Export limit exceeded: 16307 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16,307

Export CSV
CVE-2026-86449

LearnPress < 4.4.7 - Unauthenticated Unpublished Course Disclosure via REST API

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities before applying a user supplied post status filter in one of its REST routes, allowing unauthenticated attackers to list courses that are not published, including draft, pending, private, scheduled and trashed ones.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Learnpress Wordpress
Products
Learnpress Wordpress
CVE-2026-86823

Newsletter < 9.3.7 - Unauthenticated Open Redirect and Subscriber Token Disclosure via ncu Parameter

The Newsletter WordPress plugin before 9.3.7 does not validate the destination of the redirect performed after a public subscription action, allowing unauthenticated attackers to redirect users to arbitrary external sites and to disclose a subscriber token that grants access to that subscriber record's front-end actions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Newsletter Wordpress
Products
Newsletter Wordpress
CVE-2026-87966

Easy Appointments 4.0 - 4.0.2.1 - Unauthenticated Arbitrary Appointment Modification and Deletion via IDOR

The Easy Appointments WordPress plugin before 4.0.2.2 does not perform an ownership or authorization check on its unauthenticated appointment-reservation endpoint before updating an existing appointment identified by a request-supplied id, allowing unauthenticated attackers to overwrite, and through a follow-on cleanup delete, arbitrary appointments.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Easy-appointments Wordpress
Products
Easy Appointments Wordpress
CVE-2026-87965

Easy Appointments < 4.0.2.2 - Unauthenticated Appointment Cancellation/Confirmation via Forgeable Email-Link Token

The Easy Appointments WordPress plugin before 4.0.2.2 does not use an unguessable token to authorize its mail-link appointment cancellation and confirmation action, deriving the token from a hardcoded source-embedded salt and the appointment's creation timestamp, so unauthenticated attackers who know or guess that timestamp can cancel or confirm arbitrary appointments.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Easy-appointments Wordpress
Products
Easy Appointments Wordpress
CVE-2026-84905

Eventin < 4.1.24 - Contributor+ User Creation via Speaker Creation

The Eventin WordPress plugin before 4.1.24 does not verify a user's capability to create accounts when adding a speaker, allowing users with contributor-level access and above to create new WordPress user accounts that carry capabilities beyond their own, including publishing content and uploading files, and, by supplying an email address they control, to obtain a working login to the created account.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Eventin Wordpress
Products
Eventin Wordpress
CVE-2026-86447

LearnPress < 4.4.7 - Unauthenticated Student Enrollment Disclosure via load_content_via_ajax

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative course tools, allowing unauthenticated attackers to list every enrolled student's display name and user identifier against the course they are enrolled on, and to recover their email addresses through the same handler's search filter.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Learnpress Wordpress
Products
Learnpress Wordpress
CVE-2026-84906

Eventin < 4.1.24 - Unauthenticated Payment Bypass via Stripe and PayPal Cross-Order Transaction Replay

The Eventin WordPress plugin before 4.1.24 does not verify that a completed payment corresponds to the order it is applied to, confirming only that the payment gateway reports the transaction as successful, not its amount, currency, or which order it belongs to, allowing unauthenticated visitors to mark unpaid orders of any value as paid by replaying the transaction of a single genuine low-value payment.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Eventin Wordpress
Products
Eventin Wordpress
CVE-2026-90923

Autopay < 5.0.1 - Unauthenticated Cross-Customer Order Payment Parameter Disclosure and Deletion

The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete the stored payment parameters of other customers' orders.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Autopay Wordpress
Products
Autopay Wordpress
CVE-2026-91016

Motors < 1.4.121 - Unauthenticated Draft/Private Listing Disclosure

The Motors WordPress plugin before 1.4.121 does not verify that a request is authorized to view a user's non-published listings before returning them, allowing unauthenticated attackers to read any author's draft, pending and private car listings - including titles, prices, media URLs and seller notes - by supplying only the target's numeric user id.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Motors Wordpress
Products
Motors Wordpress
CVE-2026-86824

Newsletter < 9.3.8 - Unauthenticated Subscriber PII Disclosure and Modification via Predictable Tracking Signature Key

The Newsletter WordPress plugin before 9.3.8 does not generate its email tracking signing key with sufficient entropy and signs its tracking links with an unkeyed hash, allowing an unauthenticated attacker who recovers that key offline to forge tracking links, obtain any subscriber's session token, and read and modify that subscriber's stored personal data.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Newsletter Wordpress
Products
Newsletter Wordpress
CVE-2026-86446

LearnPress 4.4.3 - 4.4.6 - Unauthenticated Quiz Answer Disclosure via check-answer REST Endpoint

The LearnPress WordPress plugin before 4.4.7 does not restrict the correctness flags it returns when a quiz answer is checked, allowing unauthenticated attackers to obtain the correct answer to every option of a question, along with the instructor's explanation, on courses configured to be taken without enrolling.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Learnpress Wordpress
Products
Learnpress Wordpress
CVE-2026-86311

Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.44 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Shortcode Attributes in all versions up to, and including, 1.8.44 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
10web Wordpress
Products
Photo Gallery By 10web – Mobile-friendly Image Gallery Wordpress