Filtered by vendor Wordpress-extensions Subscriptions
Total 1138 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-15696 1 Wordpress-extensions 1 Real3d Flipbook Lite 2026-09-27 6.8 Medium
The Real3D Flipbook WordPress plugin before 5.4 does not sanitize or escape several flipbook editor fields before rendering them back in the admin editor, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any user who later opens the affected flipbook for editing, including administrators.
CVE-2026-14321 1 Wordpress-extensions 1 Divi Dash 2026-09-27 8.2 High
The divi-dash WordPress plugin before 1.0.7 does not validate the source of the client IP address it uses for rate limiting and banning, allowing unauthenticated attackers to spoof arbitrary IP addresses in order to bypass rate limiting, ban chosen addresses from the feature, and grow a stored option without bound, resulting in denial of service.
CVE-2026-16264 1 Wordpress-extensions 1 Newsletters 2026-09-27 6.5 Medium
The Newsletters WordPress plugin before 4.18.1 does not perform an ownership check on some of its subscriber management actions, and issues a management session to unauthenticated visitors on request, allowing attackers to read any subscriber's personal data and overwrite any subscriber's record including their email address.
CVE-2026-18364 1 Wordpress-extensions 1 Zportals 2026-09-27 4.3 Medium
The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on several of its AJAX actions, allowing users with a subscriber-level account to modify the zportals WordPress plugin before 6.4.2's stored integration settings.
CVE-2026-18365 1 Wordpress-extensions 1 Zportals 2026-09-27 4.3 Medium
The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on one of its AJAX actions, allowing users with a subscriber-level account to disclose the display name and email address of every registered user, including administrators.
CVE-2026-75799 1 Wordpress-extensions 1 Yahman Add-ons 2026-09-27 9 Critical
The YAHMAN Add-ons WordPress plugin before 0.9.31 does not validate the type of the remote files it caches in a publicly accessible directory, allowing unauthenticated attackers to write arbitrary PHP files on the server and achieve RCE when the relevant feature is enabled.
CVE-2026-84091 1 Wordpress-extensions 1 Sumit Payment Gateway For Woocommerce 2026-09-27 5.3 Medium
The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not verify with the payment provider that a payment notification is genuine before marking the corresponding order as paid, allowing unauthenticated users to mark a pending order paid without completing payment.
CVE-2026-88974 2 Wordpress-extensions, Wpgraphql 2 Wpgraphql, Wpgraphql 2026-09-27 5.4 Medium
WPGraphQL provides a GraphQL API for WordPress sites. Prior to 2.22.2, the updatePost mutation in src/Mutation/PostObjectUpdate.php checks only the collection-level edit_posts capability and the post author, but does not enforce the object-level edit_post capability or require publish_posts for public status transitions. An authenticated Contributor can therefore publish the Contributor's own draft without editorial approval or modify the Contributor's previously published post despite lacking edit_published_posts, while posts owned by other authors remain protected. This issue is fixed in version 2.22.2.
CVE-2026-93620 2 Payplus, Wordpress-extensions 2 Payplus Payment Gateway, Payplus Payment Gateway 2026-09-27 6.5 Medium
Unauthenticated Broken Access Control in PayPlus Payment Gateway <= 8.2.5 versions.
CVE-2026-93773 2 Wobbie, Wordpress-extensions 2 Mollie Forms, Mollie Forms 2026-09-27 8.5 High
Contributor SQL Injection in Mollie Forms <= 2.11.0 versions.
CVE-2026-94079 2 Wordpress-extensions, Wpusermanager 2 Wp User Manager, Wp User Manager 2026-09-27 5.3 Medium
Unauthenticated Broken Access Control in WP User Manager <= 2.9.19 versions.
CVE-2026-95528 2 Magazine3, Wordpress-extensions 2 Core Web Vitals & Pagespeed Booster, Core Web Vitals& Pagespeed Booster 2026-09-27 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Core Web Vitals & PageSpeed Booster <= 1.0.31 versions.
CVE-2026-95530 2 Pixelyoursite, Wordpress-extensions 2 Pixelyoursite – Your Smart Pixel (tag) Manager, Pixelyoursite 2026-09-27 6.5 Medium
Subscriber Cross Site Scripting (XSS) in PixelYourSite – Your smart PIXEL (TAG) Manager <= 11.4.1 versions.
CVE-2026-95592 2 Radiustheme, Wordpress-extensions 2 Team, Team 2026-09-27 5.3 Medium
Unauthenticated Insecure Direct Object References (IDOR) in Team <= 6.0.0 versions.
CVE-2026-95600 2 Trustedlogin, Wordpress-extensions 2 Trustedlogin, Trustedlogin Connector 2026-09-27 5.3 Medium
Unauthenticated Sensitive Data Exposure in TrustedLogin Connector <= 2.0.3 versions.
CVE-2026-95602 2 Wordpress-extensions, Yithemes 2 Yith Woocommerce Request A Quote, Yith Woocommerce Request A Quote 2026-09-27 6.5 Medium
Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects YITH WooCommerce Request A Quote: from n/a before 4.46.1.
CVE-2026-80513 1 Wordpress-extensions 1 Wpforo Forum 2026-09-27 7.5 High
The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing authenticated users with Subscriber-level access and above to inject a PHP Object. No POP chain is present in the wpForo Forum WordPress plugin before 3.1.6 itself; if one is present via another installed wpForo Forum WordPress plugin before 3.1.6 or , this could lead to remote code execution, arbitrary file operations, or SQL injection. This is an incomplete fix of CVE-2026-49769.
CVE-2026-82195 1 Wordpress-extensions 1 10web Booster 2026-09-27 6.5 Medium
The 10Web Booster WordPress plugin before 2.34.0 does not restrict access to the routine which issues the shared secret that authenticates its cloud connection, disclosing that secret to unauthenticated visitors and letting them delete it repeatedly, preventing an administrator from completing a legitimate connection.
CVE-2026-82849 1 Wordpress-extensions 1 Masteriyo Lms 2026-09-27 4.3 Medium
The Masteriyo LMS WordPress plugin before 3.4.2 does not verify that the user making the request owns the course-progress records being returned, allowing any authenticated user, such as a self-registered subscriber, to read another user's learning activity. The ownership check it applies is skipped whenever the requested account is not named with a non-zero value, in which case the records of every learner on the site are returned at once.
CVE-2026-82850 1 Wordpress-extensions 1 Masteriyo Lms 2026-09-27 4.3 Medium
The Masteriyo LMS WordPress plugin before 3.4.2 does not restrict access to quiz answer keys, allowing any authenticated user, such as a student, to retrieve the correct answers for any quiz on the site, including quizzes in courses they are not enrolled in. The redaction that hides them is applied only to a fixed list of question types, so the answers to every other type are returned in full to anyone able to view the questions.