Filtered by vendor Wordpress
Subscriptions
Total
15949 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-79630 | 2 Getwpfunnels, Wordpress | 2 Wpfunnels, Wordpress | 2026-09-04 | 5.3 Medium |
| The WPFunnels WordPress plugin before 3.13.0 does not verify that the product requested through a checkout order bump is the product that bump's discount was configured for, allowing unauthenticated users to obtain any purchasable product at a discount intended for a different one, with the reduced price carried through to the total of the order they place. | ||||
| CVE-2026-79631 | 2 Getwpfunnels, Wordpress | 2 Wpfunnels, Wordpress | 2026-09-04 | 5.3 Medium |
| The WPFunnels WordPress plugin before 3.13.0 does not restrict access to the log files it writes to a predictable location under the public uploads directory, allowing unauthenticated users to download customer order details and opt-in form submissions when logging is enabled. | ||||
| CVE-2026-82193 | 2 Wordpress, Wpvividplugins | 2 Wordpress, Wpvivid — Backup, Migration & Staging | 2026-09-04 | 5.5 Medium |
| The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied file name before using it to build a write path, allowing administrators to write files of permitted types to arbitrary locations on the server and to overwrite existing files. | ||||
| CVE-2026-81282 | 2 Villatheme, Wordpress | 2 Product Variations Swatches For Woocommerce, Wordpress | 2026-09-04 | 6.5 Medium |
| Subscriber Cross Site Scripting (XSS) in Product Variations Swatches for WooCommerce <= 1.1.18 versions. | ||||
| CVE-2026-81292 | 2 Ido Kobelkowsky, Wordpress | 2 Simple Payment, Wordpress | 2026-09-04 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Simple Payment <= 2.5.1 versions. | ||||
| CVE-2026-81300 | 2 Silverplugins217, Wordpress | 2 Calculation For Contact Form 7, Wordpress | 2026-09-04 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Calculation For Contact Form 7 <= 1.0 versions. | ||||
| CVE-2026-81776 | 2 Advanpix, Wordpress | 2 Wp Quicklatex, Wordpress | 2026-09-04 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in WP QuickLaTeX <= 3.8.8 versions. | ||||
| CVE-2026-84765 | 2 John Havlik, Wordpress | 2 Breadcrumb Navxt, Wordpress | 2026-09-04 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Breadcrumb NavXT <= 7.5.1 versions. | ||||
| CVE-2026-84767 | 2 Nexcess, Wordpress | 2 Bookit, Wordpress | 2026-09-04 | 5.3 Medium |
| Unauthenticated Bypass Vulnerability in BookIt <= 2.6.0.3 versions. | ||||
| CVE-2026-84773 | 2 Wordpress, 作者 | 2 Wordpress, Shane Bishop:ewww Image Optimizer | 2026-09-04 | 7.2 High |
| Unauthenticated Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.6 versions. | ||||
| CVE-2026-84776 | 2 Malcare, Wordpress | 2 Malcare Security, Wordpress | 2026-09-04 | 7.5 High |
| Unauthenticated Denial of Service Attack in MalCare Security <= 6.69 versions. | ||||
| CVE-2026-84779 | 2 Sheikh Heera, Wordpress | 2 Agentimus – Ai Seo, Llms.txt & Mcp For Ai Agents, Wordpress | 2026-09-04 | 8.1 High |
| Subscriber Broken Access Control in Agentimus – AI SEO, llms.txt & MCP for AI Agents <= 1.51.0 versions. | ||||
| CVE-2026-84836 | 2 Kirillbdev, Wordpress | 2 Wc Ukraine Shipping, Wordpress | 2026-09-04 | 7.1 High |
| Subscriber Insecure Direct Object References (IDOR) in WC Ukraine Shipping <= 1.22.3 versions. | ||||
| CVE-2026-84848 | 2 Brightvesseldev, Wordpress | 2 Quick Event Manager, Wordpress | 2026-09-04 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Quick Event Manager <= 9.17 versions. | ||||
| CVE-2026-85307 | 2 Kevin Pirnie, Wordpress | 2 Kp Agent Ready, Wordpress | 2026-09-04 | 5.3 Medium |
| Insertion of Sensitive Information Into Sent Data vulnerability in Kevin Pirnie KP Agent Ready allows Retrieve Embedded Sensitive Data. This issue affects KP Agent Ready: from n/a before 1.2.08. | ||||
| CVE-2026-82194 | 2 Wordpress, Wpvividplugins | 2 Wordpress, Wpvivid — Backup, Migration & Staging | 2026-09-04 | 5.5 Medium |
| The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied path before using it in a file deletion routine, allowing administrators to delete arbitrary files on the server, including files outside the web root. | ||||
| CVE-2026-84146 | 2 Wordpress, Xpro | 2 Wordpress, Xpro Addons — 140+ Widgets For Elementor | 2026-09-04 | 5.3 Medium |
| The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.8 does not perform any capability or post-status check before rendering a WooCommerce product summary from a supplied product identifier, allowing unauthenticated visitors to retrieve the title, price, SKU, description and stock details of products that are not publicly published (draft, pending, private or scheduled status). | ||||
| CVE-2026-85306 | 2 Cascadiawebservices, Wordpress | 2 Mountdev Ai Mcp Connector For Wordpress, Wordpress | 2026-09-04 | 6.5 Medium |
| Missing Authorization vulnerability in Cascadia Web Services MountDev AI MCP Connector for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MountDev AI MCP Connector for WordPress: from n/a through 1.6.5. | ||||
| CVE-2026-84813 | 2 Paolo, Wordpress | 2 Geodirectory, Wordpress | 2026-09-04 | 9.3 Critical |
| Unauthenticated SQL Injection in GeoDirectory <= 2.8.174 versions. | ||||
| CVE-2026-84761 | 2 Litespeed Technologies, Wordpress | 2 Litespeed Cache, Wordpress | 2026-09-04 | 7.2 High |
| Unauthenticated Server Side Request Forgery (SSRF) in LiteSpeed Cache <= 7.9 versions. | ||||