CVE-2026-15073

KiviCare <= 4.5.0 - Authenticated (Doctor+) SQL Injection via 'orderby' Parameter in DoctorSessionController

The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 4.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Doctor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires a KiviCare Doctor, Receptionist, or Clinic Admin role at minimum, as the vulnerable REST endpoint is restricted to authenticated users with custom plugin-level access.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Iqonicdesign Wordpress

Products

Kivicare – Clinic & Patient Management System (ehr) Wordpress

CVE-2026-15155

Essential Addons for Elementor <= 6.6.10 - Authenticated (Contributor+) Account Takeover via Email Header Injection

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Authenticated Account Takeover via Email Header Injection in all versions up to, and including, 6.6.10 This is due to insufficient server-side validation of a Login/Register widget setting used to construct outgoing email headers — the allowed-values restriction is enforced only in the client-side editor UI and not on the server, and the applied sanitization does not strip or encode CR/LF characters, allowing CRLF sequences stored in that setting to survive into raw mail headers. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject an additional Bcc header into the WordPress administrator's password-reset notification email, receive a copy of a valid administrator password-reset link, and achieve full administrator account takeover.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpdevteam

Products

Wordpress Essential Addons For Elementor – Popular Elementor Templates & Widgets

CVE-2026-7655

SureCart <= 4.2.3 - Unauthenticated Linked WordPress Account Takeover via Forged customer.updated Webhook

The SureCart plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 4.2.3. This is due to the plugin not properly validating a user's identity prior to updating their details like email during customer profile synchronization from webhook events. This makes it possible for unauthenticated attackers to change linked user's email addresses, including administrators if the administrator account is linked to a SureCart customer record, and leverage that to reset the user's password and gain access to their account if the customer ID is known.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Surecart Wordpress

Products

Surecart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments Wordpress

CVE-2025-13968

Starboard Suite Reservation Calendars <= 3.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The Starboard Suite Reservation Calendars plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcode attributes in the [starboard-suite-lightbox] shortcode in all versions up to, and including, 3.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Starboardsuite Wordpress

Products

Starboard Suite Reservation Calendars Wordpress

CVE-2023-54346

WordPress Plugin Backup Migration 1.2.8 Unauthenticated Database Backup Download

WordPress Plugin Backup Migration 1.2.8 contains an information disclosure vulnerability that allows unauthenticated attackers to download complete database backups by accessing predictable file paths. Attackers can enumerate backup directories through configuration files and complete logs, then construct direct download URLs to retrieve sensitive backup archives containing full database dumps.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Backupbliss Wordpress

Products

Backup Migration Wordpress Plugin Backup Migration Wordpress

CVE-2022-50972

WooCommerce 7.1.0 Remote Code Execution via class-wc-meta-box-product-images.php

WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by injecting shell commands through the product-type parameter. Attackers can send requests to the class-wc-meta-box-product-images.php endpoint with unsanitized product-type values to write malicious PHP files to the web root.

CVSS 4.0 · 9.3 Critical EPSS 1.1% KEV · Not listed

Vendors

Woocommerce Wordpress

Products

Woocommerce Wordpress

CVE-2022-50959

WordPress Contact Form Builder 1.6.1 Cross-Site Scripting via code_generator.php

WordPress Contact Form Builder 1.6.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by exploiting the form_id parameter. Attackers can craft malicious URLs to code_generator.php with script payloads in the form_id parameter to execute arbitrary JavaScript in victim browsers.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpdevart

Products

Wordpress Contact Form Builder

CVE-2022-50956

WordPress Plugin amministrazione-aperta 3.7.3 Local File Read

WordPress Plugin amministrazione-aperta 3.7.3 contains a local file read vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting insufficient input validation in the open parameter. Attackers can supply file paths through the open GET parameter in dispatcher.php to include and read sensitive files accessible to the web server.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Amministrazione Aperta Project Wordpress

Products

Amministrazione Aperta Wordpress

CVE-2021-47979

WordPress Plugin Backup and Restore 1.0.3 Arbitrary File Deletion

WordPress Plugin Backup and Restore 1.0.3 contains an arbitrary file deletion vulnerability that allows authenticated attackers to delete files by manipulating parameters in AJAX requests. Attackers can send POST requests to admin-ajax.php with crafted file_name and folder_name parameters to delete arbitrary files from the WordPress installation directory.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Miniorange Wordpress Wpbackitup

Products

Backup And Restore Wordpress Backup And Restore Wordpress

CVE-2021-47941

WordPress Plugin Survey & Poll 1.5.7.3 SQL Injection via sss_params

WordPress Plugin Survey & Poll 1.5.7.3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the wp_sap cookie parameter. Attackers can craft SQL payloads in the cookie to extract sensitive database information including usernames, passwords, and other confidential data from the WordPress database.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Modalsurvey Wordpress

