Search
1,599 CVEs · Medium severity
CVEs (1,599, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 1–25 of 1,599 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↑ | Description |
|---|---|---|---|---|---|
| CVE-2026-107763 | MEDIUM | 4.3 | 2026-10-17 | The Fastcache by Host.it plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.5. This is due to the plugin not properly veri… | |
| CVE-2026-111601 | MEDIUM | 6.1 | 2026-10-17 | The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'token_id' parameter in all versions up to, and including… | |
| CVE-2026-107744 | MEDIUM | 6.5 | 2026-10-17 | The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.… | |
| CVE-2026-107752 | MEDIUM | 4.9 | 2026-10-17 | The Welcart e-Commerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wp_usces_order_old (JSON fields searchSql / searchSkuSql)' parameter in all vers… | |
| CVE-2026-109368 | MEDIUM | 6.5 | 2026-10-17 | The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.0.3 via the 'id' par… | |
| CVE-2026-109369 | MEDIUM | 6.8 | 2026-10-17 | The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin … | |
| CVE-2026-109985 | MEDIUM | 6.4 | 2026-10-17 | The xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all ve… | |
| CVE-2026-109989 | MEDIUM | 6.4 | 2026-10-17 | The Themify Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'popup_width_unit' parameter in all versions up to, and including, 1.4.7 due to … | |
| CVE-2026-110268 | MEDIUM | 4.9 | 2026-10-17 | The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.2 via the 'theme_slug' parameter. Thi… | |
| CVE-2026-111726 | MEDIUM | 6.4 | 2026-10-17 | The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'visible' Shortcode Attribute in all versions up to, and including, 7.8.2 due to i… | |
| CVE-2026-92715 | MEDIUM | Patched | 4.3 | 2026-10-17 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via … |
| CVE-2026-92978 | MEDIUM | 4.3 | 2026-10-17 | The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPres… | |
| CVE-2026-103376 | MEDIUM | Patched | 5.3 | 2026-10-17 | The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) WordPress plugin before 1.120.70 does not perform any capab… |
| CVE-2026-104122 | MEDIUM | 6.8 | 2026-10-17 | The Ukr-To-Lat WordPress plugin through 1.3.5 does not sanitize and escape a term name before using it in a SQL query, allowing users with Contributor-level access and abov… | |
| CVE-2026-104246 | MEDIUM | 5.9 | 2026-10-17 | The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value before building an email attachment path from it, allowing unaut… | |
| CVE-2026-106470 | MEDIUM | Patched | 5.0 | 2026-10-17 | The WP Data Access WordPress plugin before 5.5.88 does not have authorisation and CSRF checks in one of its actions, allowing any authenticated user, such as a subscriber,… |
| CVE-2026-110527 | MEDIUM | Patched | 5.3 | 2026-10-17 | The WP User Manager WordPress plugin before 2.9.20 does not roll back the WordPress account it creates during payment-gated registration when the subsequent payment step f… |
| CVE-2026-81343 | MEDIUM | 5.3 | 2026-10-17 | The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not perform a capability check on one of its form-submission actions before writing submitted val… | |
| CVE-2026-81344 | MEDIUM | 6.6 | 2026-10-17 | The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not restrict which PHP classes may be instantiated when it deserialises stored post content that … | |
| CVE-2026-91074 | MEDIUM | 6.8 | 2026-10-17 | The BSK PDF Manager WordPress plugin through 3.8.1 does not properly sanitise and escape a parameter before using it in a SQL statement, which could allow authenticated use… | |
| CVE-2026-92432 | MEDIUM | Patched | 4.3 | 2026-10-17 | The Patreon WordPress plugin before 1.10.0 does not validate a user-supplied redirect destination before redirecting, allowing unauthenticated attackers to redirect visitor… |
| CVE-2026-92433 | MEDIUM | Patched | 6.5 | 2026-10-17 | The Patreon WordPress plugin before 1.10.0 does not verify a nonce when connecting the site to a Patreon account, allowing attackers to make a logged-in administrator re-li… |
| CVE-2026-97314 | MEDIUM | Patched | 6.5 | 2026-10-17 | The ThirstyAffiliates WordPress plugin before 3.12.1 does not check the status or type of the object requested by its link redirect tracking handler, allowing unauthentica… |
| CVE-2026-109983 | MEDIUM | 6.4 | 2026-10-17 | The YMC Filter plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'post_title' parameter in all versions up to, and including, 3.12.19 due … | |
| CVE-2026-110253 | MEDIUM | 5.4 | 2026-10-17 | The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation… |