CVE-database
126.581 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-100147 HIGH · 7.2 The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shipping_first_name' parameter in all versions up…
- CVE-2026-97348 MEDIUM · 6.5 The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.74.3 via the get_instance_css function. This…
- CVE-2026-96840 HIGH · 7.2 De Post Grid Gutenberg Blocks – PostX-plug-in voor WordPress is kwetsbaar voor Stored Cross-Site Scripting via display_name User Field in alle versies tot en met…
- CVE-2026-96574 MEDIUM · 6.4 De User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction met Frontend Post Submission plugin voor WordPress is kwetsbaar voor Stored…
- CVE-2026-96572 HIGH · 7.2 De WP Meteor Website Speed Optimization Addon plugin voor WordPress is kwetsbaar voor Stored Cross-Site Scripting via Comment Author Name in alle versies tot en…
- CVE-2026-96558 HIGH · 7.2 De plug-in Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker voor WordPress is kwetsbaar voor Stored DOM-Based Cross-Site Scripting via de parameter…
- CVE-2026-95684 HIGH · 7.2 The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'attachments[name]' Parameter in all versions up to, and…
- CVE-2026-94538 HIGH · 8.1 The WP File Download plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.3.9. This is due to the…
- CVE-2026-89100 MEDIUM · 6.1 The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via '#response' URL Fragment in all versions up to, and…
- CVE-2026-6243 MEDIUM · 6.4 The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kses bypass / mutation XSS in all versions up to,…
- CVE-2026-5725 MEDIUM · 6.1 The Favicon Rotator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'fvrt_' prefixed request parameters in all versions up to, and including,…
- CVE-2026-3717 MEDIUM · 5.3 The CV Builder – Professional Resume Builder SaaS plugin for WordPress is vulnerable to unauthorized arbitrary file upload due to a missing capability check on…
- CVE-2026-15178 MEDIUM · 5.4 The Fluent Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.2.5. This is due to the plugin…
- CVE-2026-12626 HIGH · 7.2 The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including,…
- CVE-2026-108503 LOW · 3.3 ZTE Z80 Ultra has an interface permission validation vulnerability. The callable functions provided by the system lack sufficient access control. An attacker can leverage these…
- CVE-2026-108502 LOW · 3.3 ZTE Z80 Ultra contains an information disclosure vulnerability, through which third-party applications can read relevant information by hooking system APIs.
- CVE-2026-107742 HIGH · 7.2 The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' parameter…
- CVE-2026-107712 MEDIUM · 6.5 The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the 'current_month' parameter in all versions up to,…
- CVE-2026-104801 CRITICAL · 9.1 The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation…
- CVE-2026-104006 LOW · 3.7 The SpeedyCache – Cache, Optimization, Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.2 via the…
- CVE-2026-103897 MEDIUM · 4.4 The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including,…
- CVE-2026-103427 MEDIUM · 6.4 The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'country' parameter in all versions up to, and including, 4.8.4 due…
- CVE-2026-102402 MEDIUM · 6.4 The Team – Team Members Showcase Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ttp_filter_taxonomy (meta of the attacker-chosen post)' parameter…
- CVE-2026-100196 HIGH · 7.2 The LazyLoad Plugin – Lazy Load Images, Videos, and Iframes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment_content (rendered inline into…
- CVE-2026-100161 HIGH · 7.2 The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'wcpr_image_upload_id' parameter in all versions up to, and…
- CVE-2026-97643 MEDIUM · 6.4 The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `givewp_campaign_grid` shortcode in versions up…
- CVE-2026-96682 HIGH · 7.2 De Presto Player-plug-in voor WordPress is kwetsbaar voor Stored Cross-Site Scripting via Comment Content via Tag in alle versies tot en met 4.5.1 vanwege onvoldoende…
- CVE-2026-96667 HIGH · 7.2 De Real Estate Manager – Property Listing en Agent Management-plug-in voor WordPress is kwetsbaar voor Stored Cross-Site Scripting via de 'first_name' -parameter in alle versies…
- CVE-2026-94421 MEDIUM · 6.4 The Church Admin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, and including, 5.1.2 due…
- CVE-2026-94375 MEDIUM · 5.3 The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8…
- CVE-2026-94257 HIGH · 8.1 The SMS Alert WordPress plugin before 4.0.3 does not bind the account whose password is being changed to the phone number that was actually verified…
- CVE-2026-94256 HIGH · 8.1 The SMS Alert WordPress plugin before 4.0.1 does not verify that the account being logged in is the one the verified one-time code belongs to,…
- CVE-2026-93775 HIGH · 7.2 The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Auphonic Webhook in all versions up to, and including, 4.5.6 due…
- CVE-2026-92975 HIGH · 8.1 The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.3 via…
- CVE-2026-91862 MEDIUM · 6.4 The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-image-points' parameter in all versions up to, and including,…
- CVE-2026-91050 MEDIUM · 4.3 The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference / Missing Authorization…
- CVE-2026-87781 HIGH · 8.6 The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape a parameter before using it in a SQL statement, leading to a…
- CVE-2026-87780 HIGH · 8.8 The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape values submitted through an unauthenticated endpoint before storing them and outputting them…
- CVE-2026-85571 MEDIUM · 6.5 The Tutor LMS WordPress plugin before 4.1.1 does not verify that the posts named in its course content ordering requests belong to a course the…
- CVE-2026-83526 HIGH · 8.8 The FV Player 8 plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.1.7 via the check_mimetype function.…
- CVE-2026-78068 MEDIUM · 6.4 The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Cell Content in all versions up…
- CVE-2026-77183 HIGH · 8.8 The FooSales – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to,…
- CVE-2026-18558 MEDIUM · 6.4 The Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'embeddoc' shortcode…
- CVE-2026-18496 MEDIUM · 5.3 The Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.4.3 via the wpbc_is_show_popover_in_flex_timeline() function. This…
- CVE-2026-17025 MEDIUM · 6.4 The Graphene theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'Current location' and 'Author profile image URL' Profile Fields in all versions up…
- CVE-2026-16776 MEDIUM · 6.4 The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes…
- CVE-2026-14882 MEDIUM · 6.4 The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'brizy-compiled-sections' parameter in all versions up to, and including,…
- CVE-2026-14877 MEDIUM · 6.4 The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the id attribute in all versions up to, and…
- CVE-2026-14379 MEDIUM · 6.4 The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…
- CVE-2026-14335 HIGH · 7.2 The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PayPal IPN Parameters in…