Baza CVE
Wszystkie technologie
| Oprogramowanie | Podatność i krótki opis | Zapisz | |||
|---|---|---|---|---|---|
| YMC Filter | CVE-2026-109983 The YMC Filter plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'post_title' parameter in all versions up to, and including, 3.12.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level… |
6,4 | 0,22 % | Brak wpisu w KEV nie wyklucza ataków | |
| weForms – Easy Drag & Drop Contact Form Builder For WordPress | CVE-2026-110253 The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the weforms_delete_entry_attachments function in all versions up to, and including, 1.6.28 This makes it possible for… |
5,4 | 0,28 % | Brak wpisu w KEV nie wyklucza ataków | |
| Payment forms, Buy now buttons, and Invoicing System | GetPaid | CVE-2026-111110 The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mmdwqzpoxadd' parameter in all versions up to, and including, 2.8.61 due to insufficient input sanitization and output escaping. This makes it possible for… |
7,2 | 0,28 % | Brak wpisu w KEV nie wyklucza ataków | |
| European VAT Compliance Assistant for WooCommerce | CVE-2026-100316 The European VAT Compliance Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via CF-IPCountry Header in all versions up to, and including, 1.36.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated… |
7,2 | 0,27 % | Brak wpisu w KEV nie wyklucza ataków | |
| Fancy Comments WordPress | CVE-2026-110384 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Heateor Support Fancy Comments WordPress fancy-facebook-comments allows Reflected XSS.This issue affects Fancy Comments WordPress: from n/a through 1.2.21. |
7,1 | 0,19 % | Brak wpisu w KEV nie wyklucza ataków | |
| Patreon WordPress | CVE-2026-92431 The Patreon WordPress plugin before 1.10.0 does not perform an authorization check on some of its functionality, allowing unauthenticated users to enumerate the names of terms in any taxonomy, including non-public taxonomies that WordPress does not expose on the front end. |
3,7 | 0,17 % | Brak wpisu w KEV nie wyklucza ataków | |
| Patreon WordPress | CVE-2026-92432 The Patreon WordPress plugin before 1.10.0 does not validate a user-supplied redirect destination before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL through a crafted link, which is useful for phishing. |
4,3 | 0,16 % | Brak wpisu w KEV nie wyklucza ataków | |
| Patreon WordPress | CVE-2026-92433 The Patreon WordPress plugin before 1.10.0 does not verify a nonce when connecting the site to a Patreon account, allowing attackers to make a logged-in administrator re-link the integration to an attacker-controlled account via a crafted request (CSRF), taking over the site's Patreon integration. |
6,5 | 0,14 % | Brak wpisu w KEV nie wyklucza ataków | |
| ThirstyAffiliates | CVE-2026-97314 The ThirstyAffiliates WordPress plugin before 3.12.1 does not check the status or type of the object requested by its link redirect tracking handler, allowing unauthenticated attackers to disclose the destination URLs of unpublished affiliate links and to record fabricated click statistics. |
6,5 | 0,18 % | Brak wpisu w KEV nie wyklucza ataków | |
| Ukr-To-Lat | CVE-2026-104122 The Ukr-To-Lat WordPress plugin through 1.3.5 does not sanitize and escape a term name before using it in a SQL query, allowing users with Contributor-level access and above to perform SQL injection attacks. |
6,8 | 0,22 % | Brak wpisu w KEV nie wyklucza ataków | |
| Contact Form 7 Signature Addon | CVE-2026-104246 The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value before building an email attachment path from it, allowing unauthenticated users to attach arbitrary files (bounded to wp-content on current Contact Form 7) to a form's outgoing email via… |
5,9 | 0,28 % | Brak wpisu w KEV nie wyklucza ataków | |
| WP Data Access | CVE-2026-106470 The WP Data Access WordPress plugin before 5.5.88 does not have authorisation and CSRF checks in one of its actions, allowing any authenticated user, such as a subscriber, to make the server open connections to arbitrary hosts and ports, including internal ones, and read back the outcome. |
5,0 | 0,11 % | Brak wpisu w KEV nie wyklucza ataków | |
| WP User Manager | CVE-2026-110527 The WP User Manager WordPress plugin before 2.9.20 does not roll back the WordPress account it creates during payment-gated registration when the subsequent payment step fails, allowing unauthenticated users to create functional accounts without completing payment. |
5,3 | 0,18 % | Brak wpisu w KEV nie wyklucza ataków | |
| ACF Frontend Admin by DynamiApps | CVE-2026-81343 The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not perform a capability check on one of its form-submission actions before writing submitted values into the site's global ACF options store, allowing unauthenticated visitors to overwrite site-wide option values via a… |
5,3 | 0,17 % | Brak wpisu w KEV nie wyklucza ataków | |
| ACF Frontend Admin by DynamiApps | CVE-2026-81344 The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not restrict which PHP classes may be instantiated when it deserialises stored post content that is rendered on public-facing pages, allowing high-privilege users such as administrators to inject a PHP object which, given a… |
6,6 | 0,34 % | Brak wpisu w KEV nie wyklucza ataków | |
| BSK PDF Manager | CVE-2026-91074 The BSK PDF Manager WordPress plugin through 3.8.1 does not properly sanitise and escape a parameter before using it in a SQL statement, which could allow authenticated users with contributor-level access and above to perform SQL injection attacks and read sensitive data such as administrator… |
6,8 | 0,22 % | Brak wpisu w KEV nie wyklucza ataków | |
| PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) | CVE-2026-103376 The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) WordPress plugin before 1.120.70 does not perform any capability or ownership check before returning an order's secret key in response to an unauthenticated request, allowing anyone to… |
5,3 | 0,19 % | Brak wpisu w KEV nie wyklucza ataków | |
| Tutor LMS – eLearning and online course solution | CVE-2026-92715 The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the 'ID' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers,… |
4,3 | 0,2 % | Brak wpisu w KEV nie wyklucza ataków | |
| User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder | CVE-2026-92798 The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 5.2.8 This is due to insufficient input sanitization in the 'referrer_url' branch of UR_Smart_Tags::process(), where the attacker-controlled HTTP_REFERER header… |
8,1 | 0,37 % | Brak wpisu w KEV nie wyklucza ataków | |
| User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder | CVE-2026-92978 The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.2.8 This is due to missing or incorrect… |
4,3 | 0,15 % | Brak wpisu w KEV nie wyklucza ataków | |
| User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder | CVE-2026-96660 The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Checkbox Field Value in all versions up to, and including, 5.2.8 due to… |
7,2 | 0,23 % | Brak wpisu w KEV nie wyklucza ataków | |
| Post Export Import with Media | CVE-2026-110268 The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.2 via the 'theme_slug' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to perform actions on files… |
4,9 | 0,77 % | Brak wpisu w KEV nie wyklucza ataków | |
| Themify Builder | CVE-2026-111726 The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'visible' Shortcode Attribute in all versions up to, and including, 7.8.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level… |
6,4 | 0,19 % | Brak wpisu w KEV nie wyklucza ataków | |
| WP Booking System – Booking Calendar | CVE-2026-109368 The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.0.3 via the 'id' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract private… |
6,5 | 0,26 % | Brak wpisu w KEV nie wyklucza ataków | |
| WP Booking System – Booking Calendar | CVE-2026-109369 The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers,… |
6,8 | 0,25 % | Brak wpisu w KEV nie wyklucza ataków |
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 13.11.2026, 23:02 UTC – 14.11.2026, 04:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.