Baza CVE
Wszystkie technologie
| Oprogramowanie | Podatność i krótki opis | Zapisz | |||
|---|---|---|---|---|---|
| cifs-utils / Red Hat OpenShift Container Platform 4 / Red Hat OpenShift Container Platform 5 | CVE-2026-104715 A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-controlled credentials file, input values are not properly sanitized before being assembled into… |
7,8 | 0,27 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers | CVE-2026-104730 The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.4 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP… |
9,8 | 0,51 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| WP Compress – Instant Performance & Speed Optimization | CVE-2026-104755 The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.25.00 The vulnerability exists because the `start_comms` dispatcher (`wps_ic_comms::start_comms`), hooked on every front-end request, gates… |
4,8 | 0,31 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Visual Form Builder | CVE-2026-105973 The Visual Form Builder WordPress plugin through 3.1 does not perform authorization or nonce checks when reordering form fields, allowing any authenticated user (Subscriber and above) to alter the field structure of any form on the site, persistently breaking its public rendering. |
4,3 | 0,19 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Visual Form Builder | CVE-2026-105974 The Visual Form Builder WordPress plugin through 3.1 does not perform an authorization check before displaying recent form submission data in a dashboard widget, allowing any authenticated user (Subscriber and above) to read other users' submitted contact information, including names, email… |
4,3 | 0,22 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| HUSKY – Products Filter for WooCommerce Professional | CVE-2026-107646 The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.5 via the 'woof_settings[woof_stat][server_options]' parameter. This makes it possible for unauthenticated attackers to extract… |
5,3 | 0,35 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Mobile builder | CVE-2026-103696 The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks on sites that also run the WCFM Delivery add-on. |
6,8 | 0,27 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights | CVE-2026-95809 The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'country_name' Location Parameter in all versions up to, and including, 1.9.2.1 due to insufficient input sanitization… |
7,2 | 0,25 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Schema & Structured Data for WP & AMP | CVE-2026-96570 The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswp_review_text' parameter in all versions up to, and including, 1.67 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated… |
7,2 | 0,31 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Hide My WP Ghost – Security & Firewall | CVE-2026-89051 The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'replaceHeadersAndTags' function in versions up to, and including, 7.0.12 due to insufficient input sanitization and output escaping. This makes it possible for… |
7,2 | 0,19 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Theme My Login | CVE-2026-89079 The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to… |
9,8 | 1,63 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Tainacan | CVE-2026-93767 The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 'guid' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server,… |
6,5 | 0,57 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights | CVE-2026-95686 The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'targetUrl' parameter in all versions up to, and including, 1.9.2.1 due to insufficient input sanitization and… |
7,2 | 0,28 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| PilotPress | CVE-2026-85659 The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 2.0.43. The vulnerability exists because the `update_cc_details()` AJAX handler forwards an attacker-supplied `username` parameter to ONTRAPORT via… |
8,8 | 0,36 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Tutor LMS – eLearning and online course solution | CVE-2026-88963 The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via the 'redirect_url' parameter in versions up to, and including, 4.0.8 This is due to insufficient input validation in the Topbar component's back button handler. This makes… |
6,1 | 0,19 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| SiteOrigin CSS | CVE-2026-111122 The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary… |
7,2 | 0,24 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| ssldump | CVE-2026-111458 The fanx_fingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlen(b64) + strlen(hex) + 31, but the format string "fan1:x509:server:passive:%s:sha256:%s" contains 33 fixed characters in… |
6,8 | 0,09 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Lightweight Cookie Notice – Cookie Banner for Cookie Consent | CVE-2026-12272 The Lightweight Cookie Notice – Cookie Banner for Cookie Consent plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.19 This is due to the W3TC_DYNAMIC_SECURITY constant being hardcoded to a publicly known value. This makes it possible for… |
5,3 | 0,21 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor | CVE-2026-109447 The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.0.3 via the `role` parameter handled by the `wppb_add_meta_to_user_on_activation()` function. The… |
8,1 | 0,34 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar | CVE-2026-109513 The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 3.3.3 due to insufficient… |
7,2 | 0,24 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Quick PayPal Payments: Payment Button & Form | CVE-2026-110017 The Quick PayPal Payments: Payment Button & Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form' parameter in all versions up to, and including, 6.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,… |
6,4 | 0,19 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Vitepos – Point of Sale (POS) for WooCommerce | CVE-2026-109414 The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the 'src_by[].val.start / src_by[].val.end (operator 'bt')' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of… |
6,5 | 0,27 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| SiteOrigin CSS | CVE-2026-107764 The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'url (comment_author_url)' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers… |
7,2 | 0,24 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Salon Booking System – Appointment Booking for Salons, Barbershops & Spas | CVE-2026-109232 The Salon Booking System – Appointment Booking for Salons, Barbershops & Spas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sln[<checkout-field-key>]' parameter in all versions up to, and including, 10.31.9 due to insufficient input sanitization and output escaping.… |
7,2 | 0,25 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated | CVE-2026-104001 The The Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.11.1 This is due to the software allowing users to execute an action that does not properly validate a value before running… |
5,4 | 0,23 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków |
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 14.11.2026, 23:02 UTC – 15.11.2026, 04:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.