Search
3,163 CVEs
CVEs (3,163, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 51–75 of 3,163 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↑ | Description |
|---|---|---|---|---|---|
| CVE-2026-15159 | MEDIUM | 4.3 | 2026-07-17 | The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.3.6 via the 'spreadsheet_expor… | |
| CVE-2026-15160 | MEDIUM | 4.3 | 2026-07-17 | The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3.6 via the 'spreadsheet_export_tmp_name' p… | |
| CVE-2026-15395 | HIGH | 7.2 | 2026-07-17 | The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'digitalSignature' Field Value in all versions u… | |
| CVE-2026-8616 | MEDIUM | 5.3 | 2026-07-17 | The Fense Proxy & VPN Blocker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce validation on the … | |
| CVE-2026-13352 | HIGH | 8.8 | 2026-07-17 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Arbitrary Fi… | |
| CVE-2026-13765 | HIGH | 7.5 | 2026-07-17 | The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and inc… | |
| CVE-2026-14503 | MEDIUM | 6.5 | 2026-07-17 | The pCloud WP Backup plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.3 via the wp2pcl_ajax_process_request_in… | |
| CVE-2026-15161 | MEDIUM | 6.4 | 2026-07-17 | The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.3.6. This is due to the save_filter() A… | |
| CVE-2026-15349 | MEDIUM | 4.3 | 2026-07-17 | The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.17.6. … | |
| CVE-2026-15457 | MEDIUM | 4.9 | 2026-07-17 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.0.13 via t… | |
| CVE-2026-15759 | MEDIUM | 6.4 | 2026-07-17 | The ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'number' and 'grou… | |
| CVE-2026-21770 | MEDIUM | 6.5 | 2026-07-17 | HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a DLL hijacking vulnerability which could allow an attacker to modify or replace the application with malicious content. | |
| CVE-2026-41993 | MEDIUM | Patched | 4.4 | 2026-07-17 | Improper Access Control vulnerability in the Removable Media Validation function of TXOne Networks products allows a local attacker with administrator privileges to bypass … |
| CVE-2026-58317 | MEDIUM | 6.3 | 2026-07-17 | Unsigned to Signed Conversion Error (CWE-196) vulnerability exists in TTSSH2 plugin of Tera Term provided by TeraTerm Project. When Tera Term attempts to establish an SSH c… | |
| CVE-2026-60060 | MEDIUM | 6.3 | 2026-07-17 | Improper Handling of Length Parameter Inconsistency (CWE-130) vulnerability exists in TTSSH2 plugin of Tera Term provided by TeraTerm Project. When Tera Term attempts to es… | |
| CVE-2026-15094 | MEDIUM | 6.1 | 2026-07-17 | The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'check_in_date' parameter in all versions up to, and including, 2.3.2 due … | |
| CVE-2026-15982 | CRITICAL | 9.8 | 2026-07-17 | The Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and i… | |
| CVE-2019-25764 | NONE | — | 2026-07-17 | **UNSUPPORTED WHEN ASSIGNED** Exposed IOCTL with Insufficient Access Control in the ASUS AURA SYNC driver allows a local user to bypass the driver's verification and invok… | |
| CVE-2026-10525 | MEDIUM | Patched | 6.1 | 2026-07-17 | The NEX-Forms WordPress plugin before 9.2.3 does not sanitise and escape some submitted form data before storing it and outputting it back in the admin dashboard, leading … |
| CVE-2026-11575 | HIGH | Patched | 7.5 | 2026-07-17 | The PhonePe Payment Solutions WordPress plugin before 3.1.0 does not properly verify the authenticity of incoming payment callbacks: the secret used to validate the callbac… |
| CVE-2026-11961 | HIGH | Patched | 8.1 | 2026-07-17 | The User Registration & Membership WordPress plugin before 5.2.3 does not validate that the membership tier submitted during public registration is one of the tiers allowe… |
| CVE-2026-11966 | MEDIUM | Patched | 5.3 | 2026-07-17 | The User Registration & Membership WordPress plugin before 5.2.3 does not perform a capability check for unauthenticated callers on one of its membership payment actions a… |
| CVE-2026-12393 | MEDIUM | Patched | 5.4 | 2026-07-17 | The WPS Bookings for WooCommerce WordPress plugin before 3.11.7 does not verify that a booking order belongs to the requesting user before cancelling it, allowing any authe… |
| CVE-2026-13402 | MEDIUM | Patched | 5.3 | 2026-07-17 | The Royal Addons for Elementor WordPress plugin before 1.7.1063 does not check the post status of menu items or the templates they reference in one of its REST endpoints, … |
| CVE-2026-9810 | CRITICAL | Patched | 9.8 | 2026-07-17 | The AI Copilot WordPress plugin before 1.5.4 does not bind OAuth access tokens to a WordPress user, and accepts any valid token as an administrator session, allowing unaut… |