Export limit exceeded: 16307 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16,307

Export CSV
CVE-2026-66629

WordPress Kirki plugin <= 6.2.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Kirki <= 6.2.3 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Themeum Wordpress
Products
Kirki Wordpress
CVE-2026-32553

WordPress OttoKit plugin <= 1.1.35 - Server Side Request Forgery (SSRF) vulnerability

Unauthenticated Server Side Request Forgery (SSRF) in OttoKit <= 1.1.35 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Brainstorm Force Wordpress
Products
Ottokit Wordpress
CVE-2026-15748

Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration

The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handle_file_upload function. This is due to insufficient file type validation in handle_file_upload, where the dangerous-extension blocklist performs exact-key matching that is bypassed by pipe-alternative MIME type keys, combined with a public submission handler that trusts attacker-controlled upload field configuration injected via a forged Select field value. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.

CVSS 3.1 · 9.8 Critical EPSS 4.1% KEV · Not listed
Vendors
Wordpress Wpmudev
Products
Wordpress Forminator Forms – Contact Form, Payment Form & Custom Form Builder
CVE-2026-68565

WordPress GeoDirectory plugin <= 2.8.172 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in GeoDirectory <= 2.8.172 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Paolo Wordpress
Products
Geodirectory Wordpress
CVE-2026-32481

WordPress Ezoic plugin <= 2.22.11 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in Ezoic <= 2.22.11 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Ezoic Wordpress
Products
Ezoic Wordpress
CVE-2026-28571

WordPress FormyChat plugin <= 2.15.7 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in FormyChat <= 2.15.7 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Wordpress Wppool
Products
Wordpress Formychat
CVE-2026-15384

Manual Image Crop < 1.15 - Subscriber+ Arbitrary Attachment Image Overwrite via IDOR

The Manual Image Crop WordPress plugin before 1.15 does not perform any capability check or nonce verification on the authenticated AJAX action that crops attachment images; its only guard passes for any logged-in user. A subscriber-level user can therefore supply an arbitrary attachment ID and overwrite that attachment's generated intermediate-size image (for example its thumbnail) and mutate its stored metadata, regardless of who owns the media. This is a cross-user integrity/defacement issue over the Media Library. The action also has no nonce, so it is additionally susceptible to CSRF.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Manual Image Crop Project Wordpress
Products
Manual Image Crop Wordpress
CVE-2026-6229

Royal Addons for Elementor <= 1.7.1057 - Authenticated (Contributor+) Server-Side Request Forgery via CSV URL Parameter

The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1057. This is due to insufficient validation of user-supplied URLs in the render_csv_data() function, which can be bypassed by including 'docs.google.com/spreadsheets' in a query parameter, and the subsequent use of these URLs in fopen() calls without blocking internal or private network addresses. This makes it possible for authenticated attackers, with Contributor-level access and above, to make requests to arbitrary URLs and retrieve sensitive information from internal services.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Wordpress Wproyal
Products
Wordpress Royal Addons For Elementor – Addons And Templates Kit For Elementor
CVE-2026-19728

Extra Product Options Builder for WooCommerce < 1.2.176 - Unauthenticated Customer File Disclosure via getpublicfileupload

The Extra Product Options Builder for WooCommerce WordPress plugin before 1.2.176 does not verify that the requester is entitled to a customer-uploaded file before serving it, allowing unauthenticated users who obtain a file's stored name to retrieve it. The Extra Product Options Builder for WooCommerce WordPress plugin before 1.2.176 writes a deny-all rule into its upload directories, so the disclosure only crosses a boundary on web servers that honour it, such as Apache. Where it is ignored, as on a default nginx setup, the same files are already served at their direct URL and the endpoint exposes nothing further.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Actpro Wordpress
Products
Extra Product Options For Woocommerce Wordpress
CVE-2026-19714

Simple JWT Login < 3.6.8 - Unauthenticated Account Takeover via Missing Google id_token Audience Validation

The Simple JWT Login WordPress plugin before 3.6.8 does not validate the audience of the Google identity tokens it accepts, allowing unauthenticated users to authenticate as any user whose email address such a token carries, up to and including an administrator. Every site with the Simple JWT Login WordPress plugin before 3.6.8's Google sign-in enabled is affected.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Simple Jwt Login Project Wordpress
Products
Simple Jwt Login Wordpress
CVE-2026-19725

WPvivid Backup & Migration < 0.9.131 - Unauthenticated Path Traversal via send_to_site_connect

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131 does not sanitise a value taken from an unauthenticated request before using it to build a log file path, allowing an attacker holding a site to site transfer key to create a log file in any existing writable directory of the site, including the web root. The file name always carries a fixed suffix and the contents are always the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131's own log header, so only the location of the file is attacker controlled.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpvividplugins
Products
Wordpress Wpvivid — Backup, Migration & Staging
CVE-2026-18653

