Lucene search
+L

400115 matches found

CVE
CVE
added 2026/09/03 4:53 p.m.12 views

CVE-2026-85307

KP Agent Ready is a WordPress plugin developed by Kevin Pirnie. Versions prior to 1.2.08 are affected by an Insertion of Sensitive Information Into Sent Data vulnerability that allows an unauthenticated remote attacker to retrieve embedded sensitive data. The CVSS v3.1 score is 5.3 (Medium) with ...

5.3CVSS5.9AI score0.00197EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/03 4:53 p.m.19 views

CVE-2026-75602

OpenList (a file list program supporting multiple storage backends) versions prior to 4.2.3 are affected by an authenticated path traversal vulnerability in the offline-download feature. When the SimpleHttp tool is used via POST /api/fs/add_offline_download, an attacker-controlled Content-Disposi...

6.5CVSS5.9AI score0.00431EPSS
SaveExploits0References3
CVE
CVE
added 2026/09/03 4:53 p.m.15 views

CVE-2026-85306

MountDev AI MCP Connector for WordPress , a plugin by Cascadia Web Services, is affected by a Missing Authorization (Broken Access Control) vulnerability in versions from unspecified up to 1.6.5 . The flaw allows exploitation of incorrectly configured access control security levels, granting a lo...

6.5CVSS5.9AI score0.0019EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/03 4:52 p.m.23 views

CVE-2026-85305

A Server-Side Request Forgery (SSRF) vulnerability affects the SEOPress WordPress plugin in versions from n/a through 10.1 . The flaw allows an attacker to force the server to make unintended requests. The CVSS v3.1 score is 5.4 (MEDIUM) , with a network vector, low complexity, low privileges req...

5.4CVSS5.9AI score0.00122EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/03 4:51 p.m.13 views

CVE-2026-85303

CVE-2026-85303 affects the Booking and Rental Manager WordPress plugin by Magepeople inc. , with a Stored XSS vulnerability present in versions from unspecified through 2.7.7 . The flaw stems from improper neutralization of input during web page generation, allowing an attacker with low privilege...

6.5CVSS5.9AI score0.0013EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/03 4:42 p.m.11 views

CVE-2026-85302

A DOM-Based XSS vulnerability exists in the WPKoi Templates for Elementor WordPress plugin, affecting versions from n/a through 3.7.2 . The flaw stems from improper neutralization of input during web page generation. Exploitation requires low privileges and user interaction , with a changed scope...

6.5CVSS5.9AI score0.0013EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/03 4:32 p.m.27 views

CVE-2026-84848

The WordPress Quick Event Manager plugin (versions

7.1CVSS5.9AI score0.00146EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/03 4:32 p.m.16 views

CVE-2026-84847

CVE-2026-84847 affects the WordPress Quick Event Manager plugin in versions 9.17 and earlier . The vulnerability is an unauthenticated Broken Access Control flaw, meaning an attacker with no prior access can exploit it over the network with low complexity and no user interaction. The CVSS 3.1 sco...

7.5CVSS5.9AI score0.00202EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/03 4:31 p.m.19 views

CVE-2026-84836

WC Ukraine Shipping is a WordPress plugin affected by an Insecure Direct Object References (IDOR) vulnerability in versions 1.22.3 and earlier . The flaw allows a low-privilege user (Subscriber level) to access restricted objects, resulting in high confidentiality impact and low integrity impact,...

7.1CVSS5.9AI score0.00225EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/03 4:31 p.m.32 views

CVE-2026-84834

CVE-2026-84834 affects the WordPress JobSearch plugin in versions ≤ 3.2.0 . The vulnerability is an unauthenticated PHP Object Injection , allowing a remote attacker with no privileges to potentially achieve high impact on confidentiality, integrity, and availability, as reflected by a CVSS 3.1 s...

9.8CVSS5.9AI score0.0032EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/03 4:31 p.m.24 views

CVE-2026-84814

CVE-2026-84814 affects the WordPress Bricksforge plugin in versions 3.1.8.8 and below , introducing a Subscriber Privilege Escalation vulnerability. According to the PatchStack CVSS 3.1 assessment, the vulnerability is rated CRITICAL (9.8) with a network attack vector, low complexity, no required...

