CVE-database
126.505 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-110227 MEDIUM · 5.3 Missing Authorization vulnerability in 10up Restricted Site Access restricted-site-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restricted Site Access: from n/a through…
- CVE-2026-109901 HIGH · 8.5 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Codepeople CP Multi View Event Calendar cp-multi-view-calendar allows SQL Injection.This issue…
- CVE-2026-107757 MEDIUM · 4.9 The Gallery Custom Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name (profile.php) + comment (wp-comments-post.php)' parameter in all versions up…
- CVE-2026-107756 MEDIUM · 6.4 The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name + comment' parameter in all versions up to, and including,…
- CVE-2026-107754 MEDIUM · 6.4 The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_images (file_info[2] =…
- CVE-2026-107751 HIGH · 7.2 De Mang Board-plug-in voor WordPress is kwetsbaar voor Stored Cross-Site Scripting via de parameter 'user_name' in alle versies tot en met 2.4.3 vanwege onvoldoende ontsmetting…
- CVE-2026-107650 MEDIUM · 6.4 The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_title' parameter in…
- CVE-2026-107631 HIGH · 7.2 The Record of Consent Extension for Complianz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'uid' parameter in all versions up to,…
- CVE-2026-107171 NONE Een Hardcoded Cryptographic Key-kwetsbaarheid bestond in Trellix Agent 5.8.4 via mfecryptc.dll leidt tot Database Decryption door regelmatige gebruikers.
- CVE-2026-105107 HIGH · 7.6 Koha is vulnerable to SQL injection in the Most-circulated items report. The reports/cat_issues_top.pl script (sub calculate) concatenates the user-controlled Criteria, Filter, and Limit request parameters…
- CVE-2026-105106 HIGH · 8.8 Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts the jobid request parameter for op=cud-delete and passes…
- CVE-2026-104909 HIGH · 8.1 The Mang Board plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.4.3 via the '_type (e.g. foo_type)'…
- CVE-2026-104764 HIGH · 7.2 The Post Export Import with Media plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.17.1 via deserialization…
- CVE-2026-104761 MEDIUM · 6.4 The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 2.4.3 due…
- CVE-2026-104748 CRITICAL · 9.8 The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Privilege Escalation in all…
- CVE-2026-103907 MEDIUM · 6.5 The JNews - Jeg Elementor Kit plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on both the…
- CVE-2026-103380 MEDIUM · 4.3 De Appointment Booking Plugin – LatePoint | Calendar & Scheduling voor WordPress plugin voor WordPress is kwetsbaar voor blootstelling aan gevoelige informatie in alle versies…
- CVE-2026-103367 HIGH · 8.1 The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.0 via…
- CVE-2026-103366 HIGH · 7.5 De Appointment Booking Plugin – LatePoint | Calendar & Scheduling voor WordPress-plug-in voor WordPress is kwetsbaar voor Insecure Direct Object Reference in versies tot en…
- CVE-2026-100163 HIGH · 7.4 De Appointment Booking Plugin – LatePoint | Calendar & Scheduling voor WordPress plugin voor WordPress is kwetsbaar voor Authentication Bypass in versies tot en met…
- CVE-2025-9373 MEDIUM · 6.4 The PeproDev Branches Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.0.1 due to insufficient input…
- CVE-2026-96904 MEDIUM · 5.3 The AWP Classifieds WordPress plugin before 4.4.9 does not verify that a request is authorised to view a listing when a payment transaction is referenced,…
- CVE-2026-96900 MEDIUM · 5.3 The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.1.4 does not verify ownership of the email address used to select an abandoned-cart record before…
- CVE-2026-94360 MEDIUM · 5.3 The Paymentfor Gateway for WooCommerce WordPress plugin before 1.0.6 does not verify the authenticity of an inbound payment notification before marking an order as paid,…
- CVE-2026-94261 MEDIUM · 5.3 De Sifalo Pay WordPress-plugin vóór versie 2.5.3 controleert niet of een betalingstransactie-ID daadwerkelijk bij de te bevestigen bestelling hoort, noch of de aanvrager de eigenaar…
- CVE-2026-94260 MEDIUM · 5.3 The Sifalo Pay WordPress plugin before 2.5.3 does not verify ownership of, or authorisation for, the order being updated when it handles a payment return,…
