Riskcovery

Vulnerabilities

Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.

402,123 vulnerabilities match.

CVESeveritySummary
CVE-2026-1106646.4 MediumPremium Packages <= 7.2.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Order Notes
CVE-2026-1107017.2 HighCP Multi View Events Calendar <= 1.4.42 - Unauthenticated Stored Cross-Site Scripting via 'CalendarTitle' Parameter
CVE-2026-1111784.9 MediumWP Booking System <= 2.1.0.1 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
CVE-2026-1076465.3 MediumHUSKY <= 1.4.5 - Unauthenticated Sensitive Information Exposure in 'woof_tm_data' Localized Script
CVE-2026-1101912.7 LowProduct Delivery Date for WooCommerce – Lite < 3.3.2 - Contributor+ Order Information Disclosure via Calendar View AJAX Actions
CVE-2026-1101796.8 Mediumaffiliate-toolkit < 3.8.9 - Editor+ SQL Injection via orderby Parameter
CVE-2026-1101357.4 HighOTP Login & Register Woocommerce < 2.7.3 - Unauthenticated Account Takeover via OTP Brute Force
CVE-2026-1100392.7 LowSmush < 4.3.4 - Admin+ Network-Wide Plugin Settings Update on Multisite
CVE-2026-1100158.8 HighSalon Booking System < 10.31.9 - Administrator Account Creation via CSRF
CVE-2026-1100145.3 MediumSalon Booking System < 10.31.9 - Unauthenticated Booking Creation with Arbitrary Customer ID and Status
CVE-2026-1100134.8 MediumSalon Booking System < 10.31.9 - Unauthenticated Salon REST API Access via Predictable Access-Token
CVE-2026-1100124.3 MediumSalon Booking System < 10.31.3 - Subscriber+ Booking PII Disclosure via REST bookings/upcoming
CVE-2026-1099824.2 MediumMB Custom Post Types & Custom Taxonomies < 2.12.2 - Subscriber+ Missing Authorization via CPT UI Migration
CVE-2026-1059744.3 MediumVisual Form Builder <= 3.1 - Subscriber+ Sensitive Data Disclosure via Dashboard Widget
CVE-2026-1059734.3 MediumVisual Form Builder <= 3.1 - Subscriber+ Arbitrary Form Field Reordering via Missing Authorization
CVE-2026-1036966.8 MediumMobile Builder <= 1.4.2 - Unauthenticated SQLi via 'delivery_id' Parameter
CVE-2026-749235.3 MediumDocument Gallery <= 5.1.1 - Unauthenticated Non-Public Attachment Disclosure via dg_generate_gallery and dg_generate_icons
CVE-2026-924275.3 MediumCoinsnap Bitcoin Crowdfunding <= 1.2.0 - Unauthenticated Payment Record Forgery via Webhook Secret Disclosure
CVE-2026-918306.5 MediumSubscribe to Comments < 2.3.3 - Unauthenticated Subscription Management Key Disclosure via Forged Comment Cookie
CVE-2026-918336.8 MediumWX Subscribe <= 1.2.1 - Unauthenticated SQLi via 'attach' Parameter
CVE-2026-1001867.2 HighUser Profile Builder <= 4.0.3 - Unauthenticated Stored Cross-Site Scripting via First Name Field
CVE-2026-889636.1 MediumTutor LMS <= 4.0.8 - Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting via 'redirect_url' Parameter
CVE-2026-856598.8 HighPilotPress <= 2.0.43 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover via 'username' Parameter
CVE-2026-1049328.0 HighSearch Regex 3.5 - Authenticated (Subscriber+) Remote Code Execution via User Meta Serialized String Corruption
CVE-2026-1095137.2 HighNotificationX <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via 'name' Parameter via popup-submit REST Route
CVE-2026-1094146.5 MediumVitepos <= 3.6.1 - Authenticated (Vendor+) SQL Injection via 'src_by[].val' Parameter via 'bt' Operator
CVE-2026-1077647.2 HighSiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Author URL via Inspector href Sink
CVE-2026-1111227.2 HighSiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Anchor href via Visual Inspector
CVE-2026-890517.2 HighHide My WP Ghost <= 7.0.12 - Unauthenticated Stored Cross-Site Scripting via Comment Content
CVE-2026-1037689.8 CriticalELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.7 - Unauthenticated Arbitrary File Upload via IMAP Email Attachment
CVE-2026-1094478.1 HighUser Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation to 'role' Parameter via Legacy Meta-Name Collision on [wppb-register]
CVE-2026-1038967.5 High10Web Booster <= 2.34.5 - Unauthenticated Limited File Write / Cache Poisoning via Query-string Parameter Traversal in Page-Cache Path
CVE-2026-1092327.2 HighSalon Booking System <= 10.31.9 - Unauthenticated Stored Cross-Site Scripting via Custom Checkout Field (Html/File Type) via Public Booking AJAX
CVE-2026-1040015.4 MediumSlim SEO <= 4.11.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'Biographical Info' User Meta
CVE-2026-958097.2 HighOpti-Behavior <= 1.9.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'country_name' Location Parameter
CVE-2026-122725.3 MediumLightweight Cookie Notice <= 1.19 - Sensitive Information Exposure via W3TC_DYNAMIC_SECURITY Constant
CVE-2026-890799.8 CriticalTheme My Login <= 7.2.1 - Unauthenticated Privilege Escalation via 'user_pass1' POST Parameter in wp_pre_insert_user_data Filter
CVE-2026-937676.5 MediumTainacan <= 1.3.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read via 'guid' Parameter
CVE-2026-956867.2 HighOpti-Behavior <= 1.9.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'targetUrl' Parameter
CVE-2026-1040007.2 HighSimply Schedule Appointments <= 1.6.12.35 - Unauthenticated Stored Cross-Site Scripting via 'status' Parameter via /wp-json/ssa/v1/appointments/{id}
CVE-2026-1034806.4 MediumTourfic <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute
CVE-2026-1077486.4 MediumUser Profile Builder <= 4.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter
CVE-2026-1039997.2 HighUltra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated Stored Cross-Site Scripting via File Upload
CVE-2026-1100176.4 MediumQuick PayPal Payments: Payment Button & Form <= 6.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form' Shortcode Attribute
CVE-2026-1001586.4 MediumSQL Chart Builder <= 3.0.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SQL Chart Label (X-axis) via Stored User Field
CVE-2026-965707.2 HighSchema & Structured Data for WP & AMP <= 1.67 - Unauthenticated Stored Cross-Site Scripting via 'saswp_review_text' Parameter
CVE-2026-1114586.8 Mediumssldump Heap Buffer Overflow in FAN/1 X.509 Fingerprint Formatting
CVE-2026-1092218.1 HighGroundhogg <= 4.9.3 - Authenticated (Sales Representative+) Arbitrary File Deletion via CSV Import 'copy_file' Field Mapping
CVE-2026-1076597.5 HighModula Image Gallery <= 3.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Exposed 'modulaSettings' REST field on the modula-gallery CPT
CVE-2026-1047989.8 CriticalMy Calendar <= 3.8.7 - Unauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'above' Attribute

Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.