Export limit exceeded: 24231 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (419269 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-112244 | 2026-11-04 | 5.3 Medium | ||
| The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not prevent direct access to some of its bundled PHP files, which initialise without their expected context, trigger a fatal error, and return a stack trace that discloses the server's absolute filesystem paths to unauthenticated users. | ||||
| CVE-2026-112243 | 2026-11-04 | 5.8 Medium | ||
| The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not sanitise and escape a parameter before reflecting it on one of its administrative pages in certain configurations, leading to Reflected Cross-Site Scripting that executes in the session of a logged-in administrator who is tricked into opening a crafted link. | ||||
| CVE-2026-111962 | 2026-11-04 | 3.7 Low | ||
| The WP Remote Users Sync WordPress plugin before 2.2.0 does not adequately restrict access to the user export files it writes beneath the public web root, relying on an Apache access-control file that other web servers such as Nginx ignore, which allows an unauthenticated attacker who requests the export's predictable file name while it is present to retrieve the exported users' personal data. | ||||
| CVE-2026-111740 | 2026-11-04 | 2.7 Low | ||
| The Post Duplicator WordPress plugin before 3.0.17 does not check whether the requesting user may view each post before returning a list of posts for a post type, allowing users with a role as low as Contributor to read the titles and hierarchy of other users' draft and private posts. | ||||
| CVE-2026-110964 | 2026-11-04 | 6.5 Medium | ||
| The Essential Real Estate WordPress plugin before 5.3.5 does not verify that a media attachment belongs to the requesting user before deleting it, allowing a self-registered customer-level user to delete other users' media library attachments, including those owned by administrators. | ||||
| CVE-2026-110692 | 2026-11-04 | 4.1 Medium | ||
| The PowerPack Addons for Elementor: Widgets, Form Styler and Templates WordPress plugin before 3.1.3 does not validate a user-supplied URL before using it in a server-side HTTP request, which could allow users with the contributor role and above to perform Server-Side Request Forgery attacks against internal and loopback resources and read the response back. | ||||
| CVE-2026-110540 | 1 Dell | 1 Powerprotect Data Domain Management Center | 2026-11-04 | 7.1 High |
| Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized operation. | ||||
| CVE-2026-108068 | 2026-11-04 | 3.8 Low | ||
| The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform proper authorization checks on one of its video-migration functions, which is protected by a nonce only, allowing users with Contributor-level permissions and above to disclose and bulk-modify the FV Flowplayer Video Player WordPress plugin before 7.5.56.7212's stored video records across the whole site. | ||||
| CVE-2026-108067 | 2026-11-04 | 3.8 Low | ||
| The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not properly verify record ownership before modifying or deleting stored video and meta records, allowing authenticated users with Contributor-level access and above to modify or delete arbitrary records belonging to other users, and to disclose the associated meta data in the response. | ||||
| CVE-2026-108041 | 1 Wordpress-extensions | 1 Seopress | 2026-11-04 | 7.1 High |
| The SEOPress WordPress plugin before 10.4 does not sanitise and escape some of its analytics tracking settings before outputting them in an inline script printed on every front-end page, allowing users granted a SEOPress WordPress plugin before 10.4 capability that an administrator can delegate to lower-privileged roles to perform Stored Cross-Site Scripting attacks that execute in the browser of any site visitor, including a logged-in administrator viewing the front end. | ||||
| CVE-2026-107147 | 1 Alexandregz | 1 Twofactor Gauthenticator | 2026-11-04 | N/A |
| The twofactor_gauthenticator plugin for Roundcube is vulnerable to 2fa authentication bypass by spoofed client address headers. Due to the lack of validation of the Client-IP and X-Forwarded-For headers, an attacker who obtains user's password can spoof a whitelisted IP address, resulting in the second factor being bypassed. This issue was fixed in commit 4640889. | ||||
| CVE-2026-107146 | 1 Alexandregz | 1 Twofactor Gauthenticator | 2026-11-04 | N/A |
| The twofactor_gauthenticator plugin for Roundcube is vulnerable to session persistence after failed 2FA verification. Due to the lack of server-side session destruction, an attacker can ignore the logout redirect and keep the session alive. This may allow an attacker who obtains user's password to e.g. brute force the second-factor code. This issue was fixed in commit 4640889. | ||||
| CVE-2026-107145 | 1 Alexandregz | 1 Twofactor Gauthenticator | 2026-11-04 | N/A |
| The twofactor_gauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Due to the lack of rate limiting, an attacker who obtains user's password can submit arbitrary 6-digit codes, resulting in second-factor bypass and unauthorized access to the system. This issue was fixed in commit 4640889. | ||||
| CVE-2026-106649 | 2026-11-04 | 6.8 Medium | ||
| The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.29 does not prevent users with author-level access and above from storing arbitrary JavaScript in a form button configuration, which is later output into a JavaScript execution context and runs in the browser session of any user who clicks the button, including an administrator. | ||||
| CVE-2026-106004 | 1 Wordpress-extensions | 1 Dt Lms | 2026-11-04 | 5.3 Medium |
| The DT LMS WordPress plugin through 1.2 does not perform capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to revoke any learner's course and class completion status. | ||||
| CVE-2026-106000 | 2026-11-04 | 5.3 Medium | ||
| The Booking Package WordPress plugin before 1.7.34 does not require payment to be completed before saving a booking on calendars configured to require online payment, allowing unauthenticated users to create confirmed bookings without paying. | ||||
| CVE-2026-105993 | 1 Wordpress-extensions | 1 Dt Directory Lite Addon | 2026-11-04 | 5.3 Medium |
| The DT Directory Lite Addon WordPress plugin through 1.1 does not perform nonce or capability checks on its settings handlers, allowing unauthenticated attackers to modify the DT Directory Lite Addon WordPress plugin through 1.1's configuration and skin options. | ||||
| CVE-2026-105981 | 1 Welotec | 3 Tk100, Tk500 V2, Tk500 V3 | 2026-11-04 | 7.2 High |
| Improper input validation in the Digital I/O function may allow a remote attacker with high privileges to inject operating system commands and execute them with root privileges. | ||||
| CVE-2026-105967 | 2 Ghozylab, Wordpress-extensions | 2 Gallery For Social Photo, Gallery For Social Photo | 2026-11-04 | 5.8 Medium |
| The Gallery for Social Photo WordPress plugin through 1.0.0.41 does not validate a user-supplied URL before using it to perform a server-side request, allowing unauthenticated attackers to make the server issue requests to arbitrary internal hosts and read the responses. | ||||
| CVE-2026-105413 | 2026-11-04 | 7.5 High | ||
| The Form Maker by 10Web WordPress plugin before 1.15.51 does not consistently escape user-submitted field values before rendering them on its submissions admin page, allowing unauthenticated users to store a payload that executes as arbitrary web scripts in the session of an administrator who views the submissions. | ||||