Web Co Pty Ltd. Wordpress
Products
Woocommerce Wholesale Lead Capture Wordpress
CVE-2026-27540

WordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture allows Using Malicious Files. This issue affects Woocommerce Wholesale Lead Capture: through 2.0.3.1.

CVSS 3.1 · 9 Critical EPSS 2.7% KEV · Not listed
Vendors
Rymera Web Co Pty Ltd. Wordpress
Products
Woocommerce Wholesale Lead Capture Wordpress
CVE-2026-13423

Streamit < 4.5.2 - Unauthenticated Remote Code Execution via Arbitrary Function Call

The Streamit WordPress theme before 4.5.2 does not perform any authorization or nonce verification on one of its unauthenticated AJAX routes, which invokes an attacker-supplied PHP function with an attacker-supplied argument array, allowing unauthenticated attackers to call arbitrary functions (for example to create an administrator account), leading to privilege escalation and remote code execution.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Streamlit Wordpress
Products
Streamlit Wordpress
CVE-2026-73996

WordPress Masteriyo - LMS plugin <= 2.3.2 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in ThemeGrill Masteriyo - LMS learning-management-system allows Upload a Web Shell to a Web Server.This issue affects Masteriyo - LMS: from n/a through 2.3.2.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Masteriyo Wordpress
Products
Masteriyo Wordpress
CVE-2026-119977

WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution

WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.

CVSS 3.1 · 8.1 High EPSS 1.2% KEV · Listed
Vendors
Wordpress Wordpress Foundation
Products
Wordpress Wordpress
CVE-2025-68596

WordPress Bit Assist plugin <= 1.5.11 - Broken Access Control vulnerability

Missing Authorization vulnerability in Bit Apps Bit Assist bit-assist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bit Assist: from n/a through <= 1.5.11.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Bitapps Wordpress
Products
Bit Assist Wordpress
CVE-2025-68586

WordPress Cooked plugin <= 1.11.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Gora Tech Cooked cooked allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cooked: from n/a through <= 1.11.3.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Goratech Wordpress
Products
Cooked Wordpress
CVE-2025-68584

WordPress Vimeotheque plugin <= 2.3.5.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Constantin Boiangiu Vimeotheque codeflavors-vimeo-video-post-lite allows Cross Site Request Forgery.This issue affects Vimeotheque: from n/a through <= 2.3.5.2.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress