Search vulnerabilities

Expected end of text, found ':' (at char 27), (line:1, col:28)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,536

CVE-2026-120683

Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via Testimonial Submission Form 'tpro_client_testimonial' Parameter

The Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tpro_client_testimonial' parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires an administrator to approve the pending testimonial through standard moderation and the target page to load the WordPress Interactivity runtime (e.g. a theme or block that enqueues @wordpress/interactivity).

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Shapedplugin Wordpress-extensions
Products
Real Testimonials Real Testimonials
CVE-2026-119075

Registration Form for WooCommerce <= 1.1.4 - Unauthenticated Privilege Escalation to 'user_roles' Parameter at Checkout

The Registration Form for WooCommerce plugin for WordPress is vulnerable to privilege escalation due to a missing allow-list check in the FormHandler::validate_checkout_fields() function in versions up to, and including, 1.1.4 The My Account registration path (validate_fields()) validates a submitted 'tgwcfb/user-roles' value against the form's configured allowed roles, but the checkout registration path (validate_checkout_fields(), hooked to woocommerce_after_checkout_validation) stores the raw $_POST['user_roles'] value in $this->valid_data without any allow-list enforcement, and add_user_data() then injects that value into woocommerce_new_customer_data as the new account's role. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator by supplying a user_roles=administrator parameter when creating an account during checkout, resulting in full site takeover.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Themegrill Wordpress-extensions
Products
Registration Form For Woocommerce Registration Form For Woocommerce
CVE-2026-120685

Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via JPEG IPTC Caption + '[gallery]' Shortcode Chain

The Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tpro_client_image (JPEG IPTC caption) + tpro_client_testimonial ([gallery] shortcode)' parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have the display block configured with the Strip All HTML Tags option disabled, which is the plugin's native setting for rendering formatted testimonial content, and to have approved the submitted testimonials.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Shapedplugin Wordpress-extensions
Products
Real Testimonials Real Testimonials
CVE-2026-105702

Multiple vulnerabilities that affects IBM Db2 Genius Hub

IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to obtain sensitive information due to exposure of error messages containing internal implementation details.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Agentics Db2 Genius Hub
CVE-2026-121976

Modula Image Gallery <= 3.0.17 - Authenticated (Author+) Stored Cross-Site Scripting via 'items' Parameter

The Modula plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'items' parameter in versions up to, and including, 3.0.17 This is due to insufficient input sanitization of the per-image 'link' field in the save_merged_items() REST handler and Images\Adapter::normalize_item_row(), which preserves unknown keys verbatim, combined with output escaping in Modula_Helper::generate_attributes() that applies only esc_attr() to the resulting anchor href and does not strip the 'javascript:' URL scheme. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page and clicks the gallery tile.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Wpchill
Products
Modula Image Gallery Modula Image Gallery
CVE-2026-123418

Church Admin <= 5.1.7 - Unauthenticated Stored Cross-Site Scripting via 'lat' Parameter

The Church Admin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lat' parameter in all versions up to, and including, 5.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when a Google Maps API key has been configured in Church Admin settings, as the vulnerable sink is only reached when that option is present.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Andymoyle Wordpress-extensions
Products
Church Admin Church Admin
CVE-2026-118050

Football Pool <= 2.13.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Shoutbox Message

The Football Pool plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shouttext' parameter in all versions up to, and including, 2.13.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected script only fires in the admin Edit view for a shout; the public Shoutbox widget and the admin list view both encode output via Football_Pool_Utils::xssafe(), making the admin Edit view the sole unescaped sink.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Antoineh Wordpress-extensions
Products
Football Pool Football Pool
CVE-2026-104014

Naimur Email OTP Verification for WooCommerce <= 2.1.0 - Unauthenticated Authentication Bypass to Account Takeover via Abandoned Password Reset Finalization

The Naimur Email OTP Verification for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.1.0. This is due to the plugin's password-reset finalization endpoint (the wp_ajax_nopriv_ceovw_update_new_password action handled by CEOVW_AJAX::update_new_password()) authorizing the reset solely by the presence of a database row marking an email as 'VERIFIED', with no timestamp check, no session binding, and no per-reset token — combined with mark_otp_as_verified_for_reset() leaving the row in that state after a user enters their code (abandoning the flow leaves the row behind), and a scheduled 'ceovw_cleanup_expired_otps_event' cron that has no add_action() handler anywhere in the plugin so cleanup never runs. This makes it possible for unauthenticated attackers to take over any account whose owner previously requested and verified a password-reset code and did not immediately finish choosing a new password — the attacker needs only the victim's email address and a nonce that the plugin itself localizes publicly into the CEOVW_APP global on the WooCommerce account page for logged-out visitors, after which they call the endpoint, overwrite the victim's password, and are returned a live wordpress_logged_in_ session cookie for that user (full site takeover if the account is an administrator).

