CVE database
94,291 vulnerabilities, newest first. Each page breaks the severity score down in plain language and lists affected versions, exploitation status and the fix.
- 9.8 Critical severity
SimpleForm – Form Maker to Chat Apps with…: Unrestricted Upload of File with Dangerous Type
The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.10.2 via the handle_upload function. This is due to missing server-side fi
- 7.2 High severity
FeedWordPress: Improper Neutralization of Input During Web Page Generation
The FeedWordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2026.0517 via syndicated RSS/Atom feed content. The plugin's SyndicatedPost::sanitize_content() function only strips the 'target' attribute (t
- 9.1 Critical severity
Acadlix LMS – AI Quiz Maker, Online Exam &…: Improper Limitation of a Pathname to a Restricted Directory
The Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the post_delete_assessment_file_by_id function in all versions up to, and inclu
- 8.8 High severity
User Frontend – Membership, User Registration…: Improper Privilege Management
The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.3.13 via the `post_content` p
- 9.8 Critical severity
Uncanny Toolkit for LearnDash: Improper Authentication
The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.8.2 via the `email` parameter of the `uo_login_action()` function. This is due to a parser-differential flaw in which the plugin's
- 7.2 High severity
Shield Security – Smart Bot Blocking…: Improper Neutralization of Input During Web Page Generation
The Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'REQUEST_URI' parameter in all versions up to, and including, 22.3.2 due to insufficient input sani
- 9.8 Critical severity
Project Manager – AI Powered Project…: Unrestricted Upload of File with Dangerous Type
The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.1.1 via the 'id' parameter parameter. This is due to unsanitiz
- 7.2 High severity
WPO365 | MICROSOFT 365 GRAPH MAILER: Improper Neutralization of Input During Web Page Generation
The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Subject (via wp_mail/PHPMailer, e.g. CF7 your-subject)' parameter in all versions up to, and including, 6.2 due to insufficient input sanitizatio
- 8.8 High severity
Rox Appointment Booking – Event, Calendar &…: Improper Privilege Management
The Rox Appointment Booking – Appointment Booking Scheduling Solution plugin for WordPress is vulnerable to Privilege Escalation via Mass Assignment in all versions up to, and including, 1.3.1 This is due to the public `/rox-appointment-booking/v1/public/booki
- 8.1 High severity
Wp Social Login and Register Social Counter: Improper Authentication
The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.2.2. This is due to the social login REST callback registered at `/wp-json/wslu-social-login/type/{provider}/` w
- 9.1 Critical severity
Popup Builder – Create highly converting…: Missing Authorization
The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.5 This is due to the plugin not properly verifying that a user is authorized to
- 7.5 High severity
Mail logging & Catcher: Improper Privilege Management
The Mail logging & Catcher plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.0 via the 'message' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above,
- 7.5 High severity
FunnelKit Automations – Email Marketing…: Improper Neutralization of Special Elements used in an SQL Command
The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the 'bwfan_cart_id' parameter in all versions up to, and including, 3.8.5.2 due to insufficient escapi
- 7.2 High severity
User Submitted Posts – Enable Users to Submit…: Improper Neutralization of Input During Web Page Generation
The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'user-submitted-content' parameter in all versions up to, and including, 20260916 due to insufficient
- 7.2 High severity
ThirstyAffiliates – Affiliate Links, Link…: Improper Neutralization of Input During Web Page Generation
The ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.12.1 due to insufficient input saniti
- 7.2 High severity
Shipping Zones by Drawing for WooCommerce: Improper Neutralization of Input During Web Page Generation
The Shipping Zones by Drawing for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'szbd-picked' checkout parameter in versions up to, and including, 3.3.0 The szbd_checkout_field_update_order_meta() handler stores stripsla
- 7.2 High severity
Welcart e-Commerce: Improper Neutralization of Input During Web Page Generation
The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gid' parameter in all versions up to, and including, 2.12.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated
- 9.1 Critical severity
WP Booking System – Booking Calendar: Missing Authorization
The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpbs_action_ajax_calendar_remove_note() function in versions up to, and including, 2.1.0.5 This makes it p
- 7.2 High severity
VikRentCar Car Rental Management System: Improper Neutralization of Input During Web Page Generation
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'optionals' parameter in all versions up to, and including, 1.4.10 due to insufficient input sanitization and output escaping. This makes it p
- 7.2 High severity
Relevanssi – A Better Search: Improper Neutralization of Input During Web Page Generation
The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.28.5 due to insufficient input sanitization and output escaping. This makes it possible for u
- 7.2 High severity
