Export limit exceeded: 425864 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 16307 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16,307

Export CSV
CVE-2026-14213

Amelia < 2.4.6 - Provider+ Cross-Customer Appointment Data Disclosure via IDOR

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.6 does not verify that an authenticated employee (provider) is assigned to the appointment being accessed, allowing any employee to read any appointment by its identifier and disclose the booked customer's personal data.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Ameliabooking Wordpress
Products
Booking For Appointments And Events Calendar Wordpress
CVE-2026-14182

Customer Email Verification for WooCommerce < 3.2.6 - Unauthenticated Account Takeover via Type-Juggling Authentication Bypass

The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a loose comparison that an attacker can satisfy with a crafted value type, allowing unauthenticated users to verify and take over the account of any registered user who has not yet confirmed their email address.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpfactory
Products
Wordpress Customer Email Verification For Woocommerce
CVE-2026-3835

Prevent Direct Access – Protect WordPress Files <= 2.8.8.8 - Unauthenticated Protected File Access

The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token validation in the `get_advance_file_by_url()` method in all versions up to, and including, 2.8.8.8 The method uses a SQL `LIKE` operator for token lookup without escaping wildcard characters via `$wpdb->esc_like()`. This makes it possible for unauthenticated attackers to bypass the private token requirement by supplying SQL wildcard characters (such as `%`) as the token value, matching any record in the plugin's file table and downloading any protected file.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Buildwps Wordpress
Products
Prevent Direct Access – Protect Wordpress Files Wordpress
CVE-2026-18146

Fluent Forms <= 6.2.11 - Unauthenticated Stored Cross-Site Scripting via Notification Smartcode Values

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Notification Smartcode Values in all versions up to, and including, 6.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in the browser of an administrator (or any user with the Fluent Forms entry-viewing capability) when they view the form's entry Submission Logs in the WordPress admin dashboard. Exploitation requires that a site administrator or Fluent Forms manager has configured an email notification whose subject or static (direct) Send To value references an attacker-influenced Smartcode such as an input_password field value, a cookie value, or submission.response.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpmanageninja
Products
Wordpress Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
CVE-2026-17021

Salon Booking System – Free Version < 10.30.34 - Unauthenticated Arbitrary Booking Total Tampering

The Salon Booking System WordPress plugin before 10.30.34 does not properly restrict access to some of its booking-modification AJAX actions and does not verify ownership of the targeted booking, allowing unauthenticated users to tamper with the stored total of arbitrary bookings.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Salonbookingsystem Wordpress
Products
Salon Booking System Wordpress
CVE-2026-17020

Salon Booking System – Free Version <= 10.31.0 - Subscriber+ Arbitrary Booking PII Disclosure

The Salon Booking System WordPress plugin through 10.31.0 does not verify that a requested booking belongs to the caller on one of its REST API endpoints, requiring only a basic read capability, allowing any authenticated user (including a Subscriber or self-registered customer account) to disclose any customer's booking personal data such as name, email, phone number, address and private notes by enumerating booking identifiers.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Salonbookingsystem Wordpress
Products
Salon Booking System Wordpress
CVE-2026-15237

Hotel Booking Lite < 6.2.3 - Unauthenticated Payment Record Creation via Checkout Payments REST Endpoint

The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not perform any authorization or ownership check on a REST endpoint that creates payment records, allowing unauthenticated users to create completed payment records against arbitrary bookings and falsely mark them as paid.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Motopress Hotel Booking Wordpress
Products
Motopress Hotel Booking Wordpress
CVE-2026-15388

Cookie Consent < 0.0.10 - Subscriber+ Consent Settings Update and Consent Log Disclosure

The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on its consent-settings REST routes, so they fall back to an authentication-only gate, allowing any authenticated user such as a subscriber to update the Cookie Consent WordPress plugin before 0.0.10's consent settings and, on sites connected to the vendor's paid plan, read stored visitor consent logs.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Cookie Consent Project Wordpress
Products
Cookie Consent Wordpress
CVE-2026-16977

Form Maker by 10Web < 1.15.45 - Subscriber+ SQL Injection via display_name

The Form Maker by 10Web WordPress plugin before 1.15.45 does not properly parameterize a user-controlled value that is substituted into a dynamic SQL query built for a database-backed choice field, allowing subscriber-level users to perform second-order SQL injection.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
10web Wordpress
Products
Form Maker By 10web Wordpress
CVE-2026-18046

