Filtered by vendor Wordpress-extensions Subscriptions
Total 1006 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-106010 1 Wordpress-extensions 1 Bdm Digital Payment Gateway 2026-10-21 5.3 Medium
The BDM Digital Payment Gateway WordPress plugin through 1.3.12 does not verify the credentials on its public payment-status update route and treats unset credentials as valid, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without payment in the default configuration.
CVE-2026-86791 1 Wordpress-extensions 1 Ipos Pays Payment Gateway For Woocommerce 2026-10-21 5.3 Medium
The iPOSpays Payment Gateway for WooCommerce WordPress plugin before 1.4.7 does not verify that a payment was actually completed before recording an order as paid, allowing unauthenticated users to mark any unpaid order as paid and to rewrite its total.
CVE-2026-91831 1 Wordpress-extensions 1 Subscribe To Comments 2026-10-21 3.8 Low
The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers, allowing users with Author-level access and above to inject arbitrary e-mail headers, such as a hidden Bcc, and to spoof the sender.
CVE-2026-94272 1 Wordpress-extensions 1 Snap Finance 2026-10-21 5.3 Medium
The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to fail.
CVE-2026-94294 1 Wordpress-extensions 1 App Builder 2026-10-21 5.3 Medium
The App Builder WordPress plugin before 5.7.1 does not require authentication or authorisation before writing attacker-supplied data to one of its options and, on a separate unauthenticated request, redirecting the visitor's browser to a URI built from that stored data.
CVE-2026-111406 2 Pt Norther Lights Production, Wordpress-extensions 2 Mapsvg, Mapsvg 2026-10-21 9.9 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through 8.16.1.
CVE-2026-110379 2 Ays-pro, Wordpress-extensions 2 Quiz Maker, Quiz Maker 2026-10-21 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Quiz Maker quiz-maker allows Reflected XSS.This issue affects Quiz Maker: from n/a through 6.7.1.91.
CVE-2026-111408 2 Expresstech, Wordpress-extensions 2 Quiz And Survey Master, Quiz And Survey Master 2026-10-21 8.8 High
Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7.
CVE-2026-111398 2 Pt Norther Lights Production, Wordpress-extensions 2 Mapsvg, Mapsvg 2026-10-21 7.7 High
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Path Traversal.This issue affects MapSVG: from n/a through 8.16.1.
CVE-2026-110887 2 Hivepress, Wordpress-extensions 2 Hivepress, Hivepress 2026-10-21 9.9 Critical
Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Remote Code Inclusion.This issue affects HivePress: from n/a through 1.7.32.
CVE-2026-112199 2 Wordpress-extensions, Yithemes 2 Yith Woocommerce Wishlist, Yith Woocommerce Wishlist 2026-10-21 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Wishlist yith-woocommerce-wishlist allows Stored XSS.This issue affects YITH WooCommerce Wishlist: from n/a through 4.18.1.
CVE-2026-111839 2 Videowhisper, Wordpress-extensions 2 Broadcast Live Video, Broadcast Live Video 2026-10-21 5.3 Medium
Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadcast Live Video: from n/a through 7.3.7.
CVE-2026-111410 2 E2pdf, Wordpress-extensions 2 E2pdf, E2pdf 2026-10-21 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E2Pdf.com e2pdf e2pdf allows Stored XSS.This issue affects e2pdf: from n/a through 1.32.57.
CVE-2026-111414 2 Crocoblock, Wordpress-extensions 2 Jetelements For Elementor, Jetelements For Elementor 2026-10-21 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.4.
CVE-2026-111836 2 Wordpress-extensions, Wpmanageninja 2 Fluentcommunity, Fluentcommunity 2026-10-21 4.3 Medium
Missing Authorization vulnerability in WP ManageNinja LLC FluentCommunity fluent-community allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentCommunity: from n/a through 2.11.0.
CVE-2026-111831 2 Wordpress-extensions, Wpmanageninja 2 Fluentform, Fluent Forms 2026-10-21 5.3 Medium
Missing Authorization vulnerability in WP ManageNinja LLC FluentForm fluentform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentForm: from n/a through 6.2.15.
CVE-2026-111845 2 Wordpress-extensions, Yithemes 2 Yith Woocommerce Product Bundles, Yith Woocommerce Product Bundles 2026-10-21 5.3 Medium
Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Product Bundles: from n/a through 2.29.0.
CVE-2026-110902 2 Liquid Web / Stellarwp, Wordpress-extensions 2 Event Tickets, Event Tickets 2026-10-21 4.3 Medium
Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.1.
CVE-2026-112222 2 Surfer, Wordpress-extensions 2 Surfer, Surfer 2026-10-21 5.4 Medium
Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Surfer: from n/a through 1.8.0.744.
CVE-2026-111828 2 Mamunur Rashid, Wordpress-extensions 2 Classified Listing, Classified Listing 2026-10-21 4.3 Medium
Improper Validation of Specified Quantity in Input vulnerability in Mamunur Rashid Classified Listing classified-listing allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Classified Listing: from n/a through 6.1.5.