Export limit exceeded: 10235 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 417670 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 417670 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (417670 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-107015 | 1 Simplemobiletools | 1 Simple Contacts Pro | 2026-10-30 | 9.1 Critical |
| Insecure permissions in Simple Contacts Pro versionCode 107 allow unauthorized attackers to write and read notes in another user's' note database. | ||||
| CVE-2026-115299 | 1 Wordpress-extensions | 1 Contact Form By Supsystic | 2026-10-30 | 5.4 Medium |
| The Contact Form by Supsystic WordPress plugin before 1.11.1 does not verify a CSRF nonce before saving its mail settings, allowing an attacker to overwrite the site's outbound mail configuration, including the SMTP server, its credentials and the notification recipient, by tricking a logged-in administrator into visiting a crafted page, which can route the Contact Form by Supsystic WordPress plugin before 1.11.1's contact-form notifications through infrastructure the attacker controls. | ||||
| CVE-2026-115300 | 1 Wordpress-extensions | 1 Contact Form By Supsystic | 2026-10-30 | 4.3 Medium |
| The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two administrator-only actions that bulk-delete captured form submissions and wipe a form's statistics, allowing attackers to permanently destroy a site's stored contact leads and analytics by tricking a logged-in administrator into sending a forged request. | ||||
| CVE-2026-115301 | 1 Wordpress-extensions | 1 Contact Form By Supsystic | 2026-10-30 | 7.2 High |
| The Contact Form by Supsystic WordPress plugin before 1.11.1 does not sandbox the template engine used to render its forms and allows stored form-editor content to reach that engine as executable template code, enabling an administrator to perform server-side template injection and execute arbitrary code on the server. The injected template is compiled and executed whenever any visitor loads a page containing the form, so the stored payload also lets an unauthenticated visitor read server-side secrets such as authentication salts and database credentials. | ||||
| CVE-2026-115302 | 1 Wordpress-extensions | 1 Contact Form By Supsystic | 2026-10-30 | 5.3 Medium |
| The Contact Form by Supsystic WordPress plugin before 1.11.1 does not restrict access to an AJAX action that deletes stored form statistics records, allowing unauthenticated attackers to delete arbitrary statistics entries. | ||||
| CVE-2026-88928 | 1 Wordpress-extensions | 1 Paycomet For Woocommerce | 2026-10-30 | 6.5 Medium |
| The PAYCOMET for WooCommerce WordPress plugin before 5.46 does not verify the cryptographic signature on its payment notification endpoint when the request references a tokenisation operation, allowing unauthenticated attackers to overwrite the stored payment token associated with existing orders and delete saved card records. | ||||
| CVE-2026-89216 | 1 Wordpress-extensions | 1 Vtables | 2026-10-30 | 8.6 High |
| The vTables WordPress plugin before 0.3 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and extract data from the database. | ||||
| CVE-2024-3586 | 1 Wordpress-extensions | 1 Letterpress | 2026-10-30 | 3.5 Low |
| The LetterPress WordPress plugin before 2.4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | ||||
| CVE-2026-110030 | 1 Wordpress-extensions | 1 Hide Price Until Login | 2026-10-30 | 5.3 Medium |
| The Hide Price Until Login WordPress plugin before 1.1.2 does not restrict a guest-registration handler and does not honour the site's user-registration setting, allowing anyone to create a WordPress account and obtain a logged-in session even when registration is disabled. | ||||
| CVE-2026-110504 | 1 Wordpress-extensions | 1 Enable Svg, Webp, And Ico Upload | 2026-10-30 | 6.8 Medium |
| The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not sanitize uploaded SVG files whose content is not detected as SVG, while still storing and serving them as SVG images, which could allow users with the author role and above to perform Stored Cross-Site Scripting attacks. | ||||
| CVE-2026-110505 | 1 Wordpress-extensions | 1 Enable Svg, Webp, And Ico Upload | 2026-10-30 | 6.8 Medium |
| The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not prevent animation elements in uploaded SVG files from changing a link's target to a javascript: URI, which could allow users with the author role and above to bypass its SVG sanitization and perform Stored Cross-Site Scripting attacks that execute in WebKit-based browsers such as Safari. | ||||
| CVE-2026-111739 | 1 Wordpress-extensions | 2 All-in-one Security (aios), Two Factor Authentication | 2026-10-30 | 7.5 High |
| The Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Security (AIOS) WordPress plugin before 5.5.0 do not bind the account whose two-factor code is verified to the account being authenticated, allowing an attacker who knows a victim's password and holds their own two-factor-enabled account to satisfy the victim's second-factor check with their own code and obtain the victim's session. | ||||
| CVE-2026-113616 | 1 Wordpress-extensions | 1 Logixfast Auth | 2026-10-30 | 9.8 Critical |
| The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset one-time code to the resolved account's own email address, mailing it to the address supplied in the request instead, allowing unauthenticated attackers to reset any user's password, including an administrator's, and take over the account. | ||||
| CVE-2026-113617 | 1 Wordpress-extensions | 1 Automated Import Products To Cart | 2026-10-30 | 9.9 Critical |
| The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize a user-supplied file path before using it to read and delete files, allowing users with minimal permissions, such as subscribers, to read arbitrary files (including ones containing the database credentials) and delete arbitrary files on the server. | ||||
| CVE-2026-114270 | 1 Wordpress-extensions | 1 Geodirectory | 2026-10-30 | 5.3 Medium |
| The GeoDirectory WordPress plugin before 2.8.197 does not honour post password protection when rendering a listing, allowing unauthenticated users to disclose the content and custom fields of published listings that are protected by a post password. | ||||
| CVE-2026-115245 | 1 Wordpress-extensions | 1 Chat Ai With Dispatcher | 2026-10-30 | 9.8 Critical |
| The Chat AI with Dispatcher WordPress plugin before 2.4 does not properly validate uploaded files, relying only on a spoofable client-supplied content type, allowing unauthenticated attackers to upload arbitrary files, including PHP, which can lead to remote code execution. | ||||
| CVE-2026-115259 | 1 Wordpress-extensions | 1 Photo Engine | 2026-10-30 | 4.9 Medium |
| The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.0 does not have proper authorization checks when updating post data through one of its REST API routes in all versions up to, and including, 6.5.8. This makes it possible for authenticated attackers, with Author-level access and above, to modify the title, content, excerpt and other fields of arbitrary posts, pages and attachments, including those belonging to other users. | ||||
| CVE-2026-85007 | 1 Wordpress-extensions | 1 Yt Player | 2026-10-30 | 3.8 Low |
| The Video Player for YouTube WordPress plugin before 2.1.4 does not perform a capability check on its player-preset AJAX handler, allowing users with the Contributor role and above to read the site-wide player-preset configuration, and in versions before 2.1.1 to modify and delete it as well. | ||||
| CVE-2026-86794 | 1 Wordpress-extensions | 1 Community Events | 2026-10-30 | 8.8 High |
| The Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce checks when processing public event submissions, and does not escape several of the submitted values before outputting them in the administration dashboard and on the public calendar, allowing unauthenticated users to inject arbitrary web scripts that will execute in the browser of an administrator reviewing the submission. | ||||
| CVE-2026-114488 | 2 Redhat, Wildfly | 8 Fuse 7, Jboss Enterprise Application Platform, Jboss Enterprise Application Platform Expansion Pack and 5 more | 2026-10-30 | 7.4 High |
| A flaw was found in Wildfly. A remote attacker can bypass authentication on IIOP EJB invocations as the CSIv2 security interceptor accepts ITTPrincipalName identity assertions in the service context without verifying transport-level authentication, allowing a pre-auth attacker on the port 3528 to impersonate any principal on every IIOP-exposed @Remote EJB. | ||||