Filtered by vendor Wordpress-extensions Subscriptions
Total 972 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-105057 2 Ben Marshall, Wordpress-extensions 2 Zero Spam, Zero Spam 2026-10-06 5.3 Medium
Unauthenticated Bypass Vulnerability in Zero Spam <= 5.7.11 versions.
CVE-2026-105058 2 John James Jacoby, Wordpress-extensions 2 Wp User Profiles, Wp User Profiles 2026-10-06 8.8 High
Subscriber Privilege Escalation in WP User Profiles <= 2.7.3 versions.
CVE-2026-105061 2 Brandtoss, Wordpress-extensions 2 Wpmailster, Wp Mailster 2026-10-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in WP Mailster <= 1.9.0.0 versions.
CVE-2026-105070 2 Dimitri Grassi, Wordpress-extensions 2 Salon Booking System, Salon Booking System 2026-10-06 8.8 High
Unauthenticated Privilege Escalation in Salon booking system <= 10.31.7 versions.
CVE-2026-105071 2 Royal Plugins, Wordpress-extensions 2 Sitevault, Sitevault 2026-10-06 7.5 High
Unauthenticated Sensitive Data Exposure in SiteVault – Backup, Restore, Migration &amp; Cloning <= 1.5.17 versions.
CVE-2026-105317 2 Cozmoslabs, Wordpress-extensions 2 Paid Member Subscriptions, Paid Member Subscriptions 2026-10-06 8.5 High
Subscriber SQL Injection in Paid Member Subscriptions <= 3.1.1 versions.
CVE-2026-104399 2 Stylemix, Wordpress-extensions 2 Motors, Motors 2026-10-06 N/A
Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Motors allows Retrieve Embedded Sensitive Data. This issue affects Motors: from n/a through 1.4.124.
CVE-2026-103355 2 Unlimited-elements, Wordpress-extensions 2 Unlimited Elements For Elementor (free Widgets, Addons, Templates), Unlimited Elements For Elementor 2026-10-06 9.3 Critical
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Blind SQL Injection.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20.
CVE-2026-97276 2 Veronalabs, Wordpress-extensions 2 Wp Statistics, Wp Statistics 2026-10-05 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP Statistics wp-statistics allows Reflected XSS.This issue affects WP Statistics: from n/a through 14.16.14.
CVE-2026-103354 2 Stellarwp, Wordpress-extensions 2 Gutenberg Blocks By Kadence Blocks, Gutenberg Blocks By Kadence Blocks 2026-10-05 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.7.11.1.
CVE-2026-97307 2 Stylemixthemes, Wordpress-extensions 2 Cost Calculator Builder, Cost Calculator Builder 2026-10-05 7.5 High
Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Cost Calculator Builder cost-calculator-builder allows Retrieve Embedded Sensitive Data.This issue affects Cost Calculator Builder: from n/a through 4.0.17.
CVE-2026-103062 2 Cozmoslabs, Wordpress-extensions 2 Translatepress, Translatepress 2026-10-05 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allows Stored XSS.This issue affects TranslatePress: from n/a through 3.3.6.
CVE-2026-96451 2 Ultimatemember, Wordpress-extensions 2 Ultimate Member, Ultimate Member 2026-10-05 8.8 High
Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1.
CVE-2026-104402 2 Farvisun, Wordpress-extensions 2 Mindio Magic Mcp, Mindio Magic Mcp 2026-10-05 4.3 Medium
Insertion of Sensitive Information Into Sent Data vulnerability in farvisun Mindio Magic MCP mindio-magic-mcp allows Retrieve Embedded Sensitive Data.This issue affects Mindio Magic MCP: from n/a through 0.5.6.
CVE-2026-103344 2 Unlimited-elements, Wordpress-extensions 2 Unlimited Elements For Elementor (free Widgets, Addons, Templates), Unlimited Elements For Elementor 2026-10-05 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20.
CVE-2026-86817 1 Wordpress-extensions 1 Five Star Business Profile And Schema 2026-10-05 4.9 Medium
The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly restrict the callbacks used to resolve schema field default values, allowing authenticated users with Author-level access and above to store input that discloses sensitive data, including other users' password hashes and arbitrary site option values, in public output readable by unauthenticated visitors.
CVE-2026-94171 2 Villatheme, Wordpress-extensions 2 Curcy, Curcy 2026-10-05 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme CURCY woo-multi-currency allows DOM-Based XSS.This issue affects CURCY: 2.2.18.
CVE-2026-93549 1 Wordpress-extensions 1 Cocart 2026-10-05 8.8 High
The CoCart WordPress plugin before 4.9.7 does not scope its REST API authentication filter to its own endpoints, which disables WordPress core's REST nonce protection for every route, allowing an attacker to perform a cross-site request forgery attack that creates a new administrator account using a logged-in administrator's session.
CVE-2026-17005 1 Wordpress-extensions 1 Horizontal Scrolling Announcements 2026-10-05 6.8 Medium
The Horizontal scrolling announcements WordPress plugin through 2.6 does not sanitise and escape one of its announcement settings before outputting it into an attribute context on the front end, allowing users granted access to the announcement management page (Contributor and above, once permitted) to perform Stored Cross-Site Scripting attacks that execute in the browser of anyone viewing the announcement.
CVE-2026-104119 1 Wordpress-extensions 1 Simple Shopping Cart 2026-10-05 3.5 Low
The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of its settings field values before outputting them on an admin settings page, allowing high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, which is notably impactful on multisite installations where administrators do not have the unfiltered_html capability.