Baza CVE
Wszystkie technologie
| Oprogramowanie | Podatność i krótki opis | Zapisz | |||
|---|---|---|---|---|---|
| Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights | CVE-2026-95686 The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'targetUrl' parameter in all versions up to, and including, 1.9.2.1 due to insufficient input sanitization and… |
7,2 | 0,28 % | Brak wpisu w KEV nie wyklucza ataków | |
| PilotPress | CVE-2026-85659 The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 2.0.43. The vulnerability exists because the `update_cc_details()` AJAX handler forwards an attacker-supplied `username` parameter to ONTRAPORT via… |
8,8 | 0,36 % | Brak wpisu w KEV nie wyklucza ataków | |
| Tutor LMS – eLearning and online course solution | CVE-2026-88963 The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via the 'redirect_url' parameter in versions up to, and including, 4.0.8 This is due to insufficient input validation in the Topbar component's back button handler. This makes… |
6,1 | 0,19 % | Brak wpisu w KEV nie wyklucza ataków | |
| SiteOrigin CSS | CVE-2026-111122 The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary… |
7,2 | 0,24 % | Brak wpisu w KEV nie wyklucza ataków | |
| ssldump | CVE-2026-111458 The fanx_fingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlen(b64) + strlen(hex) + 31, but the format string "fan1:x509:server:passive:%s:sha256:%s" contains 33 fixed characters in… |
6,8 | 0,09 % | Brak wpisu w KEV nie wyklucza ataków | |
| Lightweight Cookie Notice – Cookie Banner for Cookie Consent | CVE-2026-12272 The Lightweight Cookie Notice – Cookie Banner for Cookie Consent plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.19 This is due to the W3TC_DYNAMIC_SECURITY constant being hardcoded to a publicly known value. This makes it possible for… |
5,3 | 0,21 % | Brak wpisu w KEV nie wyklucza ataków | |
| User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor | CVE-2026-109447 The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.0.3 via the `role` parameter handled by the `wppb_add_meta_to_user_on_activation()` function. The… |
8,1 | 0,34 % | Brak wpisu w KEV nie wyklucza ataków | |
| NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar | CVE-2026-109513 The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 3.3.3 due to insufficient… |
7,2 | 0,24 % | Brak wpisu w KEV nie wyklucza ataków | |
| Quick PayPal Payments: Payment Button & Form | CVE-2026-110017 The Quick PayPal Payments: Payment Button & Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form' parameter in all versions up to, and including, 6.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,… |
6,4 | 0,19 % | Brak wpisu w KEV nie wyklucza ataków | |
| Vitepos – Point of Sale (POS) for WooCommerce | CVE-2026-109414 The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the 'src_by[].val.start / src_by[].val.end (operator 'bt')' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of… |
6,5 | 0,27 % | Brak wpisu w KEV nie wyklucza ataków | |
| SiteOrigin CSS | CVE-2026-107764 The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'url (comment_author_url)' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers… |
7,2 | 0,24 % | Brak wpisu w KEV nie wyklucza ataków | |
| Salon Booking System – Appointment Booking for Salons, Barbershops & Spas | CVE-2026-109232 The Salon Booking System – Appointment Booking for Salons, Barbershops & Spas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sln[<checkout-field-key>]' parameter in all versions up to, and including, 10.31.9 due to insufficient input sanitization and output escaping.… |
7,2 | 0,25 % | Brak wpisu w KEV nie wyklucza ataków | |
| Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated | CVE-2026-104001 The The Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.11.1 This is due to the software allowing users to execute an action that does not properly validate a value before running… |
5,4 | 0,23 % | Brak wpisu w KEV nie wyklucza ataków | |
| Search Regex | CVE-2026-104932 The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replace_all function. This allows authenticated attackers, with subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain… |
8,0 | 0,28 % | Brak wpisu w KEV nie wyklucza ataków | |
| User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor | CVE-2026-107748 The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 4.0.3 due to insufficient input sanitization and output escaping.… |
6,4 | 0,19 % | Brak wpisu w KEV nie wyklucza ataków | |
| Simply Schedule Appointments | CVE-2026-104000 The Simply Schedule Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in all versions up to, and including, 1.6.12.35 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject… |
7,2 | 0,24 % | Brak wpisu w KEV nie wyklucza ataków | |
| ELEX WordPress HelpDesk & Customer Ticketing System | CVE-2026-103768 The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the initMailPart function. This is due to insufficient file type validation when saving IMAP email attachments. This makes it possible… |
9,8 | 0,58 % | Brak wpisu w KEV nie wyklucza ataków | |
| 10Web Booster – Website speed optimization, Cache & Page Speed optimizer | CVE-2026-103896 The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to a limited file write via path traversal in versions up to, and including, 2.34.5 This is due to the OptimizerWebPageCache::get_cache_file_dir() function concatenating raw, unsanitized… |
7,5 | 0,46 % | Brak wpisu w KEV nie wyklucza ataków | |
| Ultra Addons for Contact Form 7 | CVE-2026-103999 The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File Upload in all versions up to, and including, 3.5.54 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary… |
7,2 | 0,26 % | Brak wpisu w KEV nie wyklucza ataków | |
| User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor | CVE-2026-100186 The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via First Name Field in all versions up to, and including, 4.0.3 due to insufficient input sanitization and output escaping. This makes… |
7,2 | 0,24 % | Brak wpisu w KEV nie wyklucza ataków | |
| Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental | CVE-2026-103480 The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for… |
6,4 | 0,19 % | Brak wpisu w KEV nie wyklucza ataków | |
| SQL Chart Builder | CVE-2026-100158 The SQL Chart Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-axis column value ($value->$xarg_s from $wpdb->get_results())' parameter in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping. This makes it possible… |
6,4 | 0,19 % | Brak wpisu w KEV nie wyklucza ataków | |
| NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar | CVE-2026-110721 The NotificationX plugin for WordPress is vulnerable to Missing Authorization leading to arbitrary content injection in versions up to, and including, 3.3.3 The /notificationx/v1/popup-submit REST route is registered with permission_callback => '__return_true', and the handler at… |
5,3 | 0,25 % | Brak wpisu w KEV nie wyklucza ataków | |
| Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance | CVE-2026-111106 The Mail Mint plugin for WordPress is vulnerable to SQL Injection via the 'filters' parameter of the /wp-json/mrm/v1/segments/contacts REST endpoint in versions up to, and including, 1.31.4 This is due to insufficient escaping on the user supplied filter 'value' before it is appended to a SQL… |
6,5 | 0,27 % | Brak wpisu w KEV nie wyklucza ataków | |
| Nexter Extension – Security, Performance, Code Snippets & Site Toolkit | CVE-2026-111114 The Nexter Extension – Security, Performance, Code Snippets & Site Toolkit plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.7.11 The vulnerability exists because the `/?reset-view` handler in `role_switcher_to_view_admin_as()` performs no nonce or… |
7,5 | 0,28 % | Brak wpisu w KEV nie wyklucza ataków |
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 15.11.2026, 03:02 UTC – 15.11.2026, 08:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.