9.8CVSS5.9AI score0.00365EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/03 4:31 p.m.32 views

CVE-2026-84813

An unauthenticated SQL Injection vulnerability affects the WordPress GeoDirectory plugin in versions

9.3CVSS5.9AI score0.00236EPSS
SaveIn wildExploits0References1
CVE
CVE
added 2026/09/03 4:31 p.m.34 views

CVE-2026-84812

CVE-2026-84812 affects the WordPress BP Better Messages plugin in versions

7.1CVSS5.9AI score0.00146EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/03 4:31 p.m.13 views

CVE-2026-84779

Agentimus – AI SEO, llms.txt & MCP for AI Agents WordPress plugin versions

8.1CVSS5.9AI score0.00264EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/03 4:31 p.m.12 views

CVE-2026-84778

An unauthenticated Denial of Service vulnerability affects the Migrate Guru – Site Migration & Cloning WordPress plugin in versions

7.5CVSS5.9AI score0.00263EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/03 4:31 p.m.20 views

CVE-2026-84777

WordPress Really Simple SSL plugin versions ≤ 9.8.0 are affected by an unauthenticated broken authentication vulnerability described as a 2FA bypass . The flaw allows a network-based attacker (with no prior privileges or user interaction, but high attack complexity) to compromise authentication, ...

7.4CVSS5.9AI score0.00239EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/03 4:31 p.m.19 views

CVE-2026-84776

CVE-2026-84776 affects the MalCare Security WordPress plugin in versions ≤ 6.69 , where an unauthenticated Denial of Service (DoS) attack is possible. The vulnerability requires no user interaction and has low attack complexity , with a network-based attack vector. Per the CVSS 3.1 score of 7.5 (...

7.5CVSS5.9AI score0.00263EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/03 4:31 p.m.11 views

CVE-2026-84774

WP Statistics (WordPress plugin) versions

6.1CVSS5.9AI score0.00149EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/03 4:31 p.m.10 views

CVE-2026-84769

CVE-2026-84769 affects the WordPress Business Directory plugin in versions

6.5CVSS5.9AI score0.00159EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/03 4:31 p.m.25 views

CVE-2026-84773

EWWW Image Optimizer for WordPress (versions

7.2CVSS5.9AI score0.00165EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/03 4:31 p.m.18 views

CVE-2026-84768

CVE-2026-84768 affects the WordPress VikAppointments Services Booking Calendar plugin in versions 1.2.20 and earlier . The vulnerability is an unauthenticated SQL Injection , meaning an attacker can exploit it without prior access or credentials. The CVSS 3.1 base score is 9.3 (CRITICAL) , with a...

9.3CVSS5.9AI score0.00236EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/03 4:31 p.m.10 views

CVE-2026-84766

An unauthenticated bypass vulnerability exists in the FluentBooking Pro WordPress plugin in versions 2.2.1 and below , as reported by Patchstack. The CVSS 3.1 score is 5.9 (Medium) , with a network attack vector, high complexity, no privileges required, and a high integrity impact but no confiden...

5.9CVSS5.9AI score0.002EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/03 4:31 p.m.12 views

CVE-2026-84767

An unauthenticated bypass vulnerability affects the WordPress BookIt plugin in versions ≤ 2.6.0.3 . The flaw allows a remote attacker with no prior authentication or user interaction to trigger the bypass over the network with low complexity. The CVSS 3.1 score is 5.3 (Medium) , reflecting a low ...

5.3CVSS5.9AI score0.00124EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/03 4:31 p.m.14 views

CVE-2026-84765

Breadcrumb NavXT , a popular WordPress plugin, is affected by an unauthenticated Cross-Site Scripting (XSS) vulnerability in versions 7.5.1 and earlier . The flaw is classified with a CVSS 3.1 score of 7.1 (HIGH) , reflecting a network attack vector, low complexity, no privileges required, but re...

7.1CVSS5.9AI score0.00146EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/03 4:31 p.m.14 views

CVE-2026-84763

CVE-2026-84763 affects the RTMKit (Rome Theme for Elementor) WordPress plugin, versions 2.1.5 and earlier . The vulnerability is an unauthenticated Cross-Site Scripting (XSS) flaw, scored CVSS 3.1: 7.1 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The changed scope indicates the im...

7.1CVSS5.9AI score0.00146EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/03 4:31 p.m.13 views

CVE-2026-84762

CVE-2026-84762 affects the WP EasyPay WordPress plugin in versions 4.5.3 and earlier . The vulnerability is an unauthenticated bypass that allows a remote attacker with no privileges and no user interaction to achieve low integrity impact , scoring CVSS 5.3 (Medium) . The specific component or ro...

5.3CVSS5.9AI score0.00207EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/03 4:31 p.m.56 views

CVE-2026-84761

CVE-2026-84761 affects the WordPress LiteSpeed Cache plugin in versions 7.9 and earlier , where an unauthenticated Server Side Request Forgery (SSRF) flaw is present. The CVSS v3.1 score is 7.2 (HIGH) with a Changed scope and low impacts to both confidentiality and integrity, while availability i...

