CVE-database
126.581 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-108566 LOW · 3.5 A vulnerability has been found in InstantSoft icms2 up to 2.18.2. This issue affects the function index of the file templates/default/controllers/messages/index.tpl.php of the component Private…
- CVE-2026-108544 MEDIUM · 6.3 A vulnerability was identified in Lippu Docx Reader Office Viewer App up to 1.4.5 on Android. This affects the function word.office.docxviewer.document.docx.reader.ViewTxt. Such manipulation of the…
- CVE-2026-108543 MEDIUM · 6.3 A vulnerability was determined in ag2ai ag2 up to 0.13.4. Affected by this issue is the function os.path.join of the component UserProxyAgent. This manipulation of…
- CVE-2026-108542 MEDIUM · 6.3 A vulnerability was found in 021is elvix-sdk up to 0.10.1. Affected by this vulnerability is an unknown functionality of the file src/mcp/index.ts of the component…
- CVE-2026-97183 MEDIUM · 4.3 The WP-Invoice WordPress plugin through 4.3.1 does not perform capability checks in several of its AJAX handlers, allowing any authenticated user, such as a Subscriber,…
- CVE-2026-96227 HIGH · 8.8 The Piotnet Forms WordPress plugin through 1.0.30 does not authenticate or validate a form-submission file-upload request and permits browser-renderable file types to be stored, allowing…
- CVE-2026-94235 MEDIUM · 4.3 The MemberHero WordPress plugin through 6.9 does not perform any capability or nonce check on one of its AJAX actions, allowing any authenticated user, such…
- CVE-2026-93550 MEDIUM · 4.3 The Veeqo for WooCommerce WordPress plugin through 2.2.8 does not restrict who can trigger its remote bridge-installation process or validate the URL it is given…
- CVE-2026-91829 HIGH · 7.1 The Subscribe to Comments WordPress plugin before 2.3.3 does not properly validate a parameter before reflecting it into a link target, allowing unauthenticated attackers to…
- CVE-2026-89305 MEDIUM · 6.5 The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing any authenticated user…
- CVE-2026-89304 MEDIUM · 6.5 The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to…
- CVE-2026-89302 HIGH · 8.6 The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated…
- CVE-2026-89299 HIGH · 8.6 The WP Verify API WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated…
- CVE-2026-89297 HIGH · 8.6 The Loja Automática WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users…
- CVE-2026-89287 HIGH · 8.6 The ASPL Product Quotation WordPress plugin through 1.1.0 does not sanitize and escape a parameter before using it in SQL statements, allowing unauthenticated attackers to…
- CVE-2026-89285 HIGH · 8.6 The Datalist it WordPress plugin through 0.0.3 does not sanitize and escape several request parameters before using them to build a SQL query, allowing unauthenticated…
- CVE-2026-89283 HIGH · 8.6 The WP Posts Password Batch Manager WordPress plugin through 1.1 does not perform any capability or nonce check on a bulk post-password action that runs…
- CVE-2026-89234 HIGH · 8.6 The WP-Partner WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append…
- CVE-2026-89232 HIGH · 8.6 The Recordbrowser WordPress plugin through 1.1.7 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append…
- CVE-2026-89214 HIGH · 8.6 De WpCues Basic Quiz WordPress-plug-in via 1.6.5 ontsmet en ontsnapt waarden niet goed voordat ze worden gebruikt in een SQL-instructie, waarmee niet-geverifieerde aanvallers SQL-injectieaanvallen kunnen…
- CVE-2026-89213 HIGH · 8.6 The Llavero.io WordPress plugin through 0.1.4 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers…
- CVE-2026-89195 HIGH · 8.6 The Site Setup Wizard WordPress plugin through 1.5.8 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows…
- CVE-2026-88930 HIGH · 8.6 The Social Web Suite WordPress plugin through 4.1.12 does not require its shared secret to be set before accepting requests authorised by it, and does…
- CVE-2026-88905 HIGH · 8.8 The KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check when saving its settings, and does not escape them before…
- CVE-2026-88903 HIGH · 8.8 The Topcontent WordPress plugin through 1.2.1 does not properly authorise one of its request handlers and disables HTML sanitisation before storing the submitted content, allowing…
- CVE-2026-88827 HIGH · 8.8 The Disable Users WordPress plugin through 1.0.5 does not enforce its account-disabling control on all authentication paths, allowing the holder of an account an administrator…
- CVE-2026-88826 HIGH · 8.8 The SmugMug Embed WordPress plugin through 3.13 does not have authorisation or CSRF checks on an AJAX action that stores gallery data, and does not…
- CVE-2026-88785 MEDIUM · 4.7 The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member's plaintext password in a URL query string when an optional…
- CVE-2026-87764 HIGH · 8.8 The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the sender of a chat message belongs to the conversation it is being…
- CVE-2026-87762 HIGH · 8.8 The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have authorisation checks on several state-changing operations, and the secret comparison it uses instead…
- CVE-2026-87761 HIGH · 8.0 The Adwised Web Push Notification WordPress plugin through 2.5.7 does not perform any capability or nonce check before allowing an authenticated user to overwrite its…
- CVE-2026-87760 HIGH · 8.8 The Web Vitals Tracking WordPress plugin through 5.4.2 does not validate or escape performance measurements submitted by unauthenticated visitors before storing them and outputting them…
- CVE-2026-86798 HIGH · 8.8 The HootBoard WordPress plugin through 3.1.4 does not perform any authorisation check on some of its REST endpoints, and does not escape the values stored…
- CVE-2026-86717 CRITICAL · 9.1 The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to delete arbitrary…
- CVE-2026-86706 CRITICAL · 9.1 The Quick quotes WordPress plugin through 1.0.0 does not perform any capability or nonce check on one of its AJAX actions and lets the caller…
- CVE-2026-85126 HIGH · 7.2 The Crowdfundly WordPress plugin through 2.2.2 does not have capability checks on some of its AJAX actions, allowing users holding one of its own low…
- CVE-2026-85121 CRITICAL · 9.1 The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to create and…
- CVE-2026-85118 CRITICAL · 9.8 The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capability check on some of its AJAX actions, allowing unauthenticated…
- CVE-2026-84737 CRITICAL · 9.8 The Freeton WP WordPress plugin through 1.0.0 does not correctly validate the activation code when authenticating a user, allowing unauthenticated attackers to log in as…
- CVE-2026-84734 CRITICAL · 9.8 The Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied in the request against the visitor's own session before authenticating…
- CVE-2026-84261 HIGH · 8.8 The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting…
- CVE-2026-84260 HIGH · 8.8 The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it…
- CVE-2026-84259 HIGH · 8.8 The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back…
- CVE-2026-84258 HIGH · 8.8 The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it…
- CVE-2026-84254 CRITICAL · 9.8 The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not have authorisation and CSRF checks when updating options via a REST…
- CVE-2026-84253 CRITICAL · 9.8 The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint,…
- CVE-2026-84252 CRITICAL · 9.8 The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and…
- CVE-2026-84251 CRITICAL · 9.8 The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when updating options via a REST endpoint,…
- CVE-2026-81649 CRITICAL · 9.1 The Fundiin cho WooCommerce WordPress plugin through 3.4.0 does not have proper authorisation on several of its REST API routes, relying instead on a credential…
- CVE-2026-81420 HIGH · 8.6 The Tcard WP WordPress plugin through 1.8.0 does not sanitise and escape a parameter before using it in a SQL statement in one of its…