- CVE-2026-94254 NONE The SellKit WordPress plugin before 2.8.0 does not validate a client-supplied product price when totals are recalculated during checkout, allowing unauthenticated attackers to place orders…
- CVE-2026-92426 NONE The YITH WooCommerce Popup WordPress plugin before 1.60.0 does not check the capability of the requesting user before deleting post meta, allowing users with the…
- CVE-2026-92409 NONE The Donation Thermometer WordPress plugin before 2.3.0 does not escape a colour value taken from a shortcode attribute before using it in an attribute of…
- CVE-2026-91076 NONE De Robokassa-betaalgateway voor WooCommerce WordPress-plugin vóór versie 1.9.0 controleert de authenticiteit van een binnenkomend betalingsverzoek niet voordat de betreffende bestelling wordt verwerkt. Hierdoor kunnen niet-geauthenticeerde…
- CVE-2026-90989 NONE The Tainacan WordPress plugin before 1.4.0 does not restrict its reports REST endpoints to users with a management capability, allowing any authenticated subscriber to read…
- CVE-2026-89310 CRITICAL · 9.9 A parameter taken from the request body is inserted into a T-SQL statement without parameterization or escaping, allowing a remote attacker to execute arbitrary SQL…
- CVE-2026-89288 NONE The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST…
- CVE-2026-88927 MEDIUM · 4.3 The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.14 does not verify that a user owns or may write to the album an…
- CVE-2026-87974 MEDIUM · 5.3 The Asaas Gateway for WooCommerce WordPress plugin before 2.7.8 does not properly authenticate its payment webhook, accepting an empty access token in its default configuration…
- CVE-2026-87968 MEDIUM · 5.3 The Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin before 5.3.2 does not perform a nonce or capability…
- CVE-2026-87843 MEDIUM · 6.5 The Trust Payments Gateway for WooCommerce WordPress plugin before 3.1.0 does not verify the authenticity of the payment provider's response when a customer returns from…
- CVE-2026-86799 HIGH · 8.8 The Forms WordPress plugin before 3.0.2 does not sanitise submitted form values on storage, nor escape them before outputting them on the form submissions screen…
- CVE-2026-86797 MEDIUM · 6.8 The Pricing Table WordPress plugin before 2.1.5 does not validate the scheme of a user-supplied link value in one of its blocks before rendering it,…
- CVE-2026-86787 HIGH · 7.2 The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled templating engine compiles and executes…
- CVE-2026-85345 MEDIUM · 4.1 The FV Flowplayer Video Player WordPress plugin before 7.5.55.7212 does not properly validate a user-supplied URL before performing a server-side fetch, and an existing host-based…
- CVE-2026-85000 MEDIUM · 5.3 The EmbedPress WordPress plugin before 4.6.8 does not perform any capability or nonce check on an unauthenticated request that triggers a server-side, credential-bearing request to…
- CVE-2026-110467 MEDIUM · 4.3 Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify a specific parameter to view the peer review scores…
- CVE-2026-110466 MEDIUM · 4.3 Tronclass developed by WisdomGarden has a Sensitive Data Exposure vulnerability. Authenticated remote attackers can bypass anonymous grading restrictions and obtain anonymous student information.
- CVE-2026-110465 MEDIUM · 4.3 Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify a specific parameter to alter the peer review scores…
- CVE-2026-108069 MEDIUM · 5.3 The Sunshine Photo Cart WordPress plugin before 3.7.4 does not check whether a visitor is permitted to access a restricted gallery before accepting comment submissions…
- CVE-2026-108066 NONE The WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capability check before removing a user's two-factor authentication configuration, allowing a site administrator…
- CVE-2026-108064 MEDIUM · 6.5 De WP Encryption WordPress-plugin vóór versie 7.8.8.2 voert geen controle uit op de mogelijkheden of nonce van een van de handlers die de SSL-certificaatverstrekkingsroutine aanstuurt.…
- CVE-2026-107594 CRITICAL · 10.0 The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the…
- CVE-2026-107508 HIGH · 8.6 The Ultimate Multisite WordPress plugin before 2.17.2 does not validate a user-supplied value used to select a file to include, allowing unauthenticated attackers to include…