Baza CVE
Wszystkie technologie
| Oprogramowanie | Podatność i krótki opis | Zapisz | |||
|---|---|---|---|---|---|
| User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin | CVE-2026-87111 The User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Referer Header in all versions up to, and including, 6.2.9 due to insufficient input sanitization and output escaping. This… |
7,2 | 0,19 % | Brak wpisu w KEV nie wyklucza ataków | |
| SureDash – Community, Courses & Member Dashboard | CVE-2026-96870 The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated… |
6,4 | 0,2 % | Brak wpisu w KEV nie wyklucza ataków | |
| Social Share Buttons | CVE-2026-100108 The Social Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form (containing share_url)' parameter in all versions up to, and including, 1.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with… |
6,4 | 0,19 % | Brak wpisu w KEV nie wyklucza ataków | |
| Mattermost | CVE-2026-16251 Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to limit the size of remote image responses buffered in memory during local image proxy direct fetches, which allows a remote attacker to cause memory exhaustion on the server via a crafted oversized… |
6,5 | 0,29 % | Brak wpisu w KEV nie wyklucza ataków | |
| Mattermost | CVE-2026-16453 Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to verify the integrity of the SAML RelayState POST parameter which allows an authenticated SAML user to join any team, including invite-only teams, via forging the team_id or invite_id fields in the… |
7,1 | 0,19 % | Brak wpisu w KEV nie wyklucza ataków | |
| Mattermost | CVE-2026-18223 Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the invited recipient's email address when redeeming team and guest invitation tokens, which allows an authenticated attacker to join a team or gain unauthorized access to private channels… |
5,0 | 0,16 % | Brak wpisu w KEV nie wyklucza ataków | |
| Mattermost | CVE-2026-18256 Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to properly restrict private teams from public team search results, which allows an authenticated user without permission to list private teams to disclose the ID, name, and display name of private… |
4,3 | 0,16 % | Brak wpisu w KEV nie wyklucza ataków | |
| Mattermost | CVE-2026-18560 Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate user’s permissions before other validations which allows non-content reviewers to infer a post’s flagged status via direct API call.. Mattermost Advisory ID: MMSA-2026-00754 |
4,3 | 0,18 % | Brak wpisu w KEV nie wyklucza ataków | |
| FiboSearch – Ajax Search for WooCommerce | CVE-2026-100106 The FiboSearch – Ajax Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'purchased_plan' parameter in all versions up to, and including, 1.34.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated… |
6,4 | 0,23 % | Brak wpisu w KEV nie wyklucza ataków | |
| Coinsnap Bitcoin Crowdfunding | CVE-2026-92427 The Coinsnap Bitcoin Crowdfunding WordPress plugin through 1.2.0 does not restrict access to the secret used to authenticate its payment gateway webhook, disclosing it to unauthenticated users and rendering the webhook's signature check ineffective. This allows unauthenticated attackers to forge… |
5,3 | 0,19 % | Brak wpisu w KEV nie wyklucza ataków | |
| YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports | CVE-2026-92553 The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.7.7 via the putFile function. This is due to insufficient file type validation in the putFile function, as sanitize_file_name() does… |
8,8 | 0,56 % | Brak wpisu w KEV nie wyklucza ataków | |
| The Grid | CVE-2026-94169 Improper Control of Generation of Code ('Code Injection') vulnerability in Theme-one The Grid the-grid allows Command Injection.This issue affects The Grid: from n/a through 2.8.1. |
10,0 | 4,42 % | Brak wpisu w KEV nie wyklucza ataków | |
| Green Popups | CVE-2026-94388 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in halfdata Green Popups halfdata-green-popups allows Blind SQL Injection.This issue affects Green Popups: from n/a before 7.6.3. |
9,3 | 0,23 % | Brak wpisu w KEV nie wyklucza ataków | |
| Houzez | CVE-2026-96339 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Houzez.co Houzez houzez allows Reflected XSS.This issue affects Houzez: from n/a through 4.4.0. |
7,1 | 0,14 % | Brak wpisu w KEV nie wyklucza ataków | |
| Gravity Forms | CVE-2026-97296 Deserialization of Untrusted Data vulnerability in Rocketgenius, Inc Gravity Forms gravityforms allows Object Injection.This issue affects Gravity Forms: from n/a before 3.1.1. |
8,1 | 0,25 % | Brak wpisu w KEV nie wyklucza ataków | |
| WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) | CVE-2026-97640 The WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS) in all versions up to, and including,… |
7,2 | 0,24 % | Brak wpisu w KEV nie wyklucza ataków | |
| WP Map Block – Google Maps, OpenStreetMap, Mapbox, Store & Shop Locator, Directory, Listings & Filters | CVE-2026-19798 The Wp Map Block plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the set_status() and bulk() functions in the Maps_Controller REST controller in versions up to, and including, 3.0.0. The plugin's permission_callback (can_edit()) only… |
4,3 | 0,2 % | Brak wpisu w KEV nie wyklucza ataków | |
| Mattermost | CVE-2026-19867 Mattermost versions 11.10.x <= 11.10.0, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to cap the number and size of mention keys stored in a user's notification properties, and to bound the quadratic multibyte-keyword matching performed for each post, which allows an authenticated… |
4,3 | 0,22 % | Brak wpisu w KEV nie wyklucza ataków | |
| Document Gallery | CVE-2026-74923 The Document Gallery WordPress plugin through 5.1.1 does not perform any capability or ownership check when generating a gallery on demand, allowing unauthenticated users to enumerate and disclose the titles, descriptions and direct file URLs of media attached to unpublished, private or trashed… |
5,3 | 0,21 % | Brak wpisu w KEV nie wyklucza ataków | |
| Subscribe to Comments | CVE-2026-91830 The Subscribe to Comments WordPress plugin before 2.3.3 does not sign or validate a cookie it trusts to identify a commenter, allowing unauthenticated attackers to disclose a subscriber's management key and silently alter that subscriber's subscriptions. |
6,5 | 0,18 % | Brak wpisu w KEV nie wyklucza ataków | |
| WX Subscribe 微信支付付费订阅 | CVE-2026-91833 The WX Subscribe 微信支付付费订阅 WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks on installs where the payment key has not been configured. |
6,8 | 0,22 % | Brak wpisu w KEV nie wyklucza ataków | |
| WP Photo Album Plus | CVE-2026-92115 The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Command Injection in all versions up to, and including, 9.3.02.002 via the `value` parameter of the `update-photo` AJAX action. This is due to insufficient shell escaping within the `wppa_image_magick_a()` function, where… |
8,8 | 1,43 % | Brak wpisu w KEV nie wyklucza ataków | |
| User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder | CVE-2026-15222 The The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.2.8. This is due to the software… |
5,4 | 0,18 % | Brak wpisu w KEV nie wyklucza ataków | |
| Mattermost | CVE-2026-18551 Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the combination of guest and admin scheme roles which allows an authenticated attacker to escalate a guest account to team or channel admin via a crafted PUT request to the member roles… |
6,5 | 0,22 % | Brak wpisu w KEV nie wyklucza ataków | |
| Mattermost | CVE-2026-18795 Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to enforce DM/GM check on server side which allows an authenticated user to quarantine a post belonging to DM or GM via direct API call.. Mattermost Advisory ID: MMSA-2026-00756 |
6,4 | 0,15 % | Brak wpisu w KEV nie wyklucza ataków |
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 14.11.2026, 23:02 UTC – 15.11.2026, 04:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.