Export limit exceeded: 413160 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (413160 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-81404 | 1 Wordpress-extensions | 1 Ipgp Visitors Origin | 2026-11-11 | 7.1 High |
| The IPGP Visitors Origin WordPress plugin before 1.6 does not sanitise or escape user input before reflecting it back in the HTTP response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who are tricked into submitting a crafted request. | ||||
| CVE-2026-81423 | 1 Wordpress-extensions | 1 Accept Stripe Payments | 2026-11-11 | 4.3 Medium |
| The Accept Stripe Payments WordPress plugin before 2.1.4 does not validate a user-supplied URL before using it in a redirect, allowing unauthenticated attackers to redirect visitors to an arbitrary external website, which can be leveraged for phishing. | ||||
| CVE-2026-81424 | 1 Wordpress-extensions | 1 Accept Stripe Payments | 2026-11-11 | 5.3 Medium |
| The Accept Stripe Payments WordPress plugin before 2.1.4 does not verify that the product fulfilled when a checkout is completed matches the product the authoritative payment was actually made for, checking only that the amount paid is at least the referenced product's price, allowing unauthenticated attackers who complete a genuine payment to obtain fulfilment for a different, equal- or lower-priced product than the one they paid for. | ||||
| CVE-2026-83543 | 1 Wordpress-extensions | 1 Greenshift | 2026-11-11 | 4.1 Medium |
| The Greenshift WordPress plugin before 13.2.0 does not validate a user-supplied URL before fetching it server-side, allowing users with contributor-level access and above to make the server issue requests to arbitrary hosts and read the response. | ||||
| CVE-2026-83544 | 1 Wordpress-extensions | 1 Greenshift | 2026-11-11 | 6.8 Medium |
| The Greenshift WordPress plugin before 13.2.0 does not properly escape a block animation attribute before outputting it within an HTML attribute, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the content is viewed. | ||||
| CVE-2026-84021 | 1 Wordpress-extensions | 1 Bold Page Builder | 2026-11-11 | 6.8 Medium |
| The Bold Page Builder WordPress plugin before 5.9.8 does not properly validate a link URL before outputting it in an HTML attribute, relying on a filter that can be evaded, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user clicks the affected link. | ||||
| CVE-2026-84022 | 1 Wordpress-extensions | 1 Bold Page Builder | 2026-11-11 | 6.8 Medium |
| The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several shortcode attributes before outputting them in HTML attributes, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page. | ||||
| CVE-2026-84896 | 1 Wordpress-extensions | 1 King Addons For Elementor | 2026-11-11 | 6.8 Medium |
| The King Addons for Elementor WordPress plugin before 51.1.77 does not escape a widget display-style setting before outputting it in an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of any visitor to the affected page, including logged-in administrators. | ||||
| CVE-2026-84899 | 1 Wordpress-extensions | 1 Vikwidgetsloader | 2026-11-11 | 6.8 Medium |
| The VikWidgetsLoader WordPress plugin before 1.12.0 does not sanitise or escape a block attribute before outputting it inside an inline script, allowing users with the Contributor role to store arbitrary JavaScript that executes in the browser of any user viewing the affected post, including the administrator who reviews the pending submission. | ||||
| CVE-2026-84926 | 1 Wordpress-extensions | 1 Embedpress | 2026-11-11 | 2.7 Low |
| The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access to one of its Google Reviews REST routes to administrators, allowing any authenticated user with contributor-level access or above to read the site administrator's email address, a value WordPress core withholds from that role. | ||||
| CVE-2026-84927 | 1 Wordpress-extensions | 1 Embedpress | 2026-11-11 | 2.7 Low |
| The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check on one of its Google Reviews REST API routes, allowing users with the Contributor role and above to modify a site-wide store, deleting entries an administrator configured and injecting their own, which are rendered publicly across the site. | ||||
| CVE-2026-84930 | 1 Wordpress-extensions | 1 Catfolders Document Gallery | 2026-11-11 | 6.8 Medium |
| The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not properly validate a block attribute before using it as an HTML tag name in its gallery output, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of anyone who views the affected post. | ||||
| CVE-2026-84935 | 1 Wordpress-extensions | 1 Ht Menu | 2026-11-11 | 8 High |
| The HT Menu WordPress plugin before 1.2.7 does not perform any capability or object-ownership check when saving navigation menu-item settings, and does not escape those stored settings when the menu is rendered, allowing users with minimal permissions such as Subscribers to store JavaScript that executes in the browser of any visitor, administrators included, who views the affected menu. | ||||
| CVE-2026-84936 | 1 Wordpress-extensions | 1 Embedpress | 2026-11-11 | 5.3 Medium |
| The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization on a public review-loading action, allowing unauthenticated users to force the site to make repeated billable third-party API requests using the site's own configured API key, and to create an unbounded number of attacker-controlled rows in the database. | ||||
| CVE-2026-13159 | 1 Wordpress-extensions | 1 Real Estate Papi | 2026-11-11 | 4.3 Medium |
| The Real Estate Papi WordPress theme through 1.0.5 does not perform capability or CSRF checks on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to install a fixed set of companion from the WordPress.org repository. Where the request runs in the session of a user who can activate , those are activated as well. | ||||
| CVE-2026-84028 | 1 Wordpress-extensions | 1 Bold Page Builder | 2026-11-11 | 6.8 Medium |
| The Bold Page Builder WordPress plugin before 5.9.9 does not sanitise and escape a shortcode attribute before outputting it in an HTML attribute, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page. | ||||
| CVE-2026-85038 | 1 Wordpress-extensions | 1 B2bking | 2026-11-11 | 5.3 Medium |
| The B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More WordPress plugin before 5.2.40 does not verify that a role selected during registration is one actually offered on the registration form, allowing unauthenticated users to assign themselves to restricted B2B customer groups and to skip the manual account-approval workflow during self-registration. | ||||
| CVE-2026-86564 | 3 Dpdk, Red Hat, Redhat | 8 Dpdk, Enterprise Linux, Fast Datapath For Rhel 10 and 5 more | 2026-11-11 | 3.3 Low |
| A flaw was found in DPDK lib/vhost. Missing length validation before reading command_data in the virtio-net control-queue handler can cause an out-of-bounds read and a host process crash. | ||||
| CVE-2025-15690 | 1 Wordpress-extensions | 1 Content Mask | 2026-11-11 | 6.8 Medium |
| The Content Mask WordPress plugin before 1.8.5.6 does not properly sanitise and escape content submitted with a post before outputting it in the pages it generates, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against any user viewing or previewing the affected page. The Content Mask WordPress plugin before 1.8.5.6's option to restrict its use by role does not prevent this. | ||||
| CVE-2026-14962 | 1 Wordpress-extensions | 1 Elex Woocommerce Request A Quote | 2026-11-11 | 8.6 High |
| The ELEX WooCommerce Request a Quote WordPress plugin before 2.4.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks and extract arbitrary data from the database. | ||||