CVE-database
126.581 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-12054 MEDIUM · 6.1 The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'REFERRER' parameter in all versions up to, and including, 3.3.57 due to…
- CVE-2026-107323 MEDIUM · 6.8 The Gallery PhotoBlocks WordPress plugin before 1.3.6 does not sanitize and escape one of its gallery settings before outputting it into an HTML attribute, allowing…
- CVE-2026-107321 MEDIUM · 5.4 De W3 Total Cache WordPress-plug-in vóór 2.10.6 beperkt een kopie van een media-importbestand niet tot de hoofdmap van het document en dwingt er ook geen…
- CVE-2026-107120 MEDIUM · 5.3 The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end registration email-verification step, which relies on a short…
- CVE-2026-105995 MEDIUM · 5.3 The Booking Package WordPress plugin before 1.7.30 does not perform authorization checks before returning stored reservation data, allowing unauthenticated users to disclose other customers' personal…
- CVE-2026-105990 MEDIUM · 5.3 The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization checks before exporting stored form submissions, allowing unauthenticated…
- CVE-2026-105989 MEDIUM · 5.3 The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization or request-validation checks on one of its AJAX…
- CVE-2026-105977 LOW · 2.2 The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform a per-object authorization check before deleting an attachment, allowing users with the Contributor role…
- CVE-2026-105976 MEDIUM · 4.7 The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform proper authorization checks in a set of AJAX actions, allowing users with at least…
- CVE-2026-104899 HIGH · 8.1 The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Local File Inclusion in all versions up to,…
- CVE-2026-104766 HIGH · 8.8 The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to,…
- CVE-2026-104763 MEDIUM · 4.9 The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.1 via the 'file_path'…
- CVE-2026-104762 MEDIUM · 6.4 The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Block Font Family Attribute in…
- CVE-2026-104754 LOW · 3.5 The Rank Math SEO WordPress plugin before 1.0.280 does not escape a stored redirection source value before outputting it in an administrative list view, allowing…
- CVE-2026-104753 MEDIUM · 4.1 The Rank Math SEO WordPress plugin before 1.0.280 does not properly sanitise and escape a parameter before using it in a SQL query, allowing high-privilege…
- CVE-2026-104752 HIGH · 7.2 The Rank Math SEO WordPress plugin before 1.0.280 does not correctly validate the type of a file uploaded through its settings import feature, allowing users…
- CVE-2026-104742 LOW · 3.1 The AI Puffer – Chat. Create. Automate. (formerly AI Power) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including,…
- CVE-2026-104741 LOW · 3.1 The AI Puffer – Chat. Create. Automate. (formerly AI Power) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including,…
- CVE-2026-104725 HIGH · 8.8 The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9 This…
- CVE-2026-104723 HIGH · 8.8 The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to,…
- CVE-2026-104023 MEDIUM · 4.9 The Smart Popup by Supsystic plugin for WordPress is vulnerable to generic SQL Injection via the 'sidx' parameter in all versions up to, and including,…
- CVE-2026-103912 MEDIUM · 4.7 The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the '
- CVE-2026-103520 MEDIUM · 6.4 De plug-in HivePress – Business Directory, Listings & Classified Ads Plugin voor WordPress is kwetsbaar voor Stored Cross-Site Scripting via de parameter 'custom text attribute…
- CVE-2026-103482 MEDIUM · 5.4 The Simple Newsletter Plugin – Noptin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'noptin_fields[] (e.g. first_name)' parameter in all versions up…
- CVE-2026-9696 MEDIUM · 6.4 De Download Manager-plug-in voor WordPress is kwetsbaar voor Stored Cross-Site Scripting via de parameter 'not_found' in alle versies tot en met 3.3.58 vanwege onvoldoende ontsmetting…
- CVE-2026-97670 CRITICAL · 9.1 The Avada (Fusion) Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16.1. This is due to the…
- CVE-2026-97630 MEDIUM · 6.4 The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Unquoted popup Shortcode Attribute in all versions up to, and…
- CVE-2026-96648 MEDIUM · 6.4 The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Cell 'data' Value via updateRows Action in all…
- CVE-2026-89301 HIGH · 7.5 The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to limited file deletion due to insufficient file path validation in the process…
- CVE-2026-87869 MEDIUM · 6.1 The Filter Everything — WordPress & WooCommerce Filters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.9.6. This…
- CVE-2026-6723 MEDIUM · 5.3 The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including,…
- CVE-2026-5727 MEDIUM · 5.4 The Hello Plus plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.7. This is due to the plugin…
- CVE-2026-104993 MEDIUM · 6.4 The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email (Contact Email…
- CVE-2026-104735 MEDIUM · 6.4 The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting…
- CVE-2026-104724 MEDIUM · 5.3 The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to generic SQL Injection via FireBox…
- CVE-2026-104021 HIGH · 7.2 The Fastcache by Host.it plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 1.7.4 via the `fastcache_settings[cache_cookie_exclude][]` parameter. This…
- CVE-2026-103998 MEDIUM · 6.1 The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'inputs…
- CVE-2026-103964 MEDIUM · 4.3 The Download Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.71 via the 'first_name' parameter. This…
- CVE-2026-103889 CRITICAL · 9.8 The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.16.2 via the…
- CVE-2026-103424 MEDIUM · 5.4 The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions…
- CVE-2026-102401 MEDIUM · 6.4 The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'regurl' parameter in all versions up to, and including, 3.3.71 due…
- CVE-2026-101324 MEDIUM · 4.7 The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'any…
- CVE-2026-96743 MEDIUM · 6.4 De invoegtoepassing voor tabelvelden voor ACF- en SCF-plug-in voor WordPress is kwetsbaar voor opgeslagen cross-site scripting via tabelveldwaarde in alle versies tot en met 1.4.1-RC2…
- CVE-2026-94589 CRITICAL · 9.8 The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up…
- CVE-2026-108501 MEDIUM · 5.7 ZTE Z80 Ultra has a system interface permission verification defect. The interface lacks necessary access control, and relevant information can be read by reflectively invoking…
- CVE-2026-107645 CRITICAL · 9.1 The Blocksy Companion plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.1.58 This is due to the implement_user_registration() AJAX…
- CVE-2026-104898 MEDIUM · 6.8 The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and…
- CVE-2026-104797 HIGH · 8.1 The Advanced Form Integration — Connect Forms to 300+ Apps plugin for WordPress is vulnerable to Authentication Bypass via Unverified Password Change in all versions…
- CVE-2026-104732 CRITICAL · 9.8 The Advanced IP Blocker plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 8.13.13 The vulnerability exists because `handle_login_action()`…
- CVE-2026-103365 MEDIUM · 5.3 The Bookly – Online Scheduling and Appointment Booking System plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 28.4…