Search vulnerabilities

Expected end of text, found ':' (at char 6), (line:1, col:7)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,120

CVE-2026-79615

Quiz And Survey Master < 11.2.4 - Contributor+ Cross-Quiz Question Bank and Answer Key Disclosure via IDOR

The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not check authorisation when returning question bank entries through one of its REST API routes, allowing users with a role as low as Contributor to read the questions, hints and correct answer keys of quizzes belonging to other users.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Quiz And Survey Master
CVE-2026-79706

Breeze Cache < 2.5.13 - Unauthenticated File Creation via Cache Path Traversal

The Breeze Cache WordPress plugin before 2.5.13 does not sanitise a value taken from the request before using it to build the paths of the files it caches, allowing unauthenticated attackers to create files at arbitrary locations on the server, outside the intended cache directory.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Breeze Cache
CVE-2026-16061

Rest Routes <= 5.5.5 - Unauthenticated SQLi via custom-tables/tables/{table_name}

The Rest Routes WordPress plugin through 5.5.5 does not sanitize and validate a value taken from the URL of one of its public REST routes before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Rest Routes
CVE-2026-16259

Uix UserCenter <= 1.0.3 - Unauthenticated Privilege Escalation

The Uix UserCenter WordPress plugin through 1.0.3 does not verify that the account being modified through an unauthenticated profile-update action belongs to the requester, and it authenticates that action with a token whose signing key is hardcoded and identical across every install, allowing unauthenticated attackers to forge a token for any user, overwrite an administrator's email and password, and take over the account.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Uix Usercenter
CVE-2026-16600

SmartAIPress <= 1.2.0 - Subscriber+ Server-Side Request Forgery via smartaipress_openai_upload_and_set_featured_image

The SmartAIPress WordPress plugin through 1.2.0 does not perform a capability check on one of its AJAX actions and does not validate a user-supplied URL before fetching it server-side, allowing users with subscriber-level access and above to make the site retrieve arbitrary internal or external URLs and read the response, resulting in a full-read Server-Side Request Forgery.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Smartapress
CVE-2026-17520

Newsletters < 4.17 - Unauthenticated API Access via Predictable API Key

The Newsletters WordPress plugin before 4.17 does not generate its API key using a sufficiently random source, deriving it from a publicly known value, allowing unauthenticated attackers to compute the key and perform privileged actions such as adding and deleting subscribers and sending emails, when the optional API has been enabled.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Newsletters
CVE-2026-17522

Newsletters < 4.17 - Arbitrary Plugin Option Update via CSRF

The Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when saving one of its settings screens, and writes every submitted parameter into its own options, allowing attackers to make a logged in administrator overwrite arbitrary Newsletters WordPress plugin before 4.17 settings, including the credential protecting its API, via a Cross-Site Request Forgery attack.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Newsletters
CVE-2026-19430

CatFolders Document Gallery Pro < 2.0.7 - Unauthenticated Missing Authorization via download-all

The Catfolders Document Gallery Pro WordPress plugin before 2.0.7 does not authorise some of its REST API routes, and the token identifying the requested content is forgeable client side, allowing unauthenticated users to list and download the contents of folders that were never published on the site.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Catfolders Document Gallery Pro
CVE-2026-76546

Profile Builder < 4.0.1 - Contributor+ Stored XSS via Format Date Shortcode

The User Profile Builder WordPress plugin before 4.0.1 does not escape the output of one of its optional shortcodes, allowing users with a role as low as contributor to perform Stored Cross-Site Scripting attacks against any user viewing the affected content, including administrators. The shortcode is not enabled by default.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Profile Builder
CVE-2026-76547

Profile Builder < 4.0.1 - Admin+ PHP Object Injection via Import/Export

The User Profile Builder WordPress plugin before 4.0.1 does not validate the type of data being deserialized when importing a configuration file, allowing high privilege users such as administrators to conduct PHP Object Injection. The affected feature is a free add-on which is disabled by default, and no POP chain is present in the User Profile Builder WordPress plugin before 4.0.1 itself, so further impact requires a suitable gadget from another installed User Profile Builder WordPress plugin before 4.0.1 or .