7.2CVSS5.9AI score0.00159EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/03 4:31 p.m.11 views

CVE-2026-84758

An unauthenticated Broken Access Control vulnerability affects the WordPress Business Directory plugin in versions 6.4.26 and earlier . A remote attacker with no prior access can exploit this flaw over the network with low complexity and no user interaction, resulting in low integrity and low ava...

6.5CVSS5.9AI score0.00196EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/03 4:31 p.m.15 views

CVE-2026-84757

CVE-2026-84757 affects the WordPress WP Compress plugin in versions 7.21.28 and earlier . The vulnerability is an unauthenticated Settings Change , meaning an attacker with no prior access can modify plugin settings over the network without any user interaction. This yields a CVSS 3.1 base score ...

8.2CVSS5.9AI score0.00225EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/03 4:31 p.m.13 views

CVE-2026-84756

CVE-2026-84756 is a privilege escalation vulnerability affecting the WCFM Membership WordPress plugin in versions 2.11.11 and below . The flaw allows a user with Subscriber privileges to escalate their access level. The vulnerability is rated HIGH (CVSS 3.1: 7.1) , with a network attack vector, l...

7.1CVSS5.9AI score0.00213EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/03 4:31 p.m.11 views

CVE-2026-84755

Mail Mint is a WordPress plugin affected by an unauthenticated Broken Access Control vulnerability in versions 1.31.0 and below . The flaw allows a remote attacker with no prior access to perform unauthorized actions on the plugin, resulting in low confidentiality and low integrity impact with no...

6.5CVSS5.9AI score0.00194EPSS
SaveIn wildExploits0References1
CVE
CVE
added 2026/09/03 4:31 p.m.16 views

CVE-2026-84754

CVE-2026-84754 affects the WordPress WPFunnels plugin in versions ≤ 3.12.13 , where an unauthenticated broken access control flaw allows a remote attacker to manipulate integrity and availability of the target system without any user interaction. The CVSS 3.1 score is 6.5 (MEDIUM) with a vector o...

6.5CVSS5.9AI score0.00242EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/03 4:31 p.m.32 views

CVE-2026-84753

CVE-2026-84753 affects the WordPress Mail Mint plugin in versions 1.31.0 and below , where an unauthenticated PHP Object Injection flaw allows a remote attacker to inject arbitrary serialized objects into the application. The vulnerability is rated CVSS 9.8 (CRITICAL) with high impact to confiden...

9.8CVSS5.9AI score0.00313EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/03 4:31 p.m.11 views

CVE-2026-84752

CVE-2026-84752 affects the WordPress RTMKit plugin (Rometheme for Elementor) in versions 2.1.5 and earlier . The vulnerability is a PHP Object Injection that can be exploited by a user with Contributor privileges, resulting in high impact on confidentiality, integrity, and availability (CVSS 8.8 ...

8.8CVSS5.9AI score0.00288EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/03 4:31 p.m.32 views

CVE-2026-84238

CVE-2026-84238 affects the YITH Request a Quote for WooCommerce Premium WordPress plugin in versions prior to 4.46.0 . The vulnerability is an unauthenticated Broken Access Control flaw, meaning an attacker can exploit it over the network without any prior access or user interaction. The CVSS 3.1...

9.8CVSS5.9AI score0.00268EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/03 4:31 p.m.15 views

CVE-2026-84215

CVE-2026-84215 affects the WordPress Timetics plugin in versions 1.0.61 and earlier . The vulnerability is an unauthenticated Broken Access Control flaw, rated CVSS 6.5 (Medium) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. This means an unauthenticated network-based attacker can exploit ...

6.5CVSS5.9AI score0.00242EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/03 4:31 p.m.30 views

CVE-2026-81776

CVE-2026-81776 affects the WordPress WP QuickLaTeX plugin in versions

7.1CVSS5.9AI score0.0018EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/03 4:31 p.m.15 views

CVE-2026-81773

CVE-2026-81773 affects the WordPress Ninja Forms File Uploads Extension plugin in versions 3.3.26 and below . The vulnerability is an unauthenticated Cross-Site Scripting (XSS) flaw, meaning no prior authentication is required to exploit it. The CVSS 3.1 base score is 7.1 (HIGH) with a vector of ...

