Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16,307

CVE-2026-1704

Appointment Booking Calendar <= 1.6.9.29 - Insecure Direct Object Reference to Authenticated (Staff+) Sensitive Information Exposure

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.9.29. This is due to the `get_item_permissions_check` method granting access to users with the `ssa_manage_appointments` capability without validating staff ownership of the requested appointment. This makes it possible for authenticated attackers, with custom-level access and above (users granted the ssa_manage_appointments capability, such as Team Members), to view appointment records belonging to other staff members and access sensitive customer personally identifiable information via the appointment ID parameter.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Croixhaug Wordpress
Products
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin Wordpress
CVE-2026-2888

Formidable Forms <= 6.28 - Unauthenticated Payment Amount Manipulation via 'item_meta' Parameter

The Formidable Forms plugin for WordPress is vulnerable to an authorization bypass through user-controlled key in all versions up to, and including, 6.28. This is due to the `frm_strp_amount` AJAX handler (`update_intent_ajax`) overwriting the global `$_POST` data with attacker-controlled JSON input and then using those values to recalculate payment amounts via field shortcode resolution in `generate_false_entry()`. The handler relies on a nonce that is publicly exposed in the page's JavaScript (`frm_stripe_vars.nonce`), which provides CSRF protection but not authorization. This makes it possible for unauthenticated attackers to manipulate PaymentIntent amounts before payment completion on forms using dynamic pricing with field shortcodes, effectively paying a reduced amount for goods or services.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Strategy11team Wordpress
Products
Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder Wordpress
CVE-2026-2987

Simple Ajax Chat <= 20260217 - Unauthenticated Stored Cross-Site Scripting via 'c'

The Simple Ajax Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'c' parameter in versions up to, and including, 20260217 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Specialk Wordpress
Products
Simple Ajax Chat – Add A Fast, Secure Chat Box Wordpress
CVE-2026-3045

Appointment Booking Calendar <= 1.6.9.29 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Settings REST API Endpoint

The Appointment Booking Calendar — Simply Schedule Appointments plugin for WordPress is vulnerable to unauthorized access of sensitive data in all versions up to and including 1.6.9.29. This is due to two compounding weaknesses: (1) a non-user-bound `public_nonce` is exposed to unauthenticated users through the public `/wp-json/ssa/v1/embed-inner` REST endpoint, and (2) the `get_item()` method in `SSA_Settings_Api` relies on `nonce_permissions_check()` for authorization (which accepts the public nonce) but does not call `remove_unauthorized_settings_for_current_user()` to filter restricted fields. This makes it possible for unauthenticated attackers to access admin-only plugin settings including the administrator email, phone number, internal access tokens, notification configurations, and developer settings via the `/wp-json/ssa/v1/settings/{section}` endpoint. The exposure of appointment tokens also allows an attacker to modify or cancel appointments.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Croixhaug Wordpress
Products
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin Wordpress
CVE-2026-3657

My Sticky Bar <= 2.8.6 - Unauthenticated SQL Injection via 'stickymenu_contact_lead_form' Action

The My Sticky Bar plugin for WordPress is vulnerable to SQL injection via the `stickymenu_contact_lead_form` AJAX action in all versions up to, and including, 2.8.6. This is due to the handler using attacker-controlled POST parameter names directly as SQL column identifiers in `$wpdb->insert()`. While parameter values are sanitized with `esc_sql()` and `sanitize_text_field()`, the parameter keys are used as-is to build the column list in the INSERT statement. This makes it possible for unauthenticated attackers to inject SQL via crafted parameter names, enabling blind time-based data extraction from the database.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Premio Wordpress
Products
My Sticky Bar – Floating Notification Bar & Sticky Header (formerly Mystickymenu) Wordpress
CVE-2026-4063

Social Icons Widget & Block <= 4.5.8 - Missing Authorization to Authenticated (Subscriber+) Sharing Configuration Creation

The Social Icons Widget & Block by WPZOOM plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check in the add_menu_item() method hooked to admin_menu in all versions up to, and including, 4.5.8. This is due to the method performing wp_insert_post() and update_post_meta() calls to create a sharing configuration without verifying the current user has administrator-level capabilities. This makes it possible for authenticated attackers, with Subscriber-level access and above, to trigger the creation of a published wpzoom-sharing configuration post with default sharing button settings, which causes social sharing buttons to be automatically injected into all post content on the frontend via the the_content filter.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpzoom
Products
Wordpress Social Icons Widget & Block – Social Media Icons & Share Buttons
CVE-2026-3226

LearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Notification Triggering

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized email notification triggering due to missing capability checks on all 10 functions in the SendEmailAjax class in all versions up to, and including, 4.3.2.8. The AbstractAjax::catch_lp_ajax() dispatcher verifies a wp_rest nonce but performs no current_user_can() check before dispatching to handler functions. The wp_rest nonce is embedded in the frontend JavaScript for all authenticated users. This makes it possible for authenticated attackers, with Subscriber-level access and above, to trigger arbitrary email notifications to admins, instructors, and users, enabling email flooding, social engineering, and impersonation of admin decisions regarding instructor requests.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Thimpress Wordpress
Products
Learnpress – Wordpress Lms Plugin For Create And Sell Online Courses Wordpress
CVE-2026-32393

WordPress Greenly Theme Addons plugin < 8.2 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Creatives_Planet Greenly Theme Addons greenly-addons allows PHP Local File Inclusion.This issue affects Greenly Theme Addons: from n/a through < 8.2.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Creatives Planet Wordpress
Products
Greenly Theme Addons Wordpress
CVE-2026-32392

WordPress Greenly theme <= 8.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Creatives_Planet Greenly greenly allows PHP Local File Inclusion.This issue affects Greenly: from n/a through <= 8.1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Creatives Planet Wordpress
Products
Greenly Wordpress
CVE-2026-31917

WordPress WP ERP plugin <= 1.16.10 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs WP ERP erp allows SQL Injection.This issue affects WP ERP: from n/a through <= 1.16.10.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Wedevs Wordpress
Products
Wp Erp Wordpress
CVE-2026-32422

WordPress WP EasyCart plugin <= 5.8.13 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in levelfourdevelopment WP EasyCart wp-easycart allows Blind SQL Injection.This issue affects WP EasyCart: from n/a through <= 5.8.13.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Levelfourdevelopment Wordpress
Products
Wp-easycart Wordpress
CVE-2026-32411

WordPress Embed Calendly plugin <= 4.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Simpma Embed Calendly embed-calendly-scheduling allows Stored XSS.This issue affects Embed Calendly: from n/a through <= 4.4.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Simpma Wordpress
Products
Embed Calendly Wordpress
CVE-2026-32328

WordPress Lemmony theme < 1.7.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in shufflehound Lemmony lemmony allows Cross Site Request Forgery.This issue affects Lemmony: from n/a through < 1.7.1.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Shufflehound Wordpress
Products
Lemmony Wordpress
CVE-2026-32402

WordPress Image Slider by Ays plugin <= 2.7.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Ays Pro Image Slider by Ays ays-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Slider by Ays: from n/a through <= 2.7.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ays-pro Wordpress
Products
Image Slider Wordpress
CVE-2026-32351

WordPress PowerPress Podcasting plugin <= 11.15.13 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in blubrry PowerPress Podcasting powerpress allows Stored XSS.This issue affects PowerPress Podcasting: from n/a through <= 11.15.13.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Blubrry Wordpress
Products
Powerpress Podcasting Wordpress
CVE-2026-32430

WordPress PowerPack Addons for Elementor plugin <= 2.9.9 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Stored XSS.This issue affects PowerPack Addons for Elementor: from n/a through <= 2.9.9.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Ideabox Wordpress
Products
Powerpack Addons For Elementor Wordpress
CVE-2026-32355

WordPress JetEngine plugin < 3.8.4.1 - Deserialization of untrusted data vulnerability

Deserialization of Untrusted Data vulnerability in Crocoblock JetEngine jet-engine allows Object Injection.This issue affects JetEngine: from n/a through < 3.8.4.1.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Crocoblock Wordpress
Products
Jetengine Wordpress
CVE-2026-32350

WordPress Chocolate House theme <= 1.1.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in wpradiant Chocolate House chocolate-house allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Chocolate House: from n/a through <= 1.1.5.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpradiant
Products
Wordpress Chocolate House
CVE-2026-32338

WordPress Construction Landing Page theme <= 1.4.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in raratheme Construction Landing Page construction-landing-page allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Construction Landing Page: from n/a through <= 1.4.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Rarathemes Wordpress
Products
Construction Landing Page Wordpress
CVE-2026-32431

WordPress Astra Bulk Edit plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Astra Bulk Edit astra-bulk-edit allows DOM-Based XSS.This issue affects Astra Bulk Edit: from n/a through <= 1.2.10.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Brainstorm Force Wordpress
Products
Astra Bulk Edit Wordpress