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Naimurrahmannahid Wordpress-extensions
Products
Naimur Email Otp Verification For Woocommerce Naimur Email Otp Verification For Woocommerce
CVE-2026-120509

Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via 'tpro_client_name' Parameter

The Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tpro_client_name' parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires an administrator to publish the submitted testimonial, trigger the Show Preview AJAX handler, and save an Update, which canonicalizes and persists the attacker-controlled payload as the Manage View title — matching the plugin's standard moderation workflow. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Shapedplugin Wordpress-extensions
Products
Real Testimonials Real Testimonials
CVE-2026-109973

Flipbox <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'flip-box-image-upload-url-01-alt' Parameter

The Image Hover Effects Ultimate Visual Composer (Flipbox - Awesomes Flip Boxes Image Overlay) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'flip-box-image-upload-url-01-alt' parameter in versions up to, and including, 3.1.1. This is due to the plugin saving the image-alt field through sanitize_text_field() in Inc/Style22::register_child() (and Inc/Style18, 19, 20, 25, 29) — which preserves the double-quote character — and then concatenating the stored value into a double-quoted HTML attribute in Public_Render/Style22::default_render() (and the corresponding Style18/19/20/25/29 renderers) with no esc_attr() escaping. This makes it possible for authenticated attackers, with contributor-level access and above (when an administrator has delegated the plugin's 'Who can edit' capability via the plugin Settings page, or on multisite installations where even administrators lack unfiltered_html), to inject arbitrary web scripts in pages that will execute whenever a user accesses any page containing an affected [oxilab_flip_box] shortcode or block.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Oxilab Wordpress-extensions
Products
Flipbox Flipbox
CVE-2026-123462

WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mycred Wordpress-extensions
Products
Mycred Mycred
CVE-2026-122660

WordPress FloristPress plugin <= 7.8.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in BAKKBONE Australia FloristPress bakkbone-florist-companion allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FloristPress: from n/a through 7.8.5.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Bakkbone Australia Wordpress-extensions
Products
Floristpress Floristpress
CVE-2026-121777

WordPress Cool Formkit Lite plugin <= 2.7.10 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Cool Plugins Cool Formkit Lite extensions-for-elementor-form allows Code Injection.This issue affects Cool Formkit Lite: from n/a through 2.7.10.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Cool Plugins Wordpress-extensions
Products
Cool Formkit Lite Cool Formkit Lite
CVE-2026-120531

Subscribe2 – Form, Email Subscribers & Newsletters <= 10.47 - Unauthenticated Stored Cross-Site Scripting via 'data[ip]' Parameter

The Subscribe2 – Form, Email Subscribers & Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data[ip]’ parameter in all versions up to, and including, 10.47 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Wedevs Wordpress-extensions
Products
Subscribe2 Subscribe2
CVE-2026-19706

Openshift/installer: openshift installer: unconditional csr approval during agent-based installation (abi) bootstrap

During ABI bootstrap, the bootstrap node's approve-csr.service approves and signs every CSR without identity validation. An attacker on the install network can retrieve the unauthenticated Ignition file (ports 22623/22624), extract a limited kubeconfig, submit a CSR for CN=system:admin, receive the signed certificate, and gain full cluster-admin access. Exploitable only during the narrow bootstrap window.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Assisted Installer Assisted Installer For Red Hat Openshift Container Platform Multicluster Engine and 3 more
CVE-2026-121573

WordPress WP Activity Log plugin <= 5.6.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log wp-security-audit-log allows Stored XSS.This issue affects WP Activity Log: from n/a through 5.6.7.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Melapress Wordpress-extensions
Products
Wp Activity Log Wp Activity Log
CVE-2026-123806

python-tuf: Platform-dependent delegation path matching

python-tuf is a Python reference implementation of The Update Framework (TUF). Prior to 7.0.0, DelegatedRole._is_target_in_pathpattern in tuf/api/_payload.py uses fnmatch.fnmatch, which applies os.path.normcase before matching and makes delegation path authorization case-insensitive on Windows. When a TUF repository has path-based delegations that differ only by case and an attacker-controlled role is visited before the legitimate role, ngclient can accept an attacker-provided target from the wrong delegation for a requested path. Linux and macOS clients are not affected because their path normalization does not change case. This issue is fixed in 7.0.0.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed
Vendors
Theupdateframework
Products
Python-tuf
CVE-2026-125367

Pico through 4.1.2 SSRF in Feeds Service via run SSH Command

Pico through 4.1.2 contains a server-side request forgery vulnerability in the feeds service that allows signed-up users to make the server fetch arbitrary URLs via the run SSH command. Attackers can upload a feeds digest post listing internal URLs and trigger immediate fetching through Fetcher.ParseURL to reach loopback, RFC1918, and cloud metadata endpoints.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Picosh
Products
Pico
CVE-2026-104676

Zion Builder <= 3.6.17 - Author+ Stored XSS via SVG Upload

The Zion Builder WordPress plugin through 3.6.17 does not sanitize uploaded SVG files or validate their contents before storing them in a publicly accessible location and serving them from the site's own origin, allowing authenticated users with the Author role or above to upload a crafted SVG containing JavaScript that executes in the browser of anyone who opens the file.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Zion Builder