7.1CVSS5.9AI score0.0018EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/03 4:31 p.m.22 views

CVE-2026-81300

CVE-2026-81300 is an unauthenticated Cross Site Scripting (XSS) vulnerability affecting the Calculation For Contact Form 7 WordPress plugin in versions ≤ 1.0 . The CVSS v3.1 score is 7.1 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicating a network-based attack with low comple...

7.1CVSS5.9AI score0.0018EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/03 4:31 p.m.26 views

CVE-2026-81295

CVE-2026-81295 affects the WordPress Under Construction plugin (versions ≤ 5.82 ) with an unauthenticated Cross-Site Scripting (XSS) flaw, as identified by Patchstack. The CVSS 3.1 score is 7.1 (HIGH) with the vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicating a network-based attack with low ...

7.1CVSS5.9AI score0.0018EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/03 4:31 p.m.14 views

CVE-2026-81292

WordPress Simple Payment plugin versions ≤ 2.5.1 are affected by an unauthenticated Cross Site Scripting (XSS) vulnerability, as reported by Patchstack. The flaw requires user interaction but no prior authentication, and operates over the network with low complexity. The CVSS 3.1 base score is 7....

7.1CVSS5.9AI score0.0018EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/03 4:31 p.m.14 views

CVE-2026-81282

Product Variations Swatches for WooCommerce (WordPress plugin) versions

6.5CVSS5.9AI score0.00211EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/03 4:31 p.m.38 views

CVE-2026-81281

CVE-2026-81281 is a Cross-Site Scripting (XSS) vulnerability in the Graphene WordPress theme , affecting versions 2.9.4 and earlier . The vulnerability requires a subscriber-level account (low privileges) and user interaction to be exploited. The CVSS v3.1 base score is 6.5 (MEDIUM) with a vector...

6.5CVSS5.9AI score0.00211EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/03 4:31 p.m.27 views

CVE-2026-84849

CVE-2026-84849 affects the Pre-Orders for WooCommerce WordPress plugin in versions 2.3 and earlier . The vulnerability is an unauthenticated bypass , meaning no prior login is required to exploit it. The CVSS 3.1 score is 6.5 (MEDIUM) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, indicati...

6.5CVSS5.9AI score0.00173EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/03 4:17 p.m.18 views

CVE-2026-85242

PlaywrightCapture is vulnerable to a server-side request forgery (SSRF) in its favicon retrieval functionality. When only_global_lookup is enabled, the application validates the initial favicon URL against localhost, loopback, and other non-public addresses, but redirects followed by aiohttp were...

6.9CVSS5.9AI score0.00254EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/03 4:10 p.m.14 views

CVE-2026-84736

Eclipse aeriOS (current development version, no official release published) has a vulnerability in its Federator component where TLS certificate validation is disabled by default for outbound HTTPS connections. When the TLS_CERTIFICATE_VALIDATION environment variable is unset or set to false, the...

8.3CVSS5.8AI score0.00167EPSS
SaveExploits0References2
CVE
CVE
added 2026/09/03 3:45 p.m.25 views

CVE-2026-85138

SeaCMS versions up to 13.6 contain a SQL injection vulnerability in the WeChat Module (file weixin/index.php). The root cause lies in the addslashes function, where improper handling of the Content argument allows remote, unauthenticated attackers to inject SQL. The attack vector is network-based...

7.5CVSS6.8AI score0.00393EPSS
SaveExploits0References5
CVE
CVE
added 2026/09/03 3:37 p.m.19 views

CVE-2026-85239

MISP is vulnerable to a validation bypass in its event template handling. The EventTemplate::beforeValidate() method only applied semantic validation when the definition was already an array; a caller supplying a pre-encoded string (including malformed JSON ) bypassed validateDefinition() and onl...

7.1CVSS5.8AI score0.00256EPSS
SaveExploits0References1Affected Software1
CVE
CVE
added 2026/09/03 3:30 p.m.20 views

CVE-2026-85238

MISP contains a session fixation vulnerability in its CustomAuth authentication flow (a custom configuration). The root cause is that __customAuthentication() wrote the authenticated user into the existing CakePHP session without first calling Session->renew(), which had been disabled. An atta...

7.6CVSS5.8AI score0.00219EPSS
SaveExploits0References1Affected Software1
CVE
CVE
added 2026/09/03 3:30 p.m.42 views

CVE-2026-53720

pymonocypher (Python bindings to the Monocypher C library) is vulnerable to a heap buffer overflow in the argon2i_32 function prior to version 4.0.2.8 . The root cause is a missing validation of the nb_blocks buffer size: if the caller supplies a buffer smaller than required by the API contract, ...

5.1CVSS6AI score0.00126EPSS
SaveExploits1References3
Total number of security vulnerabilities400115