Cookie Consent < 0.0.10 - Subscriber+ MaxMind License Key Update

The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on the REST route that stores its geolocation service license key, so the route falls back to an authentication-only gate, allowing any authenticated user such as a subscriber to overwrite the stored key and disrupt the Cookie Consent WordPress plugin before 0.0.10's geolocation-based consent banner targeting.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Cookie Consent Project Wordpress
Products
Cookie Consent Wordpress
CVE-2026-16066

Welcart e-Commerce < 2.11.34 - Author+ Stored XSS via Product Name

The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pages, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any visitor viewing the product page.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Welcart Wordpress
Products
Welcart E-commerce Wordpress
CVE-2026-16294

Blubrry PowerPress < 11.17.1 - Contributor+ Server-Side Request Forgery via Podcast Episode Chapters URL

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.1 does not validate one of its Podcast Episode URL settings before performing a server-side request with it, allowing users with a role as low as Contributor to perform Server-Side Request Forgery attacks that can target internal services.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Blubrry Wordpress
Products
Powerpress Podcasting Plugin By Blubrry Wordpress
CVE-2026-16737

WP Travel Engine < 6.8.5 - Unauthenticated Booking Details Disclosure and Modification via wte_add_trip_to_cart

The WP Travel Engine WordPress plugin before 6.8.5 does not perform authorization or ownership checks when loading a caller-supplied booking identifier in one of its unauthenticated cart actions, allowing unauthenticated attackers to disclose any customer's booking order details and their stored billing information, and to overwrite that customer's booking record with their own data.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress Wptravelengine
Products
Wordpress Wp Travel Engine
CVE-2026-17013

WP Photo Album Plus < 9.2.07.002 - Reflected XSS via lbstart

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not sanitise and escape a parameter before reflecting it into an inline script block, which could allow unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone who is tricked into opening a crafted link to a page displaying one of its galleries.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress Wp Photo Album Plus Project
Products
Wordpress Wp Photo Album Plus
CVE-2026-18035

User Access Manager < 2.3.15 - Unauthenticated Restricted Content Disclosure via REST API

The User Access Manager WordPress plugin before 2.3.15 does not apply its access restrictions to REST API requests, allowing unauthenticated attackers to read the content of posts, pages and custom post types that have been restricted to specific user groups.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
User Access Manager Project Wordpress
Products
User Access Manager Wordpress
CVE-2026-18048

WP Photo Album Plus < 9.2.07.002 - Unauthenticated Arbitrary ZIP File Deletion via delmyzip Path Traversal

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not validate a client-controlled value used to build a file path in one of its public endpoint actions, and performs no authorisation check on it, allowing unauthenticated attackers to delete arbitrary ZIP archives on the server, including ones stored outside the web root.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Wordpress Wp Photo Album Plus Project
Products
Wordpress Wp Photo Album Plus
CVE-2026-18049

WP Photo Album Plus < 9.2.07.002 - Unauthenticated Option Disclosure via gettogo

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public endpoint actions and builds an option name from a client-supplied value without restricting it to its own options, allowing unauthenticated users to read the value of other autoloaded options whose names end in a matching suffix.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Wordpress Wp Photo Album Plus Project
Products
Wordpress Wp Photo Album Plus
CVE-2026-18057

Events Manager < 7.4.1 - Subscriber+ Booking Consent Record Tampering via SQL Injection

The Events Manager WordPress plugin before 7.4.1 does not sanitise and escape a user-controlled value before using it in a SQL statement, allowing users with a subscriber account and above to perform SQL injection attacks and tamper with booking consent records belonging to other people.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Events Manager Project Wordpress
Products
Events Manager Wordpress
CVE-2026-18230

WP Directory Kit < 1.5.6 - Subscriber+ SQL Injection via section Parameter

The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks an authorization check, allowing any authenticated user such as a Subscriber to perform SQL injection attacks.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpdirectorykit
Products
Wordpress Wp Directory Kit
CVE-2026-18366

Events Manager < 7.4.1 - Unauthenticated Privilege Escalation to Administrator

The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already made for unrelated privileged actions, which allows unauthenticated users to change the password of, escalate to Administrator, or delete any account whose user ID happens to match the ID of one of the Events Manager WordPress plugin before 7.4.1's own posts.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Events Manager Project Wordpress
Products
Events Manager Wordpress