Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16,307

CVE-2026-1890

LeadConnector < 3.0.22 - Unauthenticated Rest Call

The LeadConnector WordPress plugin before 3.0.22 does not have authorization in a REST route, allowing unauthenticated users to call it and overwrite existing data

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Leadconnector Wordpress
Products
Leadconnector Wordpress
CVE-2026-2626

Divi Booster < 5.0.2 - Unauthenticated PHP Object Injection

The divi-booster WordPress plugin before 5.0.2 does not have authorization and CSRF checks in one of its fixing function, allowing unauthenticated users to modify stored divi-booster WordPress plugin before 5.0.2 options. Furthermore, due to the use of unserialize() on the data, this could be further exploited when combined with a PHP gadget chain to achieve PHP Object Injection

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Divi-booster Wordpress
Products
Divi-booster Wordpress
CVE-2025-15488

Responsive Plus < 3.4.3 - Unauthenticated Arbitrary Shortcode Execution

The Responsive Plus WordPress plugin before 3.4.3 is vulnerable to arbitrary shortcode execution due to the software allowing unauthenticated users to execute the update_responsive_woo_free_shipping_left_shortcode AJAX action that does not properly validate the content_rech_data parameter before processing it as a shortcode.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Responsive Wordpress
Products
Responsive Menu Wordpress
CVE-2026-3881

Performance Monitor <= 1.0.6 - Unauthenticated Blind SSRF

The Performance Monitor WordPress plugin through 1.0.6 does not validate a parameter before making a request to it, which could allow unauthenticated users to perform SSRF attacks

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Performance Monitor Wordpress
Products
Performance Monitor Wordpress
CVE-2025-15484

Order Notification for WooCommerce < 3.6.3 - Unauthenticated WooCommerce REST Permission Bypass

The Order Notification for WooCommerce WordPress plugin before 3.6.3 overrides WooCommerce's permission checks to grant full access to all unauthenticated requests, enabling complete read/write access to store resources like products, coupons, and customers.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Order Notification For Woocommerce Wordpress
Products
Order Notification For Woocommerce Wordpress
CVE-2026-2696

Export All URLs < 5.1 - Unauthenticated Sensitive Data Exposure

The Export All URLs WordPress plugin before 5.1 generates CSV filenames containing posts URLS (including private posts) in a predictable pattern using a random 6-digit number. These files are stored in the publicly accessible wp-content/uploads/ directory. As a result, any unauthenticated user can brute-force the filenames to gain access to sensitive data contained within the exported files.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Export All Urls Wordpress
Products
Export All Urls Wordpress
CVE-2026-2631

Datalogics Ecommerce Delivery < 2.6.60 - Unauthenticated Privilege Escalation

The Datalogics Ecommerce Delivery WordPress plugin before 2.6.60 exposes an unauthenticated REST endpoint that allows any remote user to modify the option `datalogics_token` without verification. This token is subsequently used for authentication in a protected endpoint that allows users to perform arbitrary WordPress `update_option()` operations. Attackers can use this to enable registartion and to set the default role as Administrator.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Datalogics Ecommerce Delivery Wordpress
Products
Datalogics Ecommerce Delivery Wordpress
CVE-2026-3830

Product Filter for WooCommerce by WBW < 3.1.3 - Unauthenticated SQLi

The Product Filter for WooCommerce by WBW WordPress plugin before 3.1.3 does not sanitize and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Wbw Wordpress
Products
Product Filter For Woocommerce Wordpress
CVE-2025-15441

Form Maker < 1.15.38 - SQL Injection

The Form Maker by 10Web WordPress plugin before 1.15.38 does not properly prepare SQL queries when the "MySQL Mapping" feature is in use, which could make SQL Injection attacks possible in certain contexts.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
10web Wordpress
Products
Form Maker Wordpress
CVE-2026-4432

YITH WooCommerce Wishlist < 4.13.0 - Unauthenticated Arbitrary Wishlist Renaming via IDOR

