ReportizFlow
Filtered by vendor Wordpress-extensions
Subscriptions
Total
972 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-41561 | 2 Adrian Lin, Wordpress-extensions | 2 Museder Restoreone, Museder Restoreone | 2026-10-07 | 7.5 High |
| Unauthenticated Sensitive Data Exposure in Museder RestoreOne <= 2.7.276 versions. | ||||
| CVE-2026-41562 | 2 Norvisgabriel, Wordpress-extensions | 2 Norvis Backup, Norvis Backup | 2026-10-07 | 7.5 High |
| Unauthenticated Sensitive Data Exposure in Norvis Backup <= 1.1.0 versions. | ||||
| CVE-2026-42413 | 2 Daftplug, Wordpress-extensions | 2 Snapshotify, Snapshotify | 2026-10-07 | 7.5 High |
| Unauthenticated Sensitive Data Exposure in Snapshotify – All-in-One Backup & Restore & Migrate <= 1.3.2 versions. | ||||
| CVE-2014-125130 | 2 Damjan, Wordpress-extensions | 2 Codeart Google Mp3 Audio Player, Codeart Google Mp3 Audio Player | 2026-10-07 | 7.5 High |
| CodeArt Google MP3 Audio Player plugin (google-mp3-audio-player) for WordPress through 1.0.11 contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to retrieve sensitive files by supplying a path-traversal payload in the file parameter of direct_download.php. Attackers can request paths ../../wp-config.php without authentication to download configuration files containing database credentials and secret keys, leading to full site compromise. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19. | ||||
| CVE-2026-95865 | 2 Beaverbuilder, Wordpress-extensions | 2 Beaver Builder Page Builder – Drag And Drop Website Builder, Beaver Builder Page Builder | 2026-10-07 | 6.5 Medium |
| The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to blind SQL Injection via 'fields[][value]' Parameter in all versions up to, and including, 2.11.0.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerable get_autosuggest_values AJAX endpoint is reachable by any Contributor who owns a draft post, as the required fl_ajax_update nonce is emitted into the block editor for any user who can edit a Beaver Builder post type. | ||||
| CVE-2026-84169 | 1 Wordpress-extensions | 1 Upi Qr Code Payment Gateway | 2026-10-07 | 5.3 Medium |
| The UPI QR Code Payment Gateway WordPress plugin through 1.4.3 does not verify that a payment-confirmation request actually belongs to the order and customer it claims to confirm, allowing unauthenticated attackers to mark an arbitrary order as paid without making any payment. | ||||
| CVE-2026-39763 | 2 Deepak Anand, Wordpress-extensions | 2 Wp Dummy Content Generator, Wp Dummy Content Generator | 2026-10-07 | 4.3 Medium |
| Missing Authorization vulnerability in Deepak Anand WP Dummy Content Generator wp-dummy-content-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Dummy Content Generator: from n/a through 4.0.0. | ||||
| CVE-2026-94669 | 2 Wordpress-extensions, Wpmanageninja | 2 Fluent Forms Pro Add On Pack, Fluent Forms Pro Add On Pack | 2026-10-07 | 5.3 Medium |
| Missing Authorization vulnerability in WP ManageNinja LLC Fluent Forms Pro Add On Pack fluentformpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent Forms Pro Add On Pack: from n/a through 6.2.13. | ||||
| CVE-2026-105073 | 2 Arraytics, Wordpress-extensions | 2 Wp Event Solution, Wp Event Solution | 2026-10-07 | 5.3 Medium |
| Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Arraytics WP Event Solution wp-event-solution allows Retrieve Embedded Sensitive Data.This issue affects WP Event Solution: from n/a through 4.1.25. | ||||
| CVE-2026-103684 | 2 Arraytics, Wordpress-extensions | 2 Wp Event Solution, Wp Event Solution | 2026-10-07 | 5.3 Medium |
| Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Solution: from n/a through 4.1.25. | ||||
| CVE-2026-39783 | 2 Wordpress-extensions, Wp Syntex | 2 Polylang, Polylang | 2026-10-07 | 4.3 Medium |
| Missing Authorization vulnerability in WP SYNTEX Polylang polylang allows Retrieve Embedded Sensitive Data.This issue affects Polylang: from n/a through 3.8.7. | ||||
| CVE-2026-105421 | 2 Nathanbarry, Wordpress-extensions | 2 Kit (formerly Convertkit) For Woocommerce, Kit (formerly Convertkit) For Woocommerce | 2026-10-06 | 5.3 Medium |
| Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) for WooCommerce convertkit-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit) for WooCommerce: from n/a through 2.2.0. | ||||
| CVE-2026-42414 | 2 Cridio, Wordpress-extensions | 2 Listingpro, Listingpro | 2026-10-06 | 8.5 High |
| Subscriber SQL Injection in ListingPro <= 2.9.12 versions. | ||||
| CVE-2026-42415 | 2 Portotheme, Wordpress-extensions | 2 Functionality, Porto Theme | 2026-10-06 | 9.3 Critical |
| Unauthenticated SQL Injection in Porto Theme - Functionality <= 3.9.3 versions. | ||||
| CVE-2026-42416 | 2 Andondesign, Wordpress-extensions | 2 Udesign, Udesign Core | 2026-10-06 | 8.5 High |
| Subscriber SQL Injection in UDesign Core <= 4.15.0 versions. | ||||
| CVE-2026-42417 | 2 Reputeinfosystems, Wordpress-extensions | 2 Armember, Armember Premium | 2026-10-06 | 9.3 Critical |
| Unauthenticated SQL Injection in ARMember Premium <= 7.8 versions. | ||||
| CVE-2026-42634 | 2 Bplugins, Wordpress-extensions | 2 Video Background Block – Use Video As Background In The Section., Video Background Block Use Video As Background In The Section | 2026-10-06 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Video Background Block – Use video as background in the section. <= 2.0.3 versions. | ||||
| CVE-2026-42635 | 2 Wordpress-extensions, Wpgenie | 2 Woocommerce Simple Auctions, Woocommerce Simple Auctions | 2026-10-06 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in WooCommerce Simple Auctions <= 3.0.10 versions. | ||||
| CVE-2026-42636 | 2 Wordpress-extensions, Wp Legal Pages | 2 Wp Cookie Notice For Gdpr, Ccpa & Eprivacy Consent, Wp Cookie Notice For Gdpr, Ccpa & Eprivacy Consent | 2026-10-06 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.4.6 versions. | ||||
| CVE-2026-42637 | 2 Payplug, Wordpress-extensions | 2 Payplug For Woocommerce (official), Payplug For Woocommerce (official) | 2026-10-06 | 6.5 Medium |
| Unauthenticated Settings Change in PayPlug for WooCommerce (Official) <= 3.1.0 versions. | ||||