Export limit exceeded: 369862 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (369862 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-13009 | 2 Wordpress, Wupsales | 2 Wordpress, Ai Copilot – Content Generator | 2026-07-23 | 6.5 Medium |
| The AI Copilot – Content Generator plugin for WordPress is vulnerable to generic SQL Injection via 'order[0][dir]' Parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The required waic-nonce is emitted on the front-end whenever the [waic_form] or [aiwu-form] shortcode is rendered, enabling contributor-level users who can publish shortcodes to obtain a valid nonce and reach the vulnerable AJAX handler, which performs no capability check beyond nonce verification when the shortcodes are not already embedded in a page. | ||||
| CVE-2026-27355 | 2 Metaphorcreations, Wordpress | 2 Ditty, Wordpress | 2026-07-23 | 5.3 Medium |
| Unauthenticated Broken Access Control in Ditty <= 3.1.66 versions. | ||||
| CVE-2026-65526 | 2 Themeisle, Wordpress | 2 Visualizer, Wordpress | 2026-07-23 | 8.5 High |
| Contributor SQL Injection in Visualizer <= 4.0.6 versions. | ||||
| CVE-2026-65528 | 2 Bannersky, Wordpress | 2 Bsk Pdf Manager, Wordpress | 2026-07-23 | 6.5 Medium |
| Contributor Cross Site Scripting (XSS) in BSK PDF Manager <= 3.8 versions. | ||||
| CVE-2026-65530 | 2 Templatespare, Wordpress | 2 Templatespare, Wordpress | 2026-07-23 | 4.3 Medium |
| Subscriber Broken Access Control in TemplateSpare <= 4.2.2 versions. | ||||
| CVE-2026-65531 | 2 Themeum, Wordpress | 2 Qubely, Wordpress | 2026-07-23 | 4.8 Medium |
| Unauthenticated Broken Access Control in Qubely <= 1.8.14 versions. | ||||
| CVE-2026-65532 | 2 Persianscript, Wordpress | 2 Persian Woocommerce Sms, Wordpress | 2026-07-23 | 7.6 High |
| Shop manager SQL Injection in Persian Woocommerce SMS <= 7.2.2 versions. | ||||
| CVE-2026-36163 | 1 Liquidfiles | 1 Liquidfiles | 2026-07-23 | 5.4 Medium |
| An HTML injection vulnerability in the file view endpoint of LiquidFiles v4.2.7 allows authenticated attackers to execute arbitrary JavaScript in the context of the victim's browser via the uploading of and user interaction with a crafted HTML file. | ||||
| CVE-2026-61946 | 2 Easy-appointments, Wordpress | 2 Easy Appointments, Wordpress | 2026-07-23 | 6.5 Medium |
| Unauthenticated Insecure Direct Object References (IDOR) in Easy Appointments <= 3.12.27 versions. | ||||
| CVE-2026-61949 | 2 Bookly, Wordpress | 2 Bookly, Wordpress | 2026-07-23 | 9.3 Critical |
| Unauthenticated SQL Injection in Bookly <= 27.7 versions. | ||||
| CVE-2026-65456 | 2 Pickplugins, Wordpress | 2 Product Slider For Woocommerce, Wordpress | 2026-07-23 | 4.3 Medium |
| Contributor Insecure Direct Object References (IDOR) in Product Slider for WooCommerce <= 1.13.62 versions. | ||||
| CVE-2026-65460 | 2 Wordpress, Zarinpal | 2 Wordpress, Zarinpal Gateway | 2026-07-23 | 4.3 Medium |
| Unauthenticated Cross Site Request Forgery (CSRF) in Zarinpal Gateway <= 5.1.0 versions. | ||||
| CVE-2026-14291 | 2026-07-23 | 7.5 High | ||
| The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one of its two-factor authentication code paths, allowing an unauthenticated attacker who knows a user's password to complete authentication without the one-time code and bypass enforced two-factor authentication for any account, including administrators. The affected two-factor module ships only in the premium build. | ||||
| CVE-2026-65013 | 2026-07-23 | 8.8 High | ||
| Onlook through 0.2.32, fixed in commit 423e2e9, contains a broken object level authorization vulnerability that allows authenticated attackers to access and manipulate other users' resources by supplying arbitrary UUID values to tRPC API procedures including project.get, member.remove, and chat.conversation.delete. Attackers can provide arbitrary projectId or conversationId values without authorization validation to read, modify, and delete other users' project data, members, and conversation history. | ||||
| CVE-2026-9066 | 2 Wordpress, Wpcompress | 2 Wordpress, Wp Compress | 2026-07-23 | 6.1 Medium |
| The WP Compress WordPress plugin before 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build the URLs of JavaScript files emitted on the page, leading to Reflected XSS. When a visitor follows a crafted link, the WP Compress WordPress plugin before 7.10.04's loader injects script elements pointing to an attacker-controlled origin, which lets the attacker execute arbitrary JavaScript in the visitor's session on the target site. | ||||
| CVE-2026-9577 | 2026-07-23 | 4.8 Medium | ||
| The Post Status Notifier Lite WordPress plugin before 1.13.0 does not properly escape the `mod` URL parameter before reflecting it into the admin settings page (`admin.php?page=post-status-notifier-lite`), leading to a Reflected Cross-Site Scripting vulnerability that fires in the administrator's session when they are tricked into following a crafted URL. | ||||
| CVE-2026-65503 | 2026-07-23 | 6.5 Medium | ||
| Contributor Cross Site Scripting (XSS) in Ultimate Store Kit Elementor Addons <= 3.0.5 versions. | ||||
| CVE-2026-47001 | 1 Oracle | 1 Enterprise Manager Base Platform | 2026-07-23 | 5.4 Medium |
| Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Web Services Framework). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Enterprise Manager Base Platform accessible data as well as unauthorized read access to a subset of Oracle Enterprise Manager Base Platform accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). | ||||
| CVE-2026-47695 | 2026-07-23 | N/A | ||
| CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to version 1.119.0, CC-Tweaked's HTTP API (`http.request`, `http.websocket`) blocks requests to private network ranges to prevent server-side request forgery (SSRF). This protection can be bypassed on IPv6-capable servers using NAT64 well-known prefix addresses (`64:ff9b::/96`). An attacker who can execute Lua code can reach any internal IPv4 service that the filter is intended to block, by addressing it as `http://[64:ff9b::<ipv4-as-hex>]/` instead of its direct IPv4 address. This affects any CC-Tweaked deployment on a network with NAT64 routing — a configuration that is standard on AWS, GCP, and other cloud platforms when using IPv6-only subnets. Version 1.119.0 fixes the issue. | ||||
| CVE-2026-65514 | 2026-07-23 | 6.5 Medium | ||
| Contributor Cross Site Scripting (XSS) in Appointment Hour Booking <= 1.5.86 versions. | ||||