Filtered by vendor Wordpress-extensions Subscriptions
Total 983 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-96897 1 Wordpress-extensions 1 Optima Express Idx 2026-09-28 5.3 Medium
The Optima Express IDX WordPress plugin before 8.7.6 does not perform any authorisation check on one of its AJAX actions that is available to logged-out users, allowing unauthenticated attackers to force the creation of a fixed author-role account and to repeatedly rotate its application password on any connected install.
CVE-2026-96899 1 Wordpress-extensions 1 Optima Express Idx 2026-09-28 6.8 Medium
The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value submitted through one of its REST endpoints before storing it and echoing it into the document head when the post is rendered, allowing users with a role as low as author to perform Stored Cross-Site Scripting attacks.
CVE-2026-97319 1 Wordpress-extensions 1 Powerpress 2026-09-28 6.8 Medium
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.2 does not sanitize and escape a block attribute before outputting it in a page, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVE-2026-86785 1 Wordpress-extensions 1 Social Commerce For Woocommerce 2026-09-27 5.3 Medium
The Social Commerce for WooCommerce WordPress plugin through 2.5.4 does not have authorisation checks on some of its REST API endpoints, allowing unauthenticated users to update Social Commerce for WooCommerce WordPress plugin through 2.5.4 configuration and product synchronisation state.
CVE-2022-4997 1 Wordpress-extensions 1 Jet Form Builder Stripe Gateway 2026-09-27 8.6 High
The jet-form-builder-stripe-gateway WordPress plugin before 1.1.0 does not sanitise and escape a payment token before using it in a SQL statement, allowing unauthenticated users to extract arbitrary data from the database, including password hashes.
CVE-2025-15696 1 Wordpress-extensions 1 Real3d Flipbook Lite 2026-09-27 6.8 Medium
The Real3D Flipbook WordPress plugin before 5.4 does not sanitize or escape several flipbook editor fields before rendering them back in the admin editor, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any user who later opens the affected flipbook for editing, including administrators.
CVE-2026-14321 1 Wordpress-extensions 1 Divi Dash 2026-09-27 8.2 High
The divi-dash WordPress plugin before 1.0.7 does not validate the source of the client IP address it uses for rate limiting and banning, allowing unauthenticated attackers to spoof arbitrary IP addresses in order to bypass rate limiting, ban chosen addresses from the feature, and grow a stored option without bound, resulting in denial of service.
CVE-2026-16264 1 Wordpress-extensions 1 Newsletters 2026-09-27 6.5 Medium
The Newsletters WordPress plugin before 4.18.1 does not perform an ownership check on some of its subscriber management actions, and issues a management session to unauthenticated visitors on request, allowing attackers to read any subscriber's personal data and overwrite any subscriber's record including their email address.
CVE-2026-18364 1 Wordpress-extensions 1 Zportals 2026-09-27 4.3 Medium
The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on several of its AJAX actions, allowing users with a subscriber-level account to modify the zportals WordPress plugin before 6.4.2's stored integration settings.
CVE-2026-18365 1 Wordpress-extensions 1 Zportals 2026-09-27 4.3 Medium
The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on one of its AJAX actions, allowing users with a subscriber-level account to disclose the display name and email address of every registered user, including administrators.
CVE-2026-75799 1 Wordpress-extensions 1 Yahman Add-ons 2026-09-27 9 Critical
The YAHMAN Add-ons WordPress plugin before 0.9.31 does not validate the type of the remote files it caches in a publicly accessible directory, allowing unauthenticated attackers to write arbitrary PHP files on the server and achieve RCE when the relevant feature is enabled.
CVE-2026-84091 1 Wordpress-extensions 1 Sumit Payment Gateway For Woocommerce 2026-09-27 5.3 Medium
The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not verify with the payment provider that a payment notification is genuine before marking the corresponding order as paid, allowing unauthenticated users to mark a pending order paid without completing payment.
CVE-2026-88974 2 Wordpress-extensions, Wpgraphql 2 Wpgraphql, Wpgraphql 2026-09-27 5.4 Medium
WPGraphQL provides a GraphQL API for WordPress sites. Prior to 2.22.2, the updatePost mutation in src/Mutation/PostObjectUpdate.php checks only the collection-level edit_posts capability and the post author, but does not enforce the object-level edit_post capability or require publish_posts for public status transitions. An authenticated Contributor can therefore publish the Contributor's own draft without editorial approval or modify the Contributor's previously published post despite lacking edit_published_posts, while posts owned by other authors remain protected. This issue is fixed in version 2.22.2.
CVE-2026-93620 2 Payplus, Wordpress-extensions 2 Payplus Payment Gateway, Payplus Payment Gateway 2026-09-27 6.5 Medium
Unauthenticated Broken Access Control in PayPlus Payment Gateway <= 8.2.5 versions.
CVE-2026-93773 2 Wobbie, Wordpress-extensions 2 Mollie Forms, Mollie Forms 2026-09-27 8.5 High
Contributor SQL Injection in Mollie Forms <= 2.11.0 versions.
CVE-2026-94079 2 Wordpress-extensions, Wpusermanager 2 Wp User Manager, Wp User Manager 2026-09-27 5.3 Medium
Unauthenticated Broken Access Control in WP User Manager <= 2.9.19 versions.
CVE-2026-95528 2 Magazine3, Wordpress-extensions 2 Core Web Vitals & Pagespeed Booster, Core Web Vitals& Pagespeed Booster 2026-09-27 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Core Web Vitals & PageSpeed Booster <= 1.0.31 versions.
CVE-2026-95530 2 Pixelyoursite, Wordpress-extensions 2 Pixelyoursite – Your Smart Pixel (tag) Manager, Pixelyoursite 2026-09-27 6.5 Medium
Subscriber Cross Site Scripting (XSS) in PixelYourSite – Your smart PIXEL (TAG) Manager <= 11.4.1 versions.
CVE-2026-95592 2 Radiustheme, Wordpress-extensions 2 Team, Team 2026-09-27 5.3 Medium
Unauthenticated Insecure Direct Object References (IDOR) in Team <= 6.0.0 versions.
CVE-2026-95600 2 Trustedlogin, Wordpress-extensions 2 Trustedlogin, Trustedlogin Connector 2026-09-27 5.3 Medium
Unauthenticated Sensitive Data Exposure in TrustedLogin Connector <= 2.0.3 versions.