Filtered by vendor Wordpress Subscriptions
Filtered by product Wordpress Subscriptions

Search

Switch to Advanced Search (Beta)
Total 11636 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-12685 3 Iqonic, Iqonicdesign, Wordpress 3 Wpbookit, Wpbookit, Wordpress 2026-04-02 6.5 Medium
The WPBookit WordPress plugin through 1.0.7 lacks a CSRF check when deleting customers. This could allow an unauthenticated attacker to delete any customer through a CSRF attack.
CVE-2025-12629 2 K-78, Wordpress 2 Broken Link Manager, Wordpress 2026-04-02 7.1 High
The Broken Link Manager WordPress plugin through 0.6.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVE-2025-12573 1 Wordpress 1 Wordpress 2026-04-02 6.5 Medium
The Bookingor WordPress plugin through 1.0.12 exposes authenticated AJAX actions without capability or nonce checks, allowing low-privileged users to delete Bookingor WordPress plugin through 1.0.12 data.
CVE-2025-12502 1 Wordpress 1 Wordpress 2026-04-02 6.8 Medium
The attention-bar WordPress plugin through 0.7.2.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing high privilege users such as administrator to perform SQL injection attacks
CVE-2025-11855 1 Wordpress 1 Wordpress 2026-04-02 7.5 High
The age-restriction WordPress plugin through 3.0.2 does not have authorisation in the age_restrictionRemoteSupportRequest function, allowing any authenticated users, such as subscriber to create an admin user with a hardcoded username and arbitrary password.
CVE-2025-11237 1 Wordpress 1 Wordpress 2026-04-02 5.3 Medium
The Make Email Customizer for WooCommerce WordPress plugin through 1.0.6 lacks proper authorization checks and option validation in its AJAX actions, allowing any authenticated user, such as a Subscriber, to update arbitrary WordPress options.
CVE-2025-11072 1 Wordpress 1 Wordpress 2026-04-02 5.3 Medium
The MelAbu WP Download Counter Button WordPress plugin through 1.8.6.7 does not validate the path of files to be downloaded, which could allow unauthenticated attacker to read/download arbitrary files.
CVE-2025-10915 1 Wordpress 1 Wordpress 2026-04-02 9.8 Critical
The Dreamer Blog WordPress theme through 1.2 is vulnerable to arbitrary installations due to a missing capability check.
CVE-2025-10638 1 Wordpress 1 Wordpress 2026-04-02 5.3 Medium
The NS Maintenance Mode for WP WordPress plugin through 1.3.1 lacks authorization in its subscriber export function allowing unauthenticated attackers to download a list of a site's subscribers containing their name and email address
CVE-2025-10636 2 Nsthemes, Wordpress 2 Ns Maintenance Mode For Wp, Wordpress 2026-04-02 3.5 Low
The NS Maintenance Mode for WP WordPress plugin through 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVE-2025-10635 1 Wordpress 1 Wordpress 2026-04-02 7.7 High
The Find Me On WordPress plugin through 2.0.9.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing subscribers and above to perform SQL injection attacks
CVE-2024-14015 1 Wordpress 1 Wordpress 2026-04-02 7.1 High
The WordPress eCommerce Plugin WordPress plugin through 2.9.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVE-2026-25369 2 Flexmls, Wordpress 2 Flexmls Idx, Wordpress 2026-04-02 N/A
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in flexmls Flexmls® IDX flexmls-idx allows Reflected XSS.This issue affects Flexmls® IDX: from n/a through <= 3.15.9.
CVE-2026-32587 2 Saad Iqbal, Wordpress 2 Wp Easypay, Wordpress 2026-04-02 N/A
Missing Authorization vulnerability in Saad Iqbal WP EasyPay wp-easy-pay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP EasyPay: from n/a through <= 4.2.11.
CVE-2026-32586 2 Pluggabl, Wordpress 2 Booster For Woocommerce, Wordpress 2026-04-02 N/A
Missing Authorization vulnerability in Pluggabl Booster for WooCommerce woocommerce-jetpack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booster for WooCommerce: from n/a through < 7.11.3.
CVE-2026-32565 2 Webberzone, Wordpress 2 Contextual Related Posts, Wordpress 2026-04-02 N/A
Missing Authorization vulnerability in Ajay Contextual Related Posts contextual-related-posts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contextual Related Posts: from n/a through < 4.2.2.
CVE-2026-25449 2 Shinetheme, Wordpress 2 Traveler, Wordpress 2026-04-02 N/A
Deserialization of Untrusted Data vulnerability in shinetheme Traveler traveler allows Object Injection.This issue affects Traveler: from n/a through < 3.2.8.1.
CVE-2026-27093 2 Ovatheme, Wordpress 2 Tripgo, Wordpress 2026-04-02 N/A
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ovatheme Tripgo tripgo allows PHP Local File Inclusion.This issue affects Tripgo: from n/a through < 1.5.6.
CVE-2026-27091 2 Uipress, Wordpress 2 Uipress Lite, Wordpress 2026-04-02 N/A
Missing Authorization vulnerability in UiPress UiPress lite uipress-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UiPress lite: from n/a through <= 3.5.09.
CVE-2026-25471 2 Themepaste, Wordpress 2 Admin Safety Guard, Wordpress 2026-04-02 N/A
Authentication Bypass Using an Alternate Path or Channel vulnerability in Themepaste Admin Safety Guard admin-safety-guard allows Password Recovery Exploitation.This issue affects Admin Safety Guard: from n/a through <= 1.2.6.