Filtered by vendor Wordpress-extensions
Subscriptions
Total
949 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-81340 | 2 Stylemix, Wordpress-extensions | 2 Masterstudy Lms Wordpress Plugin, Masterstudy Lms | 2026-09-29 | 3.8 Low |
| The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updating orders through its REST API, allowing users with the Instructor role to modify any order on the site, granting free course enrolment, revoking other users' paid enrolments, and tampering with order notes. | ||||
| CVE-2026-81810 | 2 Wordpress-extensions, Yaniiliev | 2 All In One Wp Migration And Backup, All In One Wp Migration And Backup | 2026-09-29 | 7.2 High |
| The All-in-One WP Migration and Backup WordPress plugin before 7.111 does not perform any capability check on several of its AJAX actions, gating them only on an installation-wide secret which it discloses to any user permitted to export the site, allowing such a user to import an arbitrary site archive and gain administrator access. Exploitation requires an administrator to have granted the export capability to a role that does not hold the All-in-One WP Migration and Backup WordPress plugin before 7.111's own import capability, which is not a default configuration. | ||||
| CVE-2026-84738 | 1 Wordpress-extensions | 1 Af Companion | 2026-09-29 | 9.1 Critical |
| The AF Companion WordPress plugin before 2.2.0 does not validate the type of files uploaded through one of its import features, allowing users with a low-privileged store-management role to upload arbitrary files, including PHP ones, leading to Remote Code Execution. | ||||
| CVE-2026-84902 | 2 Kingaddons, Wordpress-extensions | 2 King Addons For Elementor, King Addons For Elementor | 2026-09-29 | 6.8 Medium |
| The King Addons for Elementor WordPress plugin before 51.1.81 does not perform an object-level authorization check when importing template content into a page, allowing users with contributor-level access and above to overwrite the Elementor content of arbitrary posts and pages, including those owned by administrators, and to inject JavaScript through a widget setting that is output without escaping, resulting in Stored Cross-Site Scripting that executes in the session of any user who views the affected page. | ||||
| CVE-2026-84903 | 2 Kingaddons, Wordpress-extensions | 2 King Addons For Elementor, King Addons For Elementor | 2026-09-29 | 2.7 Low |
| The King Addons for Elementor WordPress plugin before 51.1.81 does not perform any capability, post-status, or password check before rendering the content of a user-supplied post, allowing users with Contributor-level access and above to read the content of private, draft, pending, and password-protected posts they are not authorized to access. | ||||
| CVE-2026-84904 | 2 Kingaddons, Wordpress-extensions | 2 King Addons For Elementor, King Addons For Elementor | 2026-09-29 | 3.8 Low |
| The King Addons for Elementor WordPress plugin before 51.1.81 does not perform per-object authorization checks on a group of image-optimization actions, gating them only on a coarse capability that lower-privileged users also hold and never confirming ownership of the targeted object, allowing authenticated users with author-level access and above to disclose absolute file paths for, overwrite the bytes of, and site-wide re-reference media belonging to other users, including administrators. | ||||
| CVE-2026-85009 | 1 Wordpress-extensions | 1 Restropress | 2026-09-29 | 6.5 Medium |
| The RestroPress WordPress plugin through 3.4.6 does not verify ownership in its payment-recovery flow before acting on a request-supplied order identifier, allowing unauthenticated attackers to enumerate which orders are in a recoverable state and to write notes to another customer's order. | ||||
| CVE-2026-85122 | 1 Wordpress-extensions | 1 Easy Form Builder | 2026-09-29 | 8.8 High |
| The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to store arbitrary content which is then rendered unescaped in an admin page, leading to Stored XSS. | ||||
| CVE-2026-85123 | 1 Wordpress-extensions | 1 Easy Form Builder | 2026-09-29 | 5.3 Medium |
| The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to create WordPress accounts on a site whose owner has disabled registration. | ||||
| CVE-2026-85127 | 2 Vikwp, Wordpress-extensions | 2 Vikbooking Hotel Booking Engine & Pms, Vikbooking | 2026-09-29 | 8.8 High |
| The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.8.15 does not restrict the type of files unauthenticated visitors may attach to its live chat, nor sanitize their contents, allowing them to store active content which is executed in the context of an administrator viewing the conversation. | ||||
| CVE-2026-85350 | 1 Wordpress-extensions | 1 Upsellwp | 2026-09-29 | 5.3 Medium |
| The UpsellWP WordPress plugin before 2.2.10 does not check that products added to the cart through a Frequently Bought Together campaign belong to that campaign, allowing unauthenticated users to buy arbitrary products at the campaign's discounted price. | ||||
| CVE-2026-87767 | 1 Wordpress-extensions | 1 Wp Shortcut Link | 2026-09-29 | 8.6 High |
| The wp shortcut link and advertisement baner WordPress plugin through 1.2.0 does not sanitize and escape a parameter before using it in a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database. | ||||
| CVE-2026-87770 | 1 Wordpress-extensions | 1 Price Drop Alert For Woo Commerce | 2026-09-29 | 8.6 High |
| The Price Drop Alert for Woo Commerce WordPress plugin through 1.1 does not sanitize and escape parameters before using them in a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database. | ||||
| CVE-2026-87771 | 1 Wordpress-extensions | 1 Product Question And Answer | 2026-09-29 | 8.6 High |
| The Product Question and Answer WordPress plugin through 1.1.0 does not sanitize and escape parameters before using them in SQL queries on AJAX actions available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database. | ||||
| CVE-2026-87774 | 1 Wordpress-extensions | 1 Tz Weekly Radio Schedule | 2026-09-29 | 8.6 High |
| The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database. | ||||
| CVE-2026-87775 | 1 Wordpress-extensions | 1 Tz Weekly Radio Schedule | 2026-09-29 | 8.6 High |
| The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database. | ||||
| CVE-2026-88825 | 1 Wordpress-extensions | 1 Igms Direct Booking | 2026-09-29 | 8.8 High |
| The iGMS Direct Booking WordPress plugin before 2.0 does not authorise or escape its widget appearance settings, allowing unauthenticated users to store arbitrary web scripts that execute in the context of an administrator viewing the iGMS Direct Booking WordPress plugin before 2.0 settings, and in the browser of any visitor to a page displaying the booking widget. | ||||
| CVE-2026-97227 | 1 Wordpress-extensions | 1 Nextscripts Social Networks Auto-poster | 2026-09-29 | 5.9 Medium |
| The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not perform capability or ownership checks on several of its AJAX actions, relying on a nonce alone, allowing users an administrator has granted access to its posting features to export the site's configured social account credentials, delete arbitrary posts and reset the NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8's configuration. | ||||
| CVE-2026-11871 | 1 Wordpress-extensions | 1 Team Showcase Supreme | 2026-09-29 | 5.3 Medium |
| The Team Members WordPress plugin before 9.3 does not perform any authorization or visibility check in an unauthenticated AJAX action that returns full team member records by ID, allowing unauthenticated attackers to enumerate and disclose details, including email addresses and phone numbers, of team members the administrator has not published publicly. | ||||
| CVE-2026-88993 | 2 Areoi, Wordpress-extensions | 2 All Bootstrap Blocks, All Bootstrap Blocks | 2026-09-28 | 6.8 Medium |
| The All Bootstrap Blocks WordPress plugin through 1.3.31 does not properly escape a block attribute before outputting it in HTML tag-name position, allowing users with Contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed. | ||||