Baza CVE
Wszystkie technologie
| Oprogramowanie | Podatność i krótki opis | Zapisz | |||
|---|---|---|---|---|---|
| Broken Link Checker | CVE-2026-96562 The The Broken Link Checker plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.14.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it… |
6,5 | 0,28 % | Brak wpisu w KEV nie wyklucza ataków | |
| Mang Board | CVE-2026-109219 The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in version 2.4.4 via the mbw_file_upload function. This is due to missing file extension validation on the attacker-supplied image_path parameter, whose basename-derived file name bypasses the extension allowlist applied… |
9,8 | 0,69 % | Brak wpisu w KEV nie wyklucza ataków | |
| Groundhogg — CRM, Newsletters, and Marketing Automation | CVE-2026-109221 The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the copy_file function in all versions up to, and including, 4.9.3 This makes it possible for authenticated attackers, with Sales… |
8,1 | 0,77 % | Brak wpisu w KEV nie wyklucza ataków | |
| InstaWP Connect – 1-click WP Staging & Migration | CVE-2026-109400 The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.1.4.1 This is due to the plugin registering its admin page via `add_management_page()` using a role name returned by… |
7,5 | 0,34 % | Brak wpisu w KEV nie wyklucza ataków | |
| Mang Board | CVE-2026-109512 The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 2.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and… |
6,4 | 0,21 % | Brak wpisu w KEV nie wyklucza ataków | |
| MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. | CVE-2026-109515 The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.78.6 This is due to the `subscribe_to_email_list` endpoint accepting an attacker-supplied… |
9,8 | 0,44 % | Brak wpisu w KEV nie wyklucza ataków | |
| Mang Board | CVE-2026-109998 The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 2.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts… |
7,2 | 0,27 % | Brak wpisu w KEV nie wyklucza ataków | |
| Bulk Page Generator – LPagery | CVE-2026-110019 The Bulk Page Generator – LPagery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with… |
4,3 | 0,22 % | Brak wpisu w KEV nie wyklucza ataków | |
| Klarna for WooCommerce | CVE-2026-110590 The Klarna for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.13.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to access any… |
7,5 | 0,33 % | Brak wpisu w KEV nie wyklucza ataków | |
| Gwolle Guestbook | CVE-2026-103481 The Gwolle Guestbook plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'permalink' parameter in all versions up to, and including, 5.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary… |
6,1 | 0,21 % | Brak wpisu w KEV nie wyklucza ataków | |
| FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler | CVE-2026-103525 The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.7.0 via the 'order_id + billing_address_id (also shipping_address_id)' parameter due to missing validation on a user… |
7,5 | 0,38 % | Brak wpisu w KEV nie wyklucza ataków | |
| miniOrange OTP Login, Verification and SMS Notifications | CVE-2026-103895 The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.5.8 via the `mo_by_pass_login()` function. This is due to `mo_delay_otp_process()` short-circuiting the authentication flow before password… |
8,1 | 0,43 % | Brak wpisu w KEV nie wyklucza ataków | |
| Forminator Forms – Contact Form, Payment Form & Custom Form Builder | CVE-2026-103911 The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.58.1. This is due to the software allowing users to execute an action that does not properly validate a value… |
6,5 | 0,27 % | Brak wpisu w KEV nie wyklucza ataków | |
| My Calendar – Accessible Event Manager | CVE-2026-104798 The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7. The public `mcs` GET parameter is reflected into post content unsanitized before WordPress core's `do_shortcode` filter runs, allowing an… |
9,8 | 0,47 % | Brak wpisu w KEV nie wyklucza ataków | |
| Modula Image Gallery – Photo Grid & Video Gallery | CVE-2026-107659 The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.11 via the 'id (post ID in /wp-json/wp/v2/modula-gallery/{id}) or none for collection route' parameter. This makes it possible for… |
7,5 | 0,3 % | Brak wpisu w KEV nie wyklucza ataków | |
| FunnelKit – Funnel Builder Plugin for WooCommerce Checkout | CVE-2026-107746 The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.16.0.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for… |
7,5 | 0,32 % | Brak wpisu w KEV nie wyklucza ataków | |
| Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy | CVE-2026-109191 The Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.0 via the 'image_hub_api_keys_* (6 options)' parameter. This makes it possible for authenticated attackers,… |
4,3 | 0,28 % | Brak wpisu w KEV nie wyklucza ataków | |
| Forminator Forms – Contact Form, Payment Form & Custom Form Builder | CVE-2026-101335 The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 1.58.1. This is due to the forminator_replace_quiz_form_data() helper invoking do_shortcode() on the fully expanded… |
6,5 | 0,28 % | Brak wpisu w KEV nie wyklucza ataków | |
| Complianz GDPR/CCPA Cookie Consent Banner | CVE-2026-97339 The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter in all versions up to, and including, 7.5.5 due to insufficient input sanitization and output escaping. This makes it possible for… |
7,2 | 0,25 % | Brak wpisu w KEV nie wyklucza ataków | |
| Backuply – Backup, Restore, Migrate and Clone | CVE-2026-93953 The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the Biographical Info field (second-order, via restore) in all versions up to, and including, 1.5.8 due to insufficient escaping on the user supplied parameter and the lack of sufficient… |
8,0 | 0,34 % | Brak wpisu w KEV nie wyklucza ataków | |
| Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy | CVE-2026-89280 The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.2.1 via the 'password' parameter due to missing validation on a user controlled key.… |
4,3 | 0,21 % | Brak wpisu w KEV nie wyklucza ataków | |
| Dark Mode – Improve Accessibility with AI Powered Dark Theme | CVE-2026-93535 The Dark Mode – Improve Accessibility with AI Powered Dark Theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'icon_light' Shortcode Attribute in all versions up to, and including, 5.3.17 due to insufficient input sanitization and output escaping. This makes it… |
6,4 | 0,15 % | Brak wpisu w KEV nie wyklucza ataków | |
| Cooked – Recipe Management | CVE-2026-77829 The Cooked – Recipe Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via [cooked-timer] Shortcode Content in all versions up to, and including, 1.16.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with… |
6,4 | 0,24 % | Brak wpisu w KEV nie wyklucza ataków | |
| Wheels | CVE-2026-111448 Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case-sensitive filesystems. Canonical-path checks for zip entries, package mappings, development assets/docs, guide images and image tags can accept paths through an existing symlink to a case-distinct… |
3,7 | 0,21 % | Brak wpisu w KEV nie wyklucza ataków | |
| Wheels | CVE-2026-111449 Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true (disabled by default). An allowed administrator request changes error/debug-display settings in shared application scope. If it overlaps with an unauthorized client's request that raises an error, that… |
5,9 | 0,21 % | Brak wpisu w KEV nie wyklucza ataków |
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 15.11.2026, 03:02 UTC – 15.11.2026, 08:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.