WP Directory Kit < 1.5.7 - Admin+ SQL Injection via section Parameter

The WP Directory Kit WordPress plugin before 1.5.7 does not sanitise and escape a parameter before using it in a SQL statement, allowing administrators to perform SQL injection attacks. On a multisite installation this lets an administrator of a single site read data belonging to the entire network, which they are not otherwise able to reach.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpdirectorykit
Products
Wordpress Wp Directory Kit
CVE-2026-17533

All-in-One WP Migration and Backup < 7.108 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via REST Import

The All-in-One WP Migration and Backup WordPress plugin before 7.108 does not restrict its migration import functionality to network administrators on multisite installations, allowing an administrator of a single subsite to execute arbitrary PHP code across the entire network.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Wordpress Yaniiliev
Products
Wordpress All In One Wp Migration And Backup
CVE-2026-16611

Product Feed PRO for WooCommerce < 13.5.7 - Unauthenticated Feed Configuration Disclosure

The Product Feed PRO for WooCommerce by AdTribes WordPress plugin before 13.5.7 does not perform an authorization check on one of its REST read routes, allowing unauthenticated users to disclose a store's feed configuration (rules, filters and field mapping) and to enumerate the full product category taxonomy.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Adtribes Wordpress
Products
Product Feed Pro For Woocommerce Wordpress
CVE-2026-9767

The School Management <= 5.4 - Authenticated (Custom+) SQL Injection via 'order[0][dir]' Parameter

The The School Management – Education & Learning ERP plugin for WordPress is vulnerable to generic SQL Injection via 'order[0][dir]' Parameter in all versions up to, and including, 5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This vulnerability is replicated across seven or more AJAX handlers including wlsm-fetch-staff-classes, wlsm-fetch-notices, wlsm-fetch-subjects, wlsm-fetch-inquiries, wlsm-fetch-staff-employee, and wlsm-fetch-payments, and the missing nonce verification on several of these handlers also enables CSRF-chained exploitation.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Weblizar Wordpress
Products
School Management - Education & Learning Management Wordpress
CVE-2026-19712

Masteriyo LMS < 2.3.3 - Instructor+ Stored XSS via Quiz Description

The Masteriyo LMS WordPress plugin before 2.3.3 does not sanitise and escape a quiz field before outputting it back in a page, and grants its instructor role the ability to store unfiltered HTML, allowing such users to perform Stored Cross-Site Scripting attacks against any visitor of the affected page, including administrators. This affects default single-site installations. Sites running multisite, or defining DISALLOW_UNFILTERED_HTML, are not affected as the capability is not granted there.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Masteriyo Wordpress
Products
Masteriyo Wordpress
CVE-2026-18438

Templately <= 3.7.1 - Authenticated (Contributor+) Arbitrary File Upload to Remote Code Execution via Gutenberg Cloud Import Attachment Filename Mismatch

The Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.7.1 via the fetch_remote_file function. This is due to a filename validation/destination mismatch in fetch_remote_file, where file type validation is performed against the attacker-controlled Content-Disposition filename rather than the URL-path-derived destination filename. This makes it possible for authenticated attackers, with contributor-level access and above, to execute code on the server. A GIF+PHP polyglot file passes wp_check_filetype_and_ext validation as image/gif via the Content-Disposition filename, while the actual destination path is written with a .php extension derived from the URL path, bypassing the unfiltered_upload capability gate entirely. The affected endpoints are reachable at this privilege level because Templately's entire REST API — including the cloud import endpoints used in this attack (/templately/v1/clouds/upload and /templately/v1/insert) — is authorized only by a current_user_can('delete_posts') check, with no administrator or manage_options capability requirement. The same permission gate also allows a contributor to overwrite the site's global Templately cloud connection via the /templately/v1/login endpoint with global_signin set to true. A complete remediation should both correct fetch_remote_file to validate the file type against the actual destination filename rather than the Content-Disposition header (and avoid deriving the write path from the request URL), and restrict state-changing Templately REST routes to an appropriate administrator-level capability.

CVSS 3.1 · 8.8 High EPSS 1.3% KEV · Not listed
Vendors
Wordpress Wpdevteam
Products
Wordpress Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud!
CVE-2026-18387

Groundhogg <= 4.5.14 - Authenticated (Vendor+) SQL Injection via 'tag_query' Parameter

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'tag_query' parameter in all versions up to, and including, 4.5.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with vendor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the attacker to trigger the vulnerable Legacy_Contact_Query code path by submitting an unknown filter type (e.g. filters[0][0][type]=force_fallback), which causes a FilterException that dispatches execution away from the modern query handler.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Trainingbusinesspros Wordpress
Products
Groundhogg — Crm, Newsletters, And Marketing Automation Wordpress