Products

Survey & Poll Wordpress Survey And Poll Wordpress

CVE-2021-47932

WordPress TheCartPress 1.5.3.6 Privilege Escalation Unauthenticated

WordPress TheCartPress 1.5.3.6 contains an unauthenticated privilege escalation vulnerability that allows attackers to create administrator accounts by submitting crafted requests to the AJAX handler. Attackers can send POST requests to the tcp_register_and_login_ajax action with tcp_role set to administrator to gain full administrative access without authentication.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Thecartpress Wordpress

Products

Thecartpress Wordpress

CVE-2020-37255

WordPress Time Capsule Plugin 1.21.16 Authentication Bypass

WordPress Time Capsule Plugin 1.21.16 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain administrative access by sending a crafted POST request with the IWP_JSON_PREFIX header. Attackers can exploit this flaw to obtain valid administrator session cookies and access the WordPress dashboard without providing credentials.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Wordpress Wptimecapsule

Products

Wordpress Wp Time Capsule

CVE-2019-25763

WordPress Ultimate Addons for Beaver Builder 1.2.4.1 Authentication Bypass

WordPress Ultimate Addons for Beaver Builder 1.2.4.1 contains an authentication bypass vulnerability that allows attackers to gain unauthorized access by exploiting the social media login form functionality. Attackers can submit a POST request to the admin-ajax.php endpoint with the uabb-lf-google-submit action, a valid administrator email address, and a valid nonce to obtain session cookies and authenticate as that user.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Brainstormforce Ultimatebeaver Wordpress

Products

Ultimate Addons For Beaver Builder Ultimate Addons For Beaver Builder Wordpress

CVE-2019-25746

WordPress Sliced Invoices 3.8.2 SQL Injection via post Parameter

WordPress Sliced Invoices 3.8.2 contains an authenticated SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the 'post' parameter. Attackers can send requests to the admin.php endpoint with action=duplicate_quote_invoice and malicious 'post' values to extract sensitive database information or modify data.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Slicedinvoices Wordpress

Products

Sliced Invoices Wordpress

CVE-2019-25744

WordPress Popup Builder 3.49 Persistent Cross-Site Scripting

WordPress Popup Builder 3.49 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by breaking out of option tags in the post_title parameter. Attackers can submit crafted POST requests to the post.php endpoint with script payloads in the post_title field that execute when pages or posts display popup selections.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Popup Builder Sygnoos Wordpress

Products

Popup Builder Popup Builder Wordpress

CVE-2018-25324

Simple Fields 0.2-0.3.5 Local File Inclusion via wp_abspath

Simple Fields 0.2 through 0.3.5 WordPress Plugin contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by injecting null bytes into the wp_abspath parameter on PHP versions before 5.3.4. Attackers can supply malicious wp_abspath values to simple_fields.php to include files like /etc/passwd or inject PHP code into Apache logs for remote code execution when allow_url_include is enabled.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Simple Fields Project Wordpress

Products

Simple Fields Wordpress

CVE-2016-20075

WordPress Ultimate Product Catalog 3.8.6 Arbitrary File Upload RCE

WordPress Ultimate Product Catalog 3.8.6 contains an arbitrary file upload vulnerability that allows authenticated users with contributor, editor, author, or administrator roles to upload malicious files by exploiting the custom fields functionality. Attackers can upload PHP shells through the Products tab custom file field and access them via the upcp-product-file-uploads directory to execute arbitrary code on the server.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Etoilewebdesign Wordpress

Products

Ultimate Product Catalog Wordpress

CVE-2016-20070

WordPress Booking Calendar Contact Form 1.0.23 Privilege Escalation Stored XSS

WordPress Booking Calendar Contact Form 1.0.23 contains privilege escalation and stored cross-site scripting vulnerabilities that allow authenticated users to modify plugin options and inject malicious scripts by failing to verify user privileges and sanitize input parameters. Attackers with subscriber-level accounts can inject XSS payloads through parameters like price, name, calendar_language, and email_confirmation_to_user via admin-ajax.php and admin.php endpoints to execute arbitrary JavaScript in administrator browsers.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Codepeople Dwbooster Wordpress

Products

Booking Calendar Contact Form Booking Calendar Contact Form Wordpress

CVE-2016-20069

WordPress Booking Calendar Contact Form 1.0.23 SQL Injection

WordPress Booking Calendar Contact Form 1.0.23 contains an unauthenticated blind SQL injection vulnerability in the shortcode function that fails to sanitize the calendar parameter before using it in database queries. Attackers can inject SQL commands through the calendar shortcode parameter to execute arbitrary SQL queries and extract sensitive database information.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Codepeople Dwbooster Wordpress

Products

Booking Calendar Contact Form Booking Calendar Contact Form Wordpress

CVE-2016-20068

WordPress Booking Calendar Contact Form 1.0.23 SQL Injection

WordPress Booking Calendar Contact Form version 1.0.23 contains an unauthenticated blind SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send requests to the admin-ajax.php endpoint with the action parameter set to 'dex_bccf_calendar_ajaxevent' and supply crafted SQL commands in the 'id' parameter to extract sensitive database information.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Codepeople Dwbooster Wordpress

Products

Booking Calendar Contact Form Booking Calendar Contact Form Wordpress