Filtered by vendor Wordpress Subscriptions
Total 13374 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-2410 2 Themeisle, Wordpress 2 Disable Admin Notices – Hide Dashboard Notifications, Wordpress 2026-04-15 4.3 Medium
The Disable Admin Notices – Hide Dashboard Notifications plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.2. This is due to missing nonce validation in the `showPageContent()` function. This makes it possible for unauthenticated attackers to add arbitrary URLs to the blocked redirects list via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVE-2026-2301 2 Metaphorcreations, Wordpress 2 Post Duplicator, Wordpress 2026-04-15 4.3 Medium
The Post Duplicator plugin for WordPress is vulnerable to unauthorized arbitrary protected post meta insertion in all versions up to, and including, 3.0.8. This is due to the `duplicate_post()` function in `includes/api.php` using `$wpdb->insert()` directly to the `wp_postmeta` table instead of WordPress's standard `add_post_meta()` function, which would call `is_protected_meta()` to prevent lower-privileged users from setting protected meta keys (those starting with `_`). This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary protected post meta keys such as `_wp_page_template`, `_wp_attached_file`, and other sensitive meta keys on duplicated posts via the `customMetaData` JSON array parameter in the `/wp-json/post-duplicator/v1/duplicate-post` REST API endpoint.
CVE-2026-2367 2 Ays-pro, Wordpress 2 Secure Copy Content Protection And Content Locking, Wordpress 2026-04-15 6.4 Medium
The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ays_block' shortcode in all versions up to, and including, 5.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2026-1779 2 Wordpress, Wpeverest 2 Wordpress, User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder 2026-04-15 8.1 High
The User Registration & Membership plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.1.2. This is due to incorrect authentication in the 'register_member' function. This makes it possible for unauthenticated attackers to log in a newly registered user on the site who has the 'urm_user_just_created' user meta set.
CVE-2026-2428 2 Techjewel, Wordpress 2 Fluent Forms Pro Add On Pack, Wordpress 2026-04-15 7.5 High
The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in all versions up to, and including, 6.1.17. This is due to the PayPal IPN (Instant Payment Notification) verification being disabled by default (`disable_ipn_verification` defaults to `'yes'` in `PayPalSettings.php`). This makes it possible for unauthenticated attackers to send forged PayPal IPN notifications to the publicly accessible IPN endpoint, marking unpaid form submissions as "paid" and triggering post-payment automation (emails, access grants, digital product delivery).
CVE-2026-3058 3 S-sols, Seraphinitesolutions, Wordpress 3 Seraphinite Accelerator, Seraphinite Accelerator, Wordpress 2026-04-15 4.3 Medium
The Seraphinite Accelerator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.28.14 via the `seraph_accel_api` AJAX action with `fn=GetData`. This is due to the `OnAdminApi_GetData()` function not performing any capability checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive operational data including cache status, scheduled task information, and external database state.
CVE-2026-1900 2 Linkwhisper, Wordpress 3 Link Whisper, Link Whisper Free, Wordpress 2026-04-15 6.5 Medium
The Link Whisper Free WordPress plugin before 0.9.1 has a publicly accessible REST endpoint that allows unauthenticated settings updates.
CVE-2026-3881 2 Performance Monitor, Wordpress 2 Performance Monitor, Wordpress 2026-04-15 5.8 Medium
The Performance Monitor WordPress plugin through 1.0.6 does not validate a parameter before making a request to it, which could allow unauthenticated users to perform SSRF attacks
CVE-2026-3830 2 Wbw, Wordpress 2 Product Filter For Woocommerce, Wordpress 2026-04-15 8.6 High
The Product Filter for WooCommerce by WBW WordPress plugin before 3.1.3 does not sanitize and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks
CVE-2026-2626 2 Divi-booster, Wordpress 2 Divi-booster, Wordpress 2026-04-15 8.1 High
The divi-booster WordPress plugin before 5.0.2 does not have authorization and CSRF checks in one of its fixing function, allowing unauthenticated users to modify stored divi-booster WordPress plugin before 5.0.2 options. Furthermore, due to the use of unserialize() on the data, this could be further exploited when combined with a PHP gadget chain to achieve PHP Object Injection
CVE-2026-2466 2 Dukapress, Wordpress 2 Dukapress, Wordpress 2026-04-15 7.1 High
The DukaPress WordPress plugin through 3.2.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVE-2025-15445 2 Restaurant Cafeteria, Wordpress 2 Restaurant Cafeteria, Wordpress 2026-04-15 5.4 Medium
The Restaurant Cafeteria WordPress theme through 0.4.6 exposes insecure admin-ajax actions without nonce or capability checks, allowing any logged-in user, like subscriber, to perform privileged operations. An attacker can install and activate a from a user-supplied URL, leading to arbitrary PHP code execution, and also import demo content that rewrites site configuration, including Restaurant Cafeteria WordPress theme through 0.4.6_mods, pages, menus, and front page settings.
CVE-2025-15363 2 Berkux, Wordpress 2 Get Use Apis, Wordpress 2026-04-15 5.9 Medium
The Get Use APIs WordPress plugin before 2.0.10 executes imported JSON, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks under certain server configurations.
CVE-2025-15488 2 Responsive, Wordpress 2 Responsive Menu, Wordpress 2026-04-15 6.5 Medium
The Responsive Plus WordPress plugin before 3.4.3 is vulnerable to arbitrary shortcode execution due to the software allowing unauthenticated users to execute the update_responsive_woo_free_shipping_left_shortcode AJAX action that does not properly validate the content_rech_data parameter before processing it as a shortcode.
CVE-2026-2687 2 Reading Progressbar, Wordpress 2 Reading Progressbar, Wordpress 2026-04-15 4.3 Medium
The Reading progressbar WordPress plugin before 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVE-2025-15484 2 Order Notification For Woocommerce, Wordpress 2 Order Notification For Woocommerce, Wordpress 2026-04-15 9.1 Critical
The Order Notification for WooCommerce WordPress plugin before 3.6.3 overrides WooCommerce's permission checks to grant full access to all unauthenticated requests, enabling complete read/write access to store resources like products, coupons, and customers.
CVE-2026-1430 2 Syedbalkhi, Wordpress 2 Wp Lightbox 2, Wordpress 2026-04-15 4.8 Medium
The WP Lightbox 2 WordPress plugin before 3.0.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVE-2026-1969 2 Themerex, Wordpress 2 Addons, Wordpress 2026-04-15 5.3 Medium
The trx_addons WordPress plugin before 2.38.5 does not correctly validate file types in one of its AJAX action, allowing unauthenticated users to upload arbitrary file. This is due to an incorrect fix of CVE-2024-13448
CVE-2026-1540 2 Spam Protect For Contact Form 7, Wordpress 2 Spam Protect For Contact Form 7, Wordpress 2026-04-15 7.2 High
The Spam Protect for Contact Form 7 WordPress plugin before 1.2.10 allows logging to a PHP file, which could allow an attacker with editor access to achieve Remote Code Execution by using a crafted header
CVE-2025-15433 2 Sharedfilespro, Wordpress 2 Shared Files, Wordpress 2026-04-15 6.8 Medium
The Shared Files WordPress plugin before 1.7.58 allows users with a role as low as Contributor to download any file on the web server (such as wp-config.php) via a path traversal vector