Export limit exceeded: 16869 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (16869 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-109994 | 2 Arraytics, Wordpress-extensions | 2 Eventin, Eventin | 2026-11-12 | 6.5 Medium |
| The Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.1.29 via the 'id' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the email address and phone number of any WordPress user, including administrators, by supplying their user id in a query-string parameter while placing the authenticated user's own id in the URL path. | ||||
| CVE-2026-120659 | 2 Themeisle, Wordpress-extensions | 2 Redirection For Contact Form 7, Redirection For Contact Form 7 | 2026-11-12 | 5.3 Medium |
| The Redirection for Contact Form 7 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to write arbitrary post meta values to newly created lead posts and copy arbitrary server-side files with allowed MIME-type extensions into the plugin's uploads directory. Exploitation requires a published Contact Form 7 form configured with the Save Entry (Save Lead) action enabled on the target site. | ||||
| CVE-2026-115431 | 2 Wordpress-extensions, Wp Swings | 2 Upsell Order Bump Offer For Woocommerce, Upsell Order Bump Offer For Woocommerce | 2026-11-12 | 7.1 High |
| Missing Authorization vulnerability in WP Swings Upsell Order Bump Offer for WooCommerce upsell-order-bump-offer-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Upsell Order Bump Offer for WooCommerce: from n/a through 3.1.6. | ||||
| CVE-2026-120851 | 2 Publishpress, Wordpress-extensions | 2 Publishpress Revisions, Publishpress Revisions | 2026-11-12 | 4.3 Medium |
| Missing Authorization vulnerability in PublishPress PublishPress Revisions revisionary allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PublishPress Revisions: from n/a through 4.2.0. | ||||
| CVE-2026-27356 | 2 Ibericode, Wordpress-extensions | 2 Mc4wp, Mc4wp | 2026-11-12 | 5.3 Medium |
| Missing Authorization vulnerability in ibericode MC4WP mailchimp-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MC4WP: from n/a through 4.14.1. | ||||
| CVE-2026-120737 | 2 Artbees, Wordpress-extensions | 2 Jupiter X Core, Jupiter X Core | 2026-11-12 | 5.9 Medium |
| The Jupiter X Core plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.62.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to enumerate and render arbitrary published post types not intended for public listing — including Flamingo CF7 submission records containing submitter names, email addresses, phone numbers, full messages, and IP addresses — and perform meta_query boolean-oracle reads against the postmeta of any published post. Exploitation requires that a Posts or Advanced Posts widget on the site has 'Is Archive Template' enabled, which is the standard Jupiter X archive-template configuration used by most Jupiter X sites; additionally, the nonce verified by the second endpoint is minted via wp_create_nonce and printed on every frontend page as ravenTools.nonce, rendering it ineffective as an authorization barrier. | ||||
| CVE-2026-120555 | 2 Artbees, Wordpress-extensions | 2 Jupiter X Core, Jupiter X Core | 2026-11-12 | 5.3 Medium |
| The Jupiter X Core plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.62.0 via the 'file' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The path confinement check introduced in the CVE-2023-3813 fix (strpos + realpath) is present and working, so reads are confined to wp-content/uploads/ and cannot reach wp-config.php or other files outside that directory. | ||||
| CVE-2026-124496 | 1 Apache | 1 Storm | 2026-11-12 | N/A |
| The DRPC HTTP endpoint lets an authenticated client act as another user without applying the configured impersonation authorizer. An authenticated user can execute DRPC functions that are restricted to another user. Users are recommended to upgrade to version 3.2.0, which fixes the issue. | ||||
| CVE-2026-118137 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-12 | 7.8 High |
| Improper authorization in Windows FTP Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-121492 | 1 Wordpress-extensions | 1 Fiber Admin | 2026-11-12 | 5.3 Medium |
| The Fiber Admin WordPress plugin before 4.0.1 does not have authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the order of arbitrary posts, including drafts, private posts and navigation menu items, as well as the order of taxonomy terms when term ordering is enabled. | ||||
| CVE-2026-121778 | 2 Wordpress-extensions, Wp Lab | 2 Wp-lister Lite For Amazon, Wp Lister Lite For Amazon | 2026-11-12 | 5.3 Medium |
| Missing Authorization vulnerability in WP Lab WP-Lister Lite for Amazon wp-lister-for-amazon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-Lister Lite for Amazon: from n/a through 2.9.2. | ||||
| CVE-2026-121767 | 2 Wedevs, Wordpress-extensions | 2 Wedocs, Wedocs | 2026-11-12 | 5.3 Medium |
| Missing Authorization vulnerability in weDevs weDocs wedocs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects weDocs: from n/a through 2.6.1. | ||||
| CVE-2026-124274 | 2 Mycred, Wordpress-extensions | 2 Mycred, Mycred | 2026-11-12 | 5.3 Medium |
| Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2. | ||||
| CVE-2026-120849 | 2 Wclovers, Wordpress-extensions | 2 Wcfm Marketplace, Wcfm Marketplace | 2026-11-12 | 4.3 Medium |
| Missing Authorization vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketplace allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Marketplace: from n/a through 3.8.3. | ||||
| CVE-2026-119467 | 2 Wordpress-extensions, Wpvibes | 2 Anywhere Elementor, Anywhere Elementor | 2026-11-12 | 5.4 Medium |
| Missing Authorization vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AnyWhere Elementor: from n/a through 1.3.0. | ||||
| CVE-2026-61990 | 2 Wclovers, Wordpress-extensions | 2 Wcfm Membership, Wcfm Membership | 2026-11-12 | 4.3 Medium |
| Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Membership: from n/a through 2.12.0. | ||||
| CVE-2026-125378 | 1 Powerdns-admin | 1 Powerdns-admin | 2026-11-12 | 4.3 Medium |
| PowerDNS-Admin before 2026.11.0 contains a missing authorization vulnerability in the apply_records handler for /admin/template/<template>/apply that lets any authenticated User-role account modify shared zone templates. Attackers can replace a template's record set by name, injecting attacker-chosen NS, MX, A or CNAME records into every zone later created from it. | ||||
| CVE-2026-105986 | 1 Konghq | 2 Kong Ai Gateway, Kong Gateway Enterprise | 2026-11-12 | N/A |
| Incorrect authorization in the Admin API RBAC of Kong Gateway Enterprise allows a delegated administrator to elevate privileges via a percent-encoded role name or a self-assigned role. | ||||
| CVE-2026-123657 | 1 Wordpress-extensions | 1 Profilepress | 2026-11-12 | 5.3 Medium |
| The ProfilePress WordPress plugin before 4.17.6 does not reject negative membership plan identifiers before checking whether a plan is active, allowing unauthenticated visitors to sign up for membership plans an administrator has deactivated and receive the role attached to them. | ||||
| CVE-2026-123661 | 1 Wordpress-extensions | 1 Profilepress | 2026-11-12 | 4.3 Medium |
| The ProfilePress WordPress plugin before 4.17.4 does not check that a membership plan is still active when checkout is used to change an existing subscription, allowing subscribers holding any subscription of their own to subscribe to plans the site owner has deactivated, including free plans that grant a user role. | ||||