Total
396952 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-15692 | 2026-09-03 | N/A | 3.5 LOW | ||
| The Icegram Express WordPress plugin before 5.8.6 does not properly escape a list description setting before outputting it within an HTML attribute, which could allow users with the Administrator role and above to perform Stored Cross-Site Scripting attacks. | |||||
| CVE-2026-14326 | 2026-09-03 | N/A | 3.8 LOW | ||
| The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through its REST API, allowing users with its custom staff role to modify, disable, or take over appointments belonging to other staff members. | |||||
| CVE-2026-78153 | 2026-09-03 | N/A | 5.3 MEDIUM | ||
| The Restrict User Access WordPress plugin before 2.8.1 does not normalise the REST API route before checking it against the routes its content protection covers, allowing unauthenticated users to bypass that protection and read restricted content and enumerate users. | |||||
| CVE-2026-81199 | 2026-09-03 | N/A | 5.3 MEDIUM | ||
| The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning a student's learning statistics, allowing unauthenticated attackers to disclose the course counts, points, certificates, quiz and assignment totals of any registered user. | |||||
| CVE-2026-19704 | 2026-09-03 | N/A | 5.3 MEDIUM | ||
| The Comments WordPress plugin before 7.6.66 does not validate a value used to build a database query, allowing unauthenticated users to inject SQL and read comments they are not entitled to see, including comments awaiting moderation, comments marked as spam or trashed, and comments on private and draft posts. The injected text reaches the query as grammar rather than as data and does not yield extraction of arbitrary data, so the confidentiality impact is the disclosed comment content rather than the database at large. | |||||
| CVE-2026-77787 | 2026-09-03 | N/A | 2.7 LOW | ||
| The Rank Math SEO WordPress plugin before 1.0.277 does not perform a capability check when bulk metadata updates target taxonomy terms, and reuses the supplied object identifier across object types, allowing users with the Author role and above to modify the SEO metadata of terms they cannot edit and to overwrite the titles of posts belonging to other users. | |||||
| CVE-2026-77792 | 2026-09-03 | N/A | 7.5 HIGH | ||
| The RegistrationMagic WordPress plugin before 6.0.9.9 does not escape a registration form field value before outputting it in an HTML attribute on an administrative page, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against high privilege users such as admin. | |||||
| CVE-2026-77793 | 2026-09-03 | N/A | 5.3 MEDIUM | ||
| The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate the total price of a paid registration server-side, allowing unauthenticated users to complete a paid registration without paying and obtain an activated account. | |||||
| CVE-2026-2811 | 2026-09-03 | N/A | 5.4 MEDIUM | ||
| The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary HTTP headers. | |||||
| CVE-2025-15485 | 2026-09-03 | N/A | 8.2 HIGH | ||
| The Auto x LINE WordPress plugin through 1.0.0 does not have authorization checks in some of its REST endpoints, allowing unauthenticated users to call them and update the plugin settings, clear logs etc | |||||
| CVE-2026-78151 | 2026-09-03 | N/A | 5.3 MEDIUM | ||
| The FormLayer WordPress plugin before 1.0.9 does not perform any authorization check before returning a form's full stored configuration in the response to its public submission handler, allowing unauthenticated users to disclose notification recipient addresses, confirmation redirect targets and integration settings, including those of unpublished forms. | |||||
| CVE-2026-77788 | 2026-09-03 | N/A | 4.9 MEDIUM | ||
| The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the metadata row being updated belongs to the object the user was authorised against, allowing users with the Author role and above to overwrite arbitrary post and user metadata, including that belonging to higher-privileged users. | |||||
| CVE-2026-81807 | 2026-09-03 | N/A | 8.8 HIGH | ||
| The Simple Ajax Chat WordPress plugin before 20260827 does not escape chat message content before rendering it, allowing unauthenticated users to inject arbitrary HTML attributes into the page and run scripts in the browser of anyone viewing the chat, including administrators. | |||||
| CVE-2026-81196 | 2026-09-03 | N/A | 2.7 LOW | ||
| The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of quiz question identifiers, allowing users with instructor access to read other instructors' quiz questions, including the correct answers and explanations. | |||||
| CVE-2026-8151 | 2026-09-03 | N/A | 5.4 MEDIUM | ||
| The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks in its settings page, allowing attackers to trick a logged-in administrator into changing the configured third-party API key. Once replaced, all subsequent member registration data (name, email, membership level) is sent to the attacker-controlled account. | |||||
| CVE-2026-81583 | 2026-09-03 | N/A | 5.4 MEDIUM | ||
| The My Login WordPress plugin before 7.2.0 does not enforce the network's registration setting when processing site signups on multisite installations, allowing users with a subscriber account, and unauthenticated users on some networks, to create new sites and be granted administrator over them. | |||||
| CVE-2026-4357 | 2026-09-03 | N/A | 10.0 CRITICAL | ||
| The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who can upload files via the plugin, as well as what can be uploaded, making it possible for unauthenticated attackers to upload PHP backdoors on affected sites. | |||||
| CVE-2026-74927 | 2026-09-03 | N/A | 5.3 MEDIUM | ||
| The MultiVendorX WordPress plugin before 5.0.15 does not have proper authorisation controls on one of its REST API listing routes, allowing unauthenticated users to retrieve vendor contact and payout details, pending payout amounts, and administrative notes attached to store applications. | |||||
| CVE-2026-19251 | 2026-09-03 | N/A | 5.3 MEDIUM | ||
| The Ultimate Member WordPress plugin before 2.13.0 does not check whether a comment has been approved, or whether the profile it belongs to is private, before returning profile activity to unauthenticated visitors, allowing them to read the content of comments still awaiting moderation. | |||||
| CVE-2026-77009 | 2026-09-03 | N/A | 9.9 CRITICAL | ||
| The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to its debugging console, which executes user-supplied PHP code, allowing any authenticated user, such as a subscriber, to run arbitrary code on the server. | |||||