ReportizFlow
Filtered by vendor Wordpress-extensions
Subscriptions
Total
997 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-103517 | 1 Wordpress-extensions | 1 Airwallex Online Payments Gateway | 2026-10-09 | 5.3 Medium |
| The Airwallex Online Payments Gateway WordPress plugin before 1.36.0 does not verify that an incoming payment notification genuinely comes from the payment provider when no webhook secret has been configured, allowing unauthenticated attackers to forge one and mark orders as paid without paying. | ||||
| CVE-2026-104671 | 1 Wordpress-extensions | 1 Tutorsstarter | 2026-10-09 | 5.3 Medium |
| The TutorStarter WordPress theme before 4.0.4 does not respect the site's user registration setting in one of its AJAX registration handlers, allowing unauthenticated visitors to create WordPress user accounts even when user registration is disabled. | ||||
| CVE-2026-105190 | 1 Wordpress-extensions | 1 Easy Digital Downloads | 2026-10-09 | 5.3 Medium |
| The Easy Digital Downloads WordPress plugin before 3.7.1 does not consult the site's user registration setting before creating a WordPress account, allowing unauthenticated users to create an account and receive a logged-in session even when registration is disabled. The created account receives the site's default role. | ||||
| CVE-2026-93509 | 1 Wordpress-extensions | 1 Wallet System For Woocommerce | 2026-10-09 | 6.5 Medium |
| The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is positive, and computes the sender's new balance from a stale snapshot taken before crediting the recipient, allowing an authenticated attacker with Subscriber-level access to mint wallet funds for themselves or drain a specific victim's balance into their own account. | ||||
| CVE-2026-62127 | 2 Mediaron, Wordpress-extensions | 2 Wp Plugin Info Card, Wp Plugin Info Card | 2026-10-09 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MediaRon LLC WP Plugin Info Card wp-plugin-info-card allows Stored XSS.This issue affects WP Plugin Info Card: from n/a through 6.3.5. | ||||
| CVE-2026-42698 | 2 Themeum, Wordpress-extensions | 2 Tutor Lms, Tutor Lms | 2026-10-09 | 5.3 Medium |
| Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Themeum Tutor LMS tutor allows Leveraging Race Conditions.This issue affects Tutor LMS: from n/a through 4.1.1. | ||||
| CVE-2026-27420 | 2 Katieseaborn, Wordpress-extensions | 2 Zotpress, Zotpress | 2026-10-09 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Katie Seaborn Zotpress zotpress allows Stored XSS.This issue affects Zotpress: from n/a through 7.4.4. | ||||
| CVE-2026-39790 | 2 E4jvikwp, Wordpress-extensions | 2 Vikrentcar, Vikrentcar | 2026-10-08 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Reflected XSS.This issue affects VikRentCar: from n/a through 1.4.7. | ||||
| CVE-2026-105397 | 2 Thimpress, Wordpress-extensions | 2 Learnpress, Learnpress | 2026-10-08 | 5.4 Medium |
| LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Attackers with the Instructor role can submit unsanitized payloads through the update_question AJAX handler that execute in the session of every student taking the quiz. | ||||
| CVE-2026-39768 | 2 Cleantalk, Wordpress-extensions | 2 Security & Malware Scan, Security & Malware Scan By Cleantalk | 2026-10-07 | N/A |
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. False positive. | ||||
| CVE-2026-42418 | 2 Wordpress-extensions, Wpsocialrocket | 2 Social Rocket, Social Rocket | 2026-10-07 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Socialrocket Social Rocket social-rocket allows Reflected XSS.This issue affects Social Rocket: from n/a through 1.3.5. | ||||
| CVE-2026-42638 | 2 Syed Balkhi, Wordpress-extensions | 2 Easy Digital Downloads, Easy Digital Downloads | 2026-10-07 | 7.5 High |
| Missing Authorization vulnerability in Awesomemotive Easy Digital Downloads easy-digital-downloads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Digital Downloads: from n/a through 3.7.1. | ||||
| CVE-2026-102375 | 2 Optimole, Wordpress-extensions | 2 Optimole, Optimole | 2026-10-07 | 6.5 Medium |
| Missing Authorization vulnerability in Optimole Optimole optimole-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Optimole: from n/a through 4.2.14. | ||||
| CVE-2026-39758 | 2 Midtrans, Wordpress-extensions | 2 Midtrans-woocommerce, Midtrans-woocommerce | 2026-10-07 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Midtrans-WooCommerce <= 2.32.3 versions. | ||||
| CVE-2026-39759 | 2 Amentotech, Wordpress-extensions | 2 Workreap, Workreap | 2026-10-07 | 9.9 Critical |
| Employer / Sales Representative Arbitrary File Upload in Workreap Core <= 3.4.5 versions. | ||||
| CVE-2026-39761 | 2 Elightup, Wordpress-extensions | 2 Meta Box Aio, Meta Box Aio | 2026-10-07 | 9.8 Critical |
| Unauthenticated Privilege Escalation in Meta Box AIO <= 3.7.1 versions. | ||||
| CVE-2026-39762 | 2 Patterns In The Cloud, Wordpress-extensions | 2 Autoship Cloud For Woocommerce Subscription Products, Autoship Cloud For Woocommerce Subscription Products | 2026-10-07 | 6.5 Medium |
| Missing Authorization vulnerability in Patterns In The Cloud Autoship Cloud for WooCommerce Subscription Products autoship-cloud allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Autoship Cloud for WooCommerce Subscription Products: from n/a through 2.17.1. | ||||
| CVE-2026-39764 | 2 Radiustheme, Wordpress-extensions | 2 Radius Booking — Booking Calendar For Appointments & Services, Radius Booking | 2026-10-07 | 9.3 Critical |
| Unauthenticated SQL Injection in Radius Booking — Booking Calendar for Appointments & Services <= 1.0.19 versions. | ||||
| CVE-2026-39765 | 2 Webappick, Wordpress-extensions | 2 Challan, Challan | 2026-10-07 | 7.2 High |
| Shop Manager Privilege Escalation in Challan <= 3.7.88 versions. | ||||
| CVE-2026-39766 | 2 Reputeinfosystems, Wordpress-extensions | 2 Arforms, Arforms | 2026-10-07 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in ARForms <= 7.1.2 versions. | ||||