Search
320 CVEs · published 2026-11-08 to 2026-11-08
CVEs (320)
Showing 176–200 of 320
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-97192 | LOW | Patched | 2.7 | 2026-11-08 | The Secure Custom Fields WordPress plugin before 6.9.8 does not re-apply its field-group location rules when persisting values submitted through the post editor save path, … |
| CVE-2026-96963 | LOW | 2.7 | 2026-11-08 | The Pie Register WordPress plugin through 3.8.4.15 does not perform an authorisation check in one of its AJAX actions, allowing users with a role as low as contributor to … | |
| CVE-2026-96961 | MEDIUM | 6.5 | 2026-11-08 | The Pie Register WordPress plugin through 3.8.4.15 does not perform any capability, nonce or authentication check on one of its request handlers, allowing unauthenticated … | |
| CVE-2026-85344 | MEDIUM | Patched | 4.3 | 2026-11-08 | The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not perform any authorization check on an AJAX action that carries out a site-wide content rewrite, … |
| CVE-2026-122085 | MEDIUM | Patched | 6.5 | 2026-11-08 | The Event Tickets Manager for WooCommerce WordPress plugin before 1.6.0 does not perform authorisation or a valid nonce check on its ticket-transfer feature, which is avail… |
| CVE-2026-122062 | MEDIUM | Patched | 5.3 | 2026-11-08 | The Pronamic Pay WordPress plugin before 11.1.0, Pronamic Pay doneren met Mollie WordPress plugin before 1.7.1 do not restrict access to stored form submissions through the… |
| CVE-2026-122060 | MEDIUM | Patched | 5.3 | 2026-11-08 | The WP Recipe Maker WordPress plugin before 10.9.2 does not check whether the post a recipe is embedded in is password protected before returning the recipe through its RES… |
| CVE-2026-114432 | CRITICAL | Patched | 9.8 | 2026-11-08 | The Contact Form 7 WordPress plugin before 6.2.4 does not validate the type or extension of files uploaded through a form file field, and a flaw in its temporary-file clean… |
| CVE-2026-110963 | CRITICAL | 9.8 | 2026-11-08 | The Userplace WordPress plugin through 1.2.0 does not perform authorization checks on an AJAX action available to unauthenticated users and publicly exposes the nonce that… | |
| CVE-2026-110132 | MEDIUM | Patched | 4.9 | 2026-11-08 | The Sync Post With Other Site WordPress plugin before 1.9.4 does not properly authorize a content-management action for post types other than pages, allowing users with Con… |
| CVE-2026-109925 | HIGH | Patched | 8.6 | 2026-11-08 | The Productive Commerce WordPress plugin before 1.1.54 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to p… |
| CVE-2026-106015 | HIGH | 8.1 | 2026-11-08 | The Ecommerce Affiliate WordPress plugin through 1.0.0 does not restrict one-time password issuance and verification to the legitimate account owner, nor limit verification… | |
| CVE-2026-105970 | MEDIUM | 5.3 | 2026-11-08 | The Thanh Toán Quét Mã QR Code Tự Động WordPress plugin through 2.0.1 does not properly verify the authenticity of incoming bank-transfer payment notifications on a defaul… | |
| CVE-2026-104639 | MEDIUM | Patched | 4.1 | 2026-11-08 | The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not sanitize and escape a value derived from an incoming webhook request before using it in a SQL query, all… |
| CVE-2026-104338 | LOW | Patched | 3.7 | 2026-11-08 | The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not perform an authorization check on one of its REST routes and derives the acting user's identity from an … |
| CVE-2026-104337 | MEDIUM | Patched | 5.3 | 2026-11-08 | The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not verify ownership of an order before returning a coupon discount computed against that order, allowing un… |
| CVE-2026-104307 | MEDIUM | Patched | 5.4 | 2026-11-08 | The BackUpWordPress plugin before 3.15 does not perform a capability or nonce check on an AJAX action that cleans up its backup directory, allowing any authenticated user (… |
| CVE-2026-103375 | MEDIUM | 5.3 | 2026-11-08 | The Antom Payments WordPress plugin through 2.0.11 does not perform any ownership or authorisation check before returning an order's confirmation link, which contains its s… | |
| CVE-2026-103303 | HIGH | 8.8 | 2026-11-08 | The Turisbook Booking System WordPress plugin through 1.3.8 does not have authorisation and CSRF checks when saving its settings, and does not sanitise and escape one of th… | |
| CVE-2026-114713 | HIGH | Patched | 8.6 | 2026-11-08 | The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 "label" message tag when echoing it into replies, which allows any user on a networ… |
| CVE-2026-124422 | MEDIUM | Patched | 6.1 | 2026-11-08 | SunEditor from 3.0.0 before 3.4.0 contains a stored cross-site scripting vulnerability in html.clean() that rebuilds iframes from data-se-iframe-holder-attrs JSON without f… |
| CVE-2026-123616 | HIGH | Patched | 7.5 | 2026-11-08 | imgproxy from 3.3.0 before 4.0.16 contains an unbounded memory allocation vulnerability in the ICO loader that fails to validate the data_size field. Attackers can supply a… |
| CVE-2026-123615 | HIGH | Patched | 7.5 | 2026-11-08 | imgproxy 3.3.0 before 4.0.17 contains an out-of-bounds heap read and write in the ICO loader's BMP header reconstruction (vips_foreign_load_ico_header in vips/icoload.c) wh… |
| CVE-2026-123614 | CRITICAL | Patched | 9.8 | 2026-11-08 | imgproxy from 4.0.0 before 4.0.16 contains an integer overflow in the ICO loader that allows remote attackers to trigger a heap buffer overflow via a crafted data_size valu… |
| CVE-2026-123613 | MEDIUM | Patched | 5.3 | 2026-11-08 | Rustls from 0.23.13 before 0.23.45 accepts TLS 1.3 handshake messages at the wrong encryption level when they follow a key-changing message in the same record, because Defr… |