The YITH WooCommerce Wishlist WordPress plugin before 4.13.0 does not properly validate wishlist ownership in the save_title() AJAX handler before allowing wishlist renaming operations. The function only checks for a valid nonce, which is publicly exposed in the page source of the /wishlist/ page, making it possible for unauthenticated attackers to rename any wishlist belonging to any user on the site.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress Yithemes
Products
Wordpress Yith Woocommerce Wishlist
CVE-2025-14545

YML for Yandex Market < 5.0.26 - Shop Manager+ RCE via Feed Generation

The YML for Yandex Market WordPress plugin before 5.0.26 is vulnerable to Remote Code Execution via the feed generation process.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Icopydoc Wordpress
Products
Yml For Yandex Market Wordpress
CVE-2026-1969

ThemeREX Addons < 2.38.5 - Unauthenticated Arbitrary File Upload

The trx_addons WordPress plugin before 2.38.5 does not correctly validate file types in one of its AJAX action, allowing unauthenticated users to upload arbitrary file. This is due to an incorrect fix of CVE-2024-13448

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Themerex Wordpress
Products
Addons Wordpress
CVE-2025-15445

Restaurant Cafeteria <= 0.4.6 - Subscriber+ Arbitrary Plugin Installation/Activation

The Restaurant Cafeteria WordPress theme through 0.4.6 exposes insecure admin-ajax actions without nonce or capability checks, allowing any logged-in user, like subscriber, to perform privileged operations. An attacker can install and activate a from a user-supplied URL, leading to arbitrary PHP code execution, and also import demo content that rewrites site configuration, including Restaurant Cafeteria WordPress theme through 0.4.6_mods, pages, menus, and front page settings.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Restaurant Cafeteria Wordpress
Products
Restaurant Cafeteria Wordpress
CVE-2026-2687

Reading progressbar < 1.3.1 - Admin+ Stored XSS

The Reading progressbar WordPress plugin before 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Reading Progressbar Wordpress
Products
Reading Progressbar Wordpress
CVE-2023-54358

WordPress adivaha Travel Plugin 2.3 Reflected XSS via isMobile

WordPress adivaha Travel Plugin 2.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating the isMobile parameter. Attackers can craft malicious URLs containing JavaScript payloads in the isMobile GET parameter at the /mobile-app/v3/ endpoint to execute arbitrary code in victims' browsers and steal session tokens or credentials.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Adivaha Wordpress
Products
Wordpress Adivaha Travel Plugin Wordpress
CVE-2026-34424

Smart Slider 3 Pro 3.5.1.35 Supply Chain Attack Remote Access Toolkit

Smart Slider 3 Pro version 3.5.1.35 for WordPress and Joomla contains a multi-stage remote access toolkit injected through a compromised update system that allows unauthenticated attackers to execute arbitrary code and commands. Attackers can trigger pre-authentication remote shell execution via HTTP headers, establish authenticated backdoors accepting arbitrary PHP code or OS commands, create hidden administrator accounts, exfiltrate credentials and access keys, and maintain persistence through multiple injection points including must-use plugins and core file modifications.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Nextendweb Wordpress
Products
Smart Slider 3 Wordpress
CVE-2023-54359

WordPress adivaha Travel Plugin 2.3 SQL Injection via pid

WordPress adivaha Travel Plugin 2.3 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'pid' GET parameter. Attackers can send requests to the /mobile-app/v3/ endpoint with crafted 'pid' values using XOR-based payloads to extract sensitive database information or cause denial of service.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Adivaha Wordpress
Products
Wordpress Adivaha Travel Plugin Wordpress
CVE-2024-54263

WordPress Spirit Framework plugin <= 1.2.13 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Talemy Spirit Framework allows PHP Local File Inclusion.This issue affects Spirit Framework: from n/a through 1.2.13.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2024-10777

AnyWhere Elementor <= 1.2.11 - Authenticated (Contributor+) Post Disclosure

The AnyWhere Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.11 via the 'INSERT_ELEMENTOR' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpvibes
Products
Wordpress Anywhere Elementor
CVE-2025-10874

Orbit Fox < 3.0.2 - Author+ Server-Side Request Forgery

The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.2 does not limit URLs which may be used for the stock photo import feature, allowing the user to specify arbitrary URLs. This leads to a server-side request forgery as the user may force the server to access any URL of their choosing.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress