Total
409135 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-14214 | 2026-08-26 | N/A | 2.7 LOW | ||
| The Booking for Appointments and Events Calendar WordPress plugin before 2.4.4 does not restrict which fields can be written through its customer import, allowing a user with the Amelia Manager role to modify arbitrary columns of any stored user record by supplying them in the import request. | |||||
| CVE-2026-12966 | 2026-08-26 | N/A | 5.3 MEDIUM | ||
| The Direct Payments for WooCommerce WordPress plugin before 2.5.3 does not verify that the requester owns the targeted WooCommerce order in several unauthenticated AJAX handlers before changing its status and overwriting its payment metadata, allowing unauthenticated attackers to tamper with other customers' orders, including forging a "payment sent" state, overwriting the payment-method label, and attaching forged payment-proof files. | |||||
| CVE-2026-14839 | 2026-08-26 | N/A | 7.5 HIGH | ||
| The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowing unauthenticated users to retrieve the title and full content of any post regardless of its status, including unpublished (draft, pending, private, and trashed) posts. | |||||
| CVE-2026-15048 | 2026-08-26 | N/A | 7.5 HIGH | ||
| The Geeky Bot WordPress plugin before 1.2.8 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to retrieve chat-history session metadata including WordPress usernames, user IDs, and timestamps. | |||||
| CVE-2026-14929 | 2026-08-26 | N/A | 4.3 MEDIUM | ||
| The JS Help Desk WordPress plugin before 3.1.4 does not verify ownership of the targeted reply before updating it, allowing any authenticated user (Subscriber and above) to overwrite the content of any support-ticket reply on the site. | |||||
| CVE-2026-14840 | 2026-08-26 | N/A | 5.3 MEDIUM | ||
| The YOP Poll WordPress plugin before 7.0.6 does not validate the connection's origin IP address and instead trusts client-controlled forwarding headers when enforcing its per-IP vote restriction, allowing unauthenticated attackers to bypass the vote limit and cast unlimited votes on a public poll. | |||||
| CVE-2026-12721 | 2026-08-26 | N/A | 8.6 HIGH | ||
| The Kirki WordPress plugin before 6.0.13 does not properly sanitise and escape a value taken from the request before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks. | |||||
| CVE-2026-16273 | 2026-08-26 | N/A | 4.6 MEDIUM | ||
| The Narrative Publisher WordPress plugin through 1.0.7 does not restrict write access to a REST-exposed post meta field or escape it when rendering, allowing users with contributor-level access and above to store JavaScript that executes in the browser of any higher-privileged user who views the affected post. | |||||
| CVE-2026-13340 | 2026-08-26 | N/A | 6.1 MEDIUM | ||
| The SVG Support WordPress plugin before 2.5.17 does not apply its SVG sanitisation to uploaded files using the .svgz extension, even though it registers and serves them as SVG, allowing a user permitted to upload SVGs (such as an Author once granted upload access) to store a script-bearing file that executes in the browser of anyone who later views it, including an administrator. | |||||
| CVE-2026-12251 | 2026-08-26 | N/A | 8.1 HIGH | ||
| The Ultimate Member WordPress plugin before 2.12.1 does not filter administrator-level capabilities from the roles it makes selectable on its registration forms, and its post-registration safeguard against elevated accounts is disabled by default, allowing unauthenticated users to register with a site-defined role that carries administrator capabilities and gain administrative access, when such a role exists and a role-selection field is present on a published registration form. | |||||
| CVE-2026-14554 | 2026-08-26 | N/A | 6.5 MEDIUM | ||
| The Check & Log Email WordPress plugin before 2.0.15 does not properly sanitize and escape parameters before using them in SQL queries, allowing users with administrator privileges to perform SQL injection attacks. | |||||
| CVE-2026-16060 | 2026-08-26 | N/A | 9.8 CRITICAL | ||
| The Insert or Embed Articulate Content into WordPress plugin through 4.3000000027 does not correctly validate the contents of an uploaded archive, relying on a bypassable check that lets an Editor-level user upload a server-executable file into a public directory, resulting in remote code execution on servers configured to execute it. | |||||
| CVE-2026-12872 | 2026-08-26 | N/A | 9.8 CRITICAL | ||
| The Webinfos WordPress plugin through 1.2 does not validate the type or name of uploaded files, nor restrict the upload action with any authentication, capability, or nonce check, allowing unauthenticated attackers to upload arbitrary files (including PHP) to a web-accessible directory, leading to remote code execution on servers that execute PHP from the uploads path. | |||||
| CVE-2026-16057 | 2026-08-26 | N/A | 6.5 MEDIUM | ||
| The Contest Gallery WordPress plugin before 30.0.7 does not perform per-object capability or nonce checks in one of its post-deletion handlers, gating it only by a coarse role-membership test, which allows any Author-level or higher user to permanently delete arbitrary posts, pages, and other content they do not own. | |||||
| CVE-2026-13158 | 2026-08-26 | N/A | 7.2 HIGH | ||
| The Everest Toolkit WordPress plugin through 1.2.3 does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabled), allowing high-privilege users (Administrator by default, including non-super-admin site administrators on multisite) to upload executable PHP files to the uploads directory. | |||||
| CVE-2026-14315 | 2026-08-26 | N/A | 6.5 MEDIUM | ||
| The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.1 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to submit forged e-commerce conversion events to the site's configured server-side advertising conversion APIs using the site's stored credentials. | |||||
| CVE-2026-15151 | 2026-08-26 | N/A | 7.5 HIGH | ||
| The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not perform a capability check on one of its AJAX actions, allowing users with the lowest booking-management role (which by default cannot access the Five Star Restaurant Reservations WordPress plugin before 2.7.23's settings) to reset the site's configured booking notification rules. | |||||
| CVE-2026-14822 | 2026-08-26 | N/A | 5.3 MEDIUM | ||
| The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not perform any authorization check on one of its order-management REST endpoints, allowing unauthenticated users to change the status of existing orders. | |||||
| CVE-2026-14849 | 2026-08-26 | N/A | 3.7 LOW | ||
| The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not protect the member and payment export files it writes to a predictable location in the uploads directory, allowing unauthenticated users to download the exported member and payment data (including PII) while an export artifact is present. | |||||
| CVE-2026-14561 | 2026-08-26 | N/A | 6.5 MEDIUM | ||
| The Authora : Easy login with mobile number WordPress plugin before 1.7.7 does not keep its one-time login code confidential, returning the code and a valid verification token in the response of an unauthenticated action, allowing unauthenticated attackers to log in as any user whose registered mobile number they know (including administrators) or to create arbitrary accounts. | |||||