Search vulnerabilities

Expected end of text, found ':' (at char 31), (line:1, col:32)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,758

CVE-2026-119491

WordPress Media LIbrary Assistant plugin <= 3.43 - Broken Access Control vulnerability

Missing Authorization vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Media LIbrary Assistant: from n/a through 3.43.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Davidlingren Wordpress-extensions
Products
Media Library Assistant Media Library Assistant
CVE-2026-120852

WordPress CartFlows plugin <= 3.3.0 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brainstorm Force CartFlows cartflows allows Code Injection.This issue affects CartFlows: from n/a through 3.3.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Brainstormforce Wordpress-extensions
Products
Cartflows Cartflows
CVE-2026-120853

WordPress CartFlows plugin <= 3.3.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Brainstorm Force CartFlows cartflows allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CartFlows: from n/a through 3.3.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Brainstormforce Wordpress-extensions
Products
Cartflows Cartflows
CVE-2026-122668

WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mycred Wordpress-extensions
Products
Mycred Mycred
CVE-2026-120514

Zephyr Project Manager <= 3.3.209 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'zpm_profile_picture' Parameter

The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'zpm_profile_picture' parameter in all versions up to, and including, 3.3.209 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is stored in the subscriber's own Zephyr profile and fires in any Administrator's browser session the first time the autocomplete mention lookup renders the avatar field, requiring no additional configuration beyond the plugin's default access_roles setting. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Dylanjkotze Wordpress-extensions
Products
Zephyr Project Manager Zephyr Project Manager
CVE-2026-120548

YML for Yandex Market <= 5.10.0 - Unauthenticated Sensitive Information Exposure through Log File via 'y4ym_check_action' Parameter via admin-post.php

The YML for Yandex Market plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.10.0 via the 'y4ym_check_action' parameter. This makes it possible for unauthenticated attackers to extract the merchant's plaintext Yandex Market API key written to the publicly accessible log file at wp-content/uploads/y4ym/yml-for-yandex-market.log, granting full control over the merchant's marketplace catalogue, prices, and stock. Exploitation requires that the targeted feed has a stored Yandex Market API key and that the y4ym_keeplogs option is enabled — both conditions that represent normal, documented plugin usage actively encouraged by the plugin's own support and feedback workflow.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Icopydoc Wordpress-extensions
Products
Yml For Yandex Market Yml For Yandex Market
CVE-2026-118784

WPSpeed <= 2.6.10 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Nickname/Display Name

The WPSpeed plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.6.10 This is due to a combination of two issues in the LightImages HTML optimizer: (1) Dispatcher::runOptimize() decides whether the current request is the site's home page by comparing only the URL path from REQUEST_URI against the path of the home URL, so on a plain-permalinks install the author archive URL /?author=<ID> is treated as the home page and the LightImages optimizer runs on it; and (2) LightImages::optimize() calls html_entity_decode() across the entire serialized DOMDocument output under the default-enabled img_processing_entity_decode setting, converting any entity-encoded markup present as plain text in the page (including WordPress's rendered author title) into live HTML. This makes it possible for authenticated attackers, with Subscriber-level access and above, to store entity-encoded markup in their own nickname/display_name through the normal profile endpoint and have that markup rehydrated into executing script when any logged-out visitor loads their author archive.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
John-dagelmore Wordpress-extensions
Products
Wpspeed – Wordpress Speed, Cache & Performance Optimization (core Web Vitals, Pagespeed 100) Wpspeed
CVE-2026-103900

WPJAM Basic <= 7.1 - Unauthenticated Privilege Escalation to 'data[args][role]' Parameter

The WPJAM Basic plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 7.1 This is due to the WPJAM_User_Signup::signup() function unpacking attacker-supplied `data[args]` from the AJAX POST body and merging it via PHP array union into the payload passed to WPJAM_User::create(), whose internal whitelist (wpjam_pick) explicitly preserves the `role` key before it is handed to wp_insert_user(). The endpoint is registered as wp_ajax_nopriv_{provider}-signup with a nonce that is emitted on the public login page. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator by creating a new user with an attacker-chosen role, provided a social-login provider is registered and open registration is enabled.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Denishua Wordpress-extensions
Products
Wpjam Basic Wpjam Basic
CVE-2026-119465

WordPress Elementor Addon Elements plugin <= 1.15 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder allows Retrieve Embedded Sensitive Data.This issue affects Elementor Addon Elements: from n/a through 1.15.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Wpvibes
Products
Elementor Addon Elements Elementor Addon Elements
CVE-2026-119473

WordPress ProfilePress plugin <= 4.17.7 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in properfraction ProfilePress wp-user-avatar allows Code Injection.This issue affects ProfilePress: from n/a through 4.17.7.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Properfraction Wordpress-extensions
Products
Profilepress Profilepress
CVE-2026-119507

WordPress NotificationX plugin <= 3.3.6 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WPDeveloper NotificationX notificationx allows Code Injection.This issue affects NotificationX: from n/a through 3.3.6.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Wpdeveloper
Products
Notificationx Notificationx
CVE-2026-120850

WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Stored XSS.This issue affects Elementor Website Builder: from n/a through 4.3.5.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Elementor Wordpress-extensions
Products
Elementor Website Builder Elementor Website Builder
CVE-2026-119520

WordPress Spectra plugin <= 2.20.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Stored XSS.This issue affects Spectra: from n/a through 2.20.4.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Brainstormforce Wordpress-extensions
Products
Spectra Spectra
CVE-2026-120842

WordPress SureForms plugin <= 2.13.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureForms: from n/a through 2.13.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Brainstormforce Wordpress-extensions
Products
Sureforms Sureforms
CVE-2026-119500

WordPress Flash & HTML5 Video plugin <= 2.14.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Flash & HTML5 Video html5-video-player allows Stored XSS.This issue affects Flash & HTML5 Video: from n/a through 2.14.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Bplugins Wordpress-extensions
Products
Flash & Html5 Video Flash & Html5 Video
CVE-2026-119501

WordPress Element Pack Elementor Addons plugin <= 10.0.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 10.0.2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Bdthemes Wordpress-extensions
Products
Element Pack Elementor Addons Element Pack Elementor Addons
CVE-2026-120365

WordPress WP Customer Area plugin <= 8.4.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aguila Technologies WP Customer Area customer-area allows Stored XSS.This issue affects WP Customer Area: from n/a through 8.4.3.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Aguilatechnologies Wordpress-extensions
Products
Wp Customer Area Wp Customer Area
CVE-2026-119525

WordPress Dropshipping XML for WooCommerce plugin <= 1.7.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP Desk Dropshipping XML for WooCommerce dropshipping-xml-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dropshipping XML for WooCommerce: from n/a through 1.7.4.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Wp Desk
Products
Dropshipping Xml For Woocommerce Dropshipping Xml For Woocommerce
CVE-2026-120364

WordPress Vidplex plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Untapwp Vidplex vidplex allows Stored XSS.This issue affects Vidplex: from n/a through 1.0.3.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Untapwp Wordpress-extensions
Products
Vidplex Vidplex
CVE-2026-123148

WordPress IvyForms plugin <= 1.5.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in TMS IvyForms ivyforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IvyForms: from n/a through 1.5.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Tms Wordpress-extensions
Products
Ivyforms Ivyforms