Export limit exceeded: 16394 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16,394

Export CSV
CVE-2026-13226

Groundhogg <= 4.5.4 - Authenticated (Custom+) SQL Injection via 'after' Parameter

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'after' parameter in all versions up to, and including, 4.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Sales Manager-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The AJAX handler wp_ajax_groundhogg_get_contacts_table has its capability check commented out and performs no nonce verification, meaning any authenticated user regardless of role can reach the vulnerable code path.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Trainingbusinesspros Wordpress
Products
Groundhogg — Crm, Newsletters, And Marketing Automation Wordpress
CVE-2026-1869

User Registration & Membership <= 5.2.0 - Missing Authorization to Unauthenticated Payment Bypass

The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to unauthorized modification of data due to missing validation checks in the confirm_payment() function in all versions up to, and including, 5.2.0. This makes it possible for unauthenticated attackers to bypass payment processing and activate paid memberships.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpeverest
Products
Wordpress User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
CVE-2025-15546

Iptanus File Upload < 5.1.7 - File Overwrite via Race Condition

The Iptanus File Upload WordPress plugin before 5.1.7 does not implement proper file handling when the duplicatepolicy setting is configured to "maintain both." Due to a Time-of-Check to Time-of-Use (TOCTOU) race condition between the file existence check and the actual file write operation, an authenticated attacker can overwrite files uploaded by other users.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Iptanus Wordpress
Products
Iptanus File Upload Wordpress
CVE-2016-20066

WordPress CP Polls 1.0.8 Persistent Cross-Site Scripting

WordPress CP Polls 1.0.8 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts through unsanitized file upload functionality. Attackers can upload files containing script payloads with event handlers like onerror attributes to execute arbitrary JavaScript in the browsers of users viewing the affected content.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Dwbooster Wordpress
Products
Cp Polls Wordpress
CVE-2016-20067

WordPress CP Polls 1.0.8 Cross-Site Request Forgery

WordPress CP Polls 1.0.8 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions on behalf of authenticated users. Attackers can craft malicious HTML pages that execute unwanted poll operations when administrators visit the page while logged in.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Dwbooster Wordpress
Products
Cp Polls Wordpress
CVE-2026-39502

WordPress Form Maker by 10Web plugin <= 1.15.38 - SQL Injection vulnerability

Unauthenticated SQL Injection in Form Maker by 10Web <= 1.15.38 versions.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
10web Wordpress
Products
Form Maker Wordpress
CVE-2026-52699

WordPress VikRentCar plugin <= 1.4.5 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References (IDOR) in VikRentCar <= 1.4.5 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
E4jvikwp Wordpress
Products
Vikrentcar Wordpress
CVE-2026-6964

Video Conferencing with Zoom <= 4.6.7 - Missing Authorization to Unauthenticated Zoom SDK Credential Exposure via 'get_auth' AJAX Action

The Video Conferencing with Zoom plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.6.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to obtain the site's Zoom SDK API key and a freshly-signed JWT that can be used with the Zoom Web SDK to join any Zoom meeting associated with those credentials without a legitimate invitation.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
J 3rk Wordpress
Products
Video Conferencing With Zoom Wordpress
CVE-2025-69112

WordPress Planty theme <= 1.14.0 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Planty <= 1.14.0 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Themerex Wordpress
Products
Planty Wordpress
CVE-2025-69113

WordPress Nexio theme <= 1.10.0 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Nexio <= 1.10.0 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Themerex Wordpress
Products
Nexio Wordpress
CVE-2025-69114

WordPress MaxiNet theme <= 1.2.10 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in MaxiNet <= 1.2.10 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Themerex Wordpress
Products
Maxinet Wordpress