blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

CVEs stored22,604
Affected records46,307
Newest source updateNovember 9, 2026
CVE-2026-86583 September 23, 2026
The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.4.17 via the plugin's own export and re-import workflow. The vulnerability exists… Full details
HIGH 8.8
CVE-2026-19125 September 23, 2026
The EthPress – Web3 Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.5. This is due to the verify_login() function in app/Login.php containing a missing return… Full details
HIGH 8.1
CVE-2026-95513 September 23, 2026
Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar for WordPress by vcita Full details
HIGH 7.5
CVE-2026-94118 September 23, 2026
Contributor Cross Site Scripting (XSS) in Premium Blocks – Gutenberg Blocks for WordPress Full details
MEDIUM 6.5
CVE-2026-88974 September 23, 2026
WPGraphQL provides a GraphQL API for WordPress sites. Prior to 2.22.2, the updatePost mutation in src/Mutation/PostObjectUpdate.php checks only the collection-level edit_posts capability and the post author, but does not enforce the object-level edit_post capability… Full details
MEDIUM 5.4
CVE-2026-84091 September 23, 2026
The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not verify with the payment provider that a payment notification is genuine before marking the corresponding order as paid, allowing unauthenticated users to… Full details
MEDIUM 5.3
CVE-2026-90950 September 23, 2026
The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not verify the reCAPTCHA on its registration handler when a form field is absent from the request, allowing unauthenticated users to create accounts without solving… Full details
MEDIUM 5.3
CVE-2026-87978 September 23, 2026
The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on one branch of its payment webhook, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without any payment. Full details
MEDIUM 5.3
CVE-2026-87848 September 23, 2026
The MPCX Lightbox WordPress plugin 1.2.2 through 1.2.5 does not have any authorisation or authentication on one of its AJAX actions available to unauthenticated users, nor does it check the status of the requested… Full details
LOW 3.7
CVE-2026-87071 September 23, 2026
The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which metadata keys a form submission may supply, and does not exclude the keys WordPress reserves for its own use, so unauthenticated visitors submitting… Full details
MEDIUM 5.3
CVE-2026-87070 September 23, 2026
The Forminator Forms WordPress plugin before 1.57.2.1 does not verify that a request came from a trusted proxy before preferring client-supplied forwarding headers over the connecting address, and it uses that value both to… Full details
MEDIUM 5.3
CVE-2026-86612 September 23, 2026
The Ninja Tables WordPress plugin before 5.2.17 does not restrict shortcode expansion to administrator-authored table rows which, in a non-default configuration, allows unauthenticated users to have arbitrary shortcodes executed on a public page, and… Full details
MEDIUM 5.6
CVE-2026-86604 September 23, 2026
The GTranslate WordPress plugin before 5.0.1 does not remove shortcodes from the content of outgoing emails before expanding them which, in a non-default configuration, allows unauthenticated users to have arbitrary shortcodes registered on the… Full details
MEDIUM 4.8
CVE-2026-86601 September 23, 2026
The WP Recipe Maker WordPress plugin before 10.8.2 does not remove shortcodes from comment content before expanding it while building a page's structured metadata, allowing unauthenticated users to have arbitrary shortcodes executed server side… Full details
MEDIUM 6.5
CVE-2026-93368 September 23, 2026
The Rename wp-login.php to anything you want plugin for WordPress is vulnerable to time-based SQL Injection via 'log' (Username) Parameter in all versions up to, and including, 2.0.1 due to insufficient escaping on the… Full details
HIGH 7.5
CVE-2026-6831 September 23, 2026
The Advanced Contact form 7 DB plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 2.0.9. This is due to the plugin not properly verifying that a user… Full details
MEDIUM 6.5
CVE-2026-5924 September 23, 2026
The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Maps block's 'customStyle' attribute in all versions up to, and including, 2.1.3. This is due to the… Full details
MEDIUM 6.4
CVE-2026-93528 September 23, 2026
The NP Quote Request for WooCommerce WordPress plugin before 2.4.16 does not verify order ownership before rendering an order's details, allowing unauthenticated attackers to view another customer's order using the order's key. Full details
LOW 3.7
CVE-2026-93511 September 23, 2026
The Premium Packages WordPress plugin before 7.2.1 does not verify PayPal's webhook signature before processing payment and subscription notifications, allowing unauthenticated attackers to forge payment confirmations and subscription-cancellation events against any order whose transaction… Full details
MEDIUM 5.3
CVE-2026-93510 September 23, 2026
The Points and Rewards for WooCommerce WordPress plugin before 2.10.4 does not validate the claimed reward amount or restrict who can call its Win Wheel claim handler, allowing authenticated users, Subscriber and above, to… Full details
MEDIUM 4.3
CVE-2026-93508 September 23, 2026
The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-level access and above to create, modify and delete arbitrary post meta… Full details
HIGH 8.1
CVE-2026-93507 September 23, 2026
The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action, allowing Contributor-level users and above to duplicate arbitrary posts of any type… Full details
LOW 3.3
CVE-2026-91077 September 23, 2026
The Event Booking Manager for WooCommerce WordPress plugin before 5.7.3 does not restrict its event listing query to events the requesting user is permitted to read, so users with contributor-level access and above can… Full details
LOW 2.7
CVE-2026-91073 September 23, 2026
The Subscribe Forms WordPress plugin before 1.6.3 does not sanitise and escape one of its form settings before outputting it in a page, allowing authenticated users with the Author role and above to perform… Full details
MEDIUM 6.8
CVE-2026-91025 September 23, 2026
The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's Booking Manager WordPress plugin before 2.1.21-specific settings targets the requesting user's own account, allowing any authenticated user… Full details
MEDIUM 4.3
CVE-2026-91024 September 23, 2026