VikRentCar Car Rental Management System: Improper Neutralization of Input During Web Page Generation
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'poplink' parameter in all versions up to, and including, 1.4.9 due to insufficient input sanitization and output escaping. This makes it poss
- 7.2 High severity
W3 Total Cache: Improper Neutralization of Input During Web Page Generation
The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.10.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated
- 9.8 Critical severity
PDF Invoice for WooCommerce + Drag and Drop…: Deserialization of Untrusted Data
The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.1.1 via the 'customer_note' parameter parameter. This is due to insufficient sanitization of the
- 7.2 High severity
PDF Invoices & Packing Slips for WooCommerce: Improper Neutralization of Input During Web Page Generation
The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'billing_address.first_name / last_name / company, customer_note' parameter in all versions up to, and including, 5.16.4 due to insuffici
- 7.2 High severity
SureCart – Ecommerce Made Easy For Selling…: Improper Neutralization of Input During Web Page Generation
The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.9.4
- 8.1 High severity
WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Exploited
WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the se
- 7.5 High severity
Mapster WP Maps: Missing Authorization
The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that writes post data, allowing unauthenticated attackers to overwrite the title of arbitrary posts, create arbitrary published posts, and overwrite
- 7.5 High severity
Security Optimizer: Improper Authentication
The Security Optimizer WordPress plugin before 1.6.9 does not limit the number of two-factor authentication codes that can be submitted for a pending login, allowing an attacker who already knows a user's password to brute force the second factor and take over
- 7.2 High severity
Bulk Media Register: Improper Limitation of a Pathname to a Restricted Directory
The Bulk Media Register WordPress plugin before 2.01 does not properly validate a user-supplied path before moving a file on the server, allowing users with the Author role to move or rename arbitrary files, including outside the WordPress root, which can defe
- 7.2 High severity
PPWP – Password Protect Pages: Improper Neutralization of Input During Web Page Generation
The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment / shortcode attribute desc_below_form (and placeholder as the marker-smuggling helper)' parameter in all versions up to, and including, 1.9.26
- 7.2 High severity
Ninja Forms – Contact Form Builder with…: Improper Neutralization of Input During Web Page Generation
The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formData.extra' parameter in all versions up to, and including, 3.15.5 due to insufficient
- 7.2 High severity
Meow Lightbox: Improper Neutralization of Input During Web Page Generation
The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (bbPress reply body)' parameter in all versions up to, and including, 5.6.4 due to insufficient input sanitization and output escaping. This makes it poss
- 7.4 High severity
HyperCloud: Improper Neutralization of Special Elements used in an OS Command
Improper Neutralization of Special Elements used in a Command ('Command Injection') in the Orchestrator component of SoftIron HyperCloud allows an authenticated user with access to the management plane to execute arbitrary operating system commands on hypervis
- 8.7 High severity
File Force Download: Incorrect Authorization
The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a file URL carries the download query parameter. In Drupal 7, returning a non-empty header array from that hook is itself a grant of access to
- 9.3 Critical severity
assent: Authentication Bypass by Spoofing
Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth Assent allows an unauthenticated remote attacker to impersonate another user via the user parameter of the authorization callback. Apple post
- 7.6 High severity
shopify_app: Incorrect Authorization
Shopify App is a Rails engine for building Shopify applications. From 22.1.0 until 23.0.3, `token-exchange` authenticated controllers can expose a request-derived `shop` context instead of the identity from a verified Shopify ID token or active Shopify session
- 7.4 High severity
coop: Improper Authentication
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, the SAML strategy's verify callback resolved the authenticated user by email alone using `kyselyUserFindByEmail`, without binding the lookup to the organization in `/saml/login/:orgI
- 8.7 High severity
coop: Missing Authentication for Critical Functionality
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, an unauthenticated actor can query `Query.allOrgs` through `/api/v1/graphql` on a publicly accessible deployment and obtain data for all organizations, including organization IDs, na
- 8.7 High severity
sql: Deserialization of Untrusted Data
OpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing Language. In the 2.x line from 2.8.0.0 until 2.19.6.0, and the 3.x line prior to 3.7.0.0, a remote authenticated user with basic read/search permissions can provide a crafted `curs
- 8.8 High severity
okta-ai-agent: Improper Control of Generation of Code
TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language. Prior to 3.0.1-beta, any authenticated user with a valid `fctr_session` cookie can submit arbitrary Python source in the `script_code` fie