Search vulnerabilities

Expected end of text, found ':' (at char 6), (line:1, col:7)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,857

CVE-2026-86602

WP Recipe Maker 10.3.0 - 10.8.1 - Subscriber+ Draft and Private Recipe Content Disclosure via wprm_shortcode_preview

The WP Recipe Maker WordPress plugin before 10.8.2 does not perform any capability check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the full content of unpublished recipes.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Wp Recipe Maker
CVE-2026-86603

WP Recipe Maker < 10.8.2 - Subscriber+ Non-Public List Title Disclosure via wprm_search_lists

The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to retrieve the IDs and titles of other users' unpublished lists.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Wp Recipe Maker
CVE-2026-86608

WP Recipe Maker 9.8.0 - 10.8.1 - Unauthenticated DoS via Unbounded User Meta Insertion

The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its REST routes, nor does it bound what that route stores, allowing unauthenticated users to write unlimited data into any user's metadata and to permanently prevent that account, including an administrator's, from loading.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Wp Recipe Maker
CVE-2026-86783

PostX < 5.0.41 - Unauthenticated Custom Field Key Disclosure via REST API

The Post Grid Gutenberg Blocks WordPress plugin before 5.0.41 does not perform an authorization or post-visibility check on a REST API route that returns the custom field keys of a given post, allowing unauthenticated users to disclose the custom field key names of arbitrary posts, including private, draft, pending, scheduled and password-protected posts.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Postx
CVE-2026-86842

Real3D Flipbook Lite < 5.4 - Author+ Content Deletion and Stored XSS via Global Settings Overwrite

The Real3D Flipbook WordPress plugin before 5.4 does not perform capability checks on several of its authenticated flipbook management actions, allowing users with Author-level access and above to delete other users' flipbook content and overwrite administrator-only global settings, which can be leveraged to store JavaScript that executes in the context of any visitor or administrator viewing the site.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Real3d Flipbook Lite
CVE-2026-87069

Forminator Forms < 1.57.2.1 - Subscriber+ Form Stripe Field Migration via migrate_stripe

The Forminator Forms WordPress plugin before 1.57.2.1 does not perform a nonce, capability or ownership check before running a one-time payment-field migration during the construction of one of its admin screens, and that construction happens on every wp-admin request for any logged-in user. Any authenticated user, including a Subscriber with no permissions in the Forminator Forms WordPress plugin before 1.57.2.1, can therefore rewrite the saved field configuration of any form on the site, including a live payment form.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Forminator Forms
CVE-2026-87074

Forminator Forms < 1.57.2.1 - Unauthenticated Arbitrary Recipient Email Sending with Attacker-Controlled Link

The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who created the draft, and takes both the recipient address and the link written into the message from the request, so unauthenticated visitors can make the site send a message from its own mail configuration to any address, carrying a link of their choosing inside the site's own template. The token that authorises the send is handed to the anonymous caller by the Forminator Forms WordPress plugin before 1.57.2.1 itself and can be replayed without limit.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Forminator Forms
CVE-2026-87979

Paymob for WooCommerce < 4.1.14 - Unauthenticated Saved Card Token Write to Any User via Webhook

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch of its payment webhook, allowing unauthenticated attackers to write a card-token record to any user's account and to enumerate registered accounts.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Paymob For Woocommerce
CVE-2026-87981

Paymob for WooCommerce < 4.1.14 - Contributor+ Payment Gateway Configuration Deletion and Modification via Multiple AJAX Actions

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not perform a capability check on several admin AJAX actions that manage its payment-gateway configuration, allowing users with contributor-level access to delete, wipe, or modify that configuration, including the stored payment credentials.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Paymob For Woocommerce
CVE-2026-88929

Sale Booster 7.0.0 - 7.5.1 - Unauthenticated Non-Public Product Disclosure

The Product Badge, Label, Countdown Timer for WooCommerce WordPress plugin before 7.5.2 does not check whether a product is published before returning its details to unauthenticated users, allowing them to read the title, description and price of draft, pending and private products.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Sale Booster
CVE-2026-88997