The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL query, allowing authenticated users with Author-level access and… Full details
MEDIUM 6.8
CVE-2026-90985 September 23, 2026
The WPC Smart Compare for WooCommerce WordPress plugin before 6.6.1 does not apply WordPress's post-password protection when returning product content through its comparison handler, allowing unauthenticated users to read the description of password-protected products. Full details
MEDIUM 5.3
CVE-2026-90951 September 23, 2026
The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not bind one of its unauthenticated payment actions to the requesting user, allowing someone who holds another member's in-flight payment identifier to delete that member's… Full details
LOW 3.7
CVE-2026-89331 September 23, 2026
The FluentBoards WordPress plugin before 2.1.0 does not properly restrict the member data returned by its public, token-shared board feature, allowing unauthenticated users to disclose the email addresses of a shared board's members, typically… Full details
MEDIUM 5.3
CVE-2026-88997 September 23, 2026
The JSM Show Post Metadata WordPress plugin before 4.9.1 does not properly escape a post meta key before outputting it into an inline event-handler attribute in an admin-facing meta box, allowing users with contributor-level… Full details
MEDIUM 6.8
CVE-2026-88929 September 23, 2026
The Product Badge, Label, Countdown Timer for WooCommerce WordPress plugin before 7.5.2 does not check whether a product is published before returning its details to unauthenticated users, allowing them to read the title, description… Full details
MEDIUM 5.3
CVE-2026-87981 September 23, 2026
The Paymob for WooCommerce WordPress plugin before 4.1.14 does not perform a capability check on several admin AJAX actions that manage its payment-gateway configuration, allowing users with contributor-level access to delete, wipe, or modify… Full details
MEDIUM 4.7
CVE-2026-87979 September 23, 2026
The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch of its payment webhook, allowing unauthenticated attackers to write a card-token record to any user's account… Full details
MEDIUM 5.3
CVE-2026-87074 September 23, 2026
The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who created the draft, and takes both the recipient address and the link written into the message from… Full details
LOW 3.7
CVE-2026-87069 September 23, 2026
The Forminator Forms WordPress plugin before 1.57.2.1 does not perform a nonce, capability or ownership check before running a one-time payment-field migration during the construction of one of its admin screens, and that construction… Full details
LOW 3.1
CVE-2026-86842 September 23, 2026
The Real3D Flipbook WordPress plugin before 5.4 does not perform capability checks on several of its authenticated flipbook management actions, allowing users with Author-level access and above to delete other users' flipbook content and… Full details
MEDIUM 6.8
CVE-2026-86785 September 23, 2026
The Social Commerce for WooCommerce WordPress plugin through 2.5.4 does not have authorisation checks on some of its REST API endpoints, allowing unauthenticated users to update Social Commerce for WooCommerce WordPress plugin through 2.5.4… Full details
MEDIUM 5.3
CVE-2026-86783 September 23, 2026
The Post Grid Gutenberg Blocks WordPress plugin before 5.0.41 does not perform an authorization or post-visibility check on a REST API route that returns the custom field keys of a given post, allowing unauthenticated… Full details
MEDIUM 5.3
CVE-2026-86608 September 23, 2026
The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its REST routes, nor does it bound what that route stores, allowing unauthenticated users to write unlimited… Full details
HIGH 8.2
CVE-2026-86603 September 23, 2026
The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to retrieve the IDs and titles… Full details
MEDIUM 4.3
CVE-2026-86602 September 23, 2026
The WP Recipe Maker WordPress plugin before 10.8.2 does not perform any capability check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the full content of… Full details
MEDIUM 4.3
CVE-2026-85006 September 23, 2026
The HappyAddons for Elementor WordPress plugin before 3.50.0 does not escape an icon value on one of its button widgets before outputting it inside an HTML attribute, allowing users with Contributor-level access and above… Full details
MEDIUM 6.8
CVE-2026-84743 September 23, 2026
The Events Calendar WordPress plugin before 6.17.5 does not perform a per-object capability check on one family of its REST write routes, allowing users with a low-privilege role such as contributor to modify, unpublish,… Full details
LOW 3.8
CVE-2026-84742 September 23, 2026
The Events Calendar WordPress plugin before 6.17.5 does not check the capability required to publish content before creating or updating it through its REST API, allowing users with a role that cannot normally publish,… Full details
LOW 2.7
CVE-2026-84741 September 23, 2026
The Events Calendar WordPress plugin before 6.17.5 does not check the post status of linked records before embedding their stored details into a public REST API response, allowing unauthenticated users to read the contents… Full details
MEDIUM 5.3
CVE-2026-84168 September 23, 2026
The Easy Hide Login WordPress plugin before 1.7 does not fully enforce its hidden-login protection, allowing an unauthenticated attacker to reach the standard login page through certain password-reset request parameters and to recover the… Full details
MEDIUM 5.3
CVE-2026-84150 September 23, 2026
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not verify that the target user of a REST route matches the authenticated caller before reading and modifying that user's… Full details
MEDIUM 5.4
CVE-2026-84098 September 23, 2026
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not properly verify a listing's ownership before deleting it, allowing authenticated attackers with Subscriber-level access and above to delete arbitrary… Full details
MEDIUM 6.5
CVE-2026-84046 September 23, 2026
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not validate a user-supplied URL before fetching it server-side, allowing users with the subscriber role and above to make the… Full details
MEDIUM 5
CVE-2026-84027 September 23, 2026
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not check user capabilities when creating orders through its REST API, allowing users with the subscriber role and above to… Full details
MEDIUM 4.3