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Profile Builder
CVE-2026-76548

Profile Builder < 4.0.1 - Unauthenticated Unpublished Content and Media Modification via Front-End Upload Auth Bypass

The User Profile Builder WordPress plugin before 4.0.1 does not properly restrict its front-end file upload feature, granting unauthenticated visitors capabilities reserved to privileged roles. This allows them to list the site's media library and to modify unpublished posts, pages and media items belonging to other users.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
User Profile Builder
CVE-2026-76586

BookingPress 1.5.6 - 1.6.2 - Unauthenticated Booking Price Manipulation via PayPal Payment Confirmation

The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.6.3 does not verify the amount actually paid against the server-side price staged for a booking when confirming an online payment, allowing unauthenticated users to have a paid appointment approved for a fraction of its price.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Bookingpress
CVE-2026-77012

Icollect <= 1.0.0 - Unauthenticated Arbitrary File Read, SSRF and Path Traversal File Write via Default Publishing Password

The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not require a per-install secret for one of its unauthenticated endpoints, relying on a hardcoded default, and does not validate the URLs or destination paths it is given, allowing unauthenticated attackers to read arbitrary files from the server, force it to issue arbitrary requests and retrieve the responses, and write attacker-supplied content outside the uploads directory.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Iclecollect
CVE-2026-76585

Customer Reviews for WooCommerce < 5.118.0 - Unauthenticated Stored XSS via 'comment' Parameter

The Customer Reviews for WooCommerce WordPress plugin before 5.118.0 does not sanitise and escape the content of customer reviews received via one of its endpoints, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Customer Reviews For Woocommerce
CVE-2026-77013

Icollect <= 1.0.0 - Unauthenticated User and Term Creation via Unrestricted Method Dispatch

The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not restrict which of its handler methods a request may invoke, and performs no capability or nonce check on them, allowing unauthenticated users to create WordPress user accounts and taxonomy terms.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Icollect
CVE-2025-15663

BEAF < 4.7.19 - Author+ Stored XSS via After Label

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's after-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser of anyone (including an administrator) who views the slider.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Beaf
CVE-2025-15664

BEAF < 4.7.19 - Author+ Stored XSS via Before Label

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's before-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser of anyone (including an administrator) who views the slider.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Beaf
CVE-2026-12865

Photo Gallery by 10Web < 1.8.44 - Reflected XSS via title and paged Parameters

The Photo Gallery by 10Web WordPress plugin before 1.8.44 does not escape two request parameters before reflecting them into input-attribute values on its admin pages (one on the Shortcode page, one on the Galleries/Albums list page), so an unauthenticated attacker can craft a link that, when opened by a logged-in administrator (or, for the first sink, a contributor), executes arbitrary JavaScript in the victim's authenticated session via an auto-firing onfocus handler. The Galleries/Albums sink renders only when the site has more than 20 galleries/albums (the normal state of a populated install).

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Photo Gallery By 10web
CVE-2026-14215

Amelia < 2.4.9 - Unauthenticated Post-Booking Action Trigger

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not require authentication or a valid request token before running the post-booking action chain, allowing an unauthenticated user to trigger booking notifications and integration callbacks for a booking by enumerating its identifier.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Amelia
CVE-2026-15232

Appointment Booking Lite < 2.4.8 - Unauthenticated Arbitrary Reservation Deletion

The MotoPress Appointment Booking WordPress plugin before 2.4.8 does not perform an authorization or ownership check when handling a user-supplied booking identifier on an unauthenticated endpoint, allowing unauthenticated attackers to permanently delete other users' reservations. This is an incomplete fix of CVE-2026-9180: the deletion remains reachable on sites using payment confirmation, confirmed through version 2.4.7.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Appointment Booking Lite