JSM Show Post Metadata < 4.9.1 - Contributor+ Stored XSS via Custom Field Meta Key

The JSM Show Post Metadata WordPress plugin before 4.9.1 does not properly escape a post meta key before outputting it into an inline event-handler attribute in an admin-facing meta box, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the session of a higher-privileged user who reviews the affected post.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Jsm Show Post Metadata
CVE-2026-89331

FluentBoards 1.95 - 2.0.15 - Unauthenticated Board Member Email Address Disclosure via Public Board Endpoints

The FluentBoards WordPress plugin before 2.1.0 does not properly restrict the member data returned by its public, token-shared board feature, allowing unauthenticated users to disclose the email addresses of a shared board's members, typically including administrators.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Fluentboards
CVE-2026-90951

Paid Member Subscriptions < 3.1.0 - Unauthenticated In-Flight Checkout State Deletion via pms_process_payment

The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not bind one of its unauthenticated payment actions to the requesting user, allowing someone who holds another member's in-flight payment identifier to delete that member's checkout state.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Paid Member Subscriptions
CVE-2026-90985

WPC Smart Compare for WooCommerce < 6.6.1 - Unauthenticated Password-Protected Product Description Disclosure via woosc_load

The WPC Smart Compare for WooCommerce WordPress plugin before 6.6.1 does not apply WordPress's post-password protection when returning product content through its comparison handler, allowing unauthenticated users to read the description of password-protected products.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Wpc Smart Compare For Woocommerce
CVE-2026-91024

Booking Manager < 2.1.21 - Author+ SQLi via ICS Import Feed UID (sync_gid)

The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL query, allowing authenticated users with Author-level access and above to perform SQL injection attacks by importing a feed they control.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Booking Manager
CVE-2026-91025

Booking Manager < 2.1.21 - Subscriber+ Arbitrary User Plugin Meta Modification via IDOR

The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's Booking Manager WordPress plugin before 2.1.21-specific settings targets the requesting user's own account, allowing any authenticated user with subscriber-level access and above to create or overwrite the Booking Manager WordPress plugin before 2.1.21's per-user settings on arbitrary users, including administrators.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Booking Manager
CVE-2026-91073

Subscribe Forms 1.4.1 - 1.6.2 - Author+ Stored XSS via Attention Effect Form Setting

The Subscribe Forms WordPress plugin before 1.6.3 does not sanitise and escape one of its form settings before outputting it in a page, allowing authenticated users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor who views a page embedding the form, including logged-out visitors and administrators.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Subscribe Forms
CVE-2026-91077

Event Booking Manager for WooCommerce 5.3.6 - 5.7.2 - Contributor+ Unpublished Event Disclosure via mpwem_load_event_list

The Event Booking Manager for WooCommerce WordPress plugin before 5.7.3 does not restrict its event listing query to events the requesting user is permitted to read, so users with contributor-level access and above can retrieve other authors' private, draft and trashed events, together with event detail the standard listing does not show them. This discloses private events and their content that WordPress withholds from users lacking the read_private_posts capability.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Event Booking Manager For Woocommerce
CVE-2026-93507

WC Fields Factory < 4.1.11 - Contributor+ Arbitrary Post Cloning and Private Content Disclosure

The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action, allowing Contributor-level users and above to duplicate arbitrary posts of any type or status, including other users' private or draft content, and gain read access to the resulting copy.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Wc Fields Factory
CVE-2026-93508

WC Fields Factory < 4.1.11 - Subscriber+ Arbitrary Post Meta Manipulation via AJAX

The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-level access and above to create, modify and delete arbitrary post meta on any post, including WooCommerce products, regardless of ownership, and to manipulate stored pricing rules on a product to reduce its checkout price.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Wc Fields Factory