Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
49732
Total
4014
Critical
14766
High
14490
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-16981 | UNKNOWN | — | The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not perform any authorization check (no capability, nonce, login, or ownership check) on one … | Aug 05, 2026 |
| CVE-2026-16968 | MEDIUM | 6.5 | The GeoDirectory WordPress plugin before 2.8.168 does not restrict a user-search handler to users allowed to list users, allowing any authenticated user with Contributor-level access … | Aug 05, 2026 |
| CVE-2026-16942 | MEDIUM | 5.4 | The WP Custom HTML Page WordPress plugin through 0.6.2 does not sanitise HTML stored through one of its custom page handlers, nor restrict it to … | Aug 05, 2026 |
| CVE-2026-16940 | UNKNOWN | — | The Custom Fields WordPress plugin before 1.5.1 does not validate a user-supplied file path before deletion, allowing unauthenticated users to delete arbitrary files on the … | Aug 05, 2026 |
| CVE-2026-16746 | UNKNOWN | — | The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in one of its REST API endpoints, … | Aug 05, 2026 |
| CVE-2026-16736 | HIGH | 7.5 | The User Registration & Membership WordPress plugin before 5.2.6 does not enforce the site's registration-disabled setting when processing registration-form submissions, allowing unauthenticated users to create … | Aug 05, 2026 |
| CVE-2026-16613 | MEDIUM | 4.3 | The GDPR Cookie Compliance WordPress plugin before 5.1.0 expires the visitor's cookies from an action that is reachable without authentication and performs no request-origin check, … | Aug 05, 2026 |
| CVE-2026-16605 | HIGH | 7.2 | The MultiVendorX WordPress plugin before 5.0.11 does not verify that the store targeted through its REST API belongs to the requesting vendor, allowing an authenticated … | Aug 05, 2026 |
| CVE-2026-16604 | HIGH | 7.5 | The Passster WordPress plugin before 4.3.6 outputs password-protected block content in the public page response before verifying the password, allowing unauthenticated users to recover the … | Aug 05, 2026 |
| CVE-2026-16603 | HIGH | 7.5 | The Passster WordPress plugin before 4.3.6 does not enforce its category-based content protection on the WordPress REST API, allowing unauthenticated users to read the full … | Aug 05, 2026 |
| CVE-2026-16602 | HIGH | 7.5 | The Passster WordPress plugin before 4.3.6 does not perform a post-status check before returning post content from an unauthenticated REST endpoint, allowing unauthenticated users to … | Aug 05, 2026 |
| CVE-2026-16583 | MEDIUM | 6.1 | The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.8 does not sanitize uploaded SVG files … | Aug 05, 2026 |
| CVE-2026-16573 | HIGH | 7.5 | The Bit Form WordPress plugin before 3.2.0 does not sanitize an uploaded signature image before storing it, allowing unauthenticated attackers to upload a crafted SVG … | Aug 05, 2026 |
| CVE-2026-16561 | HIGH | 7.5 | The Sunshine Photo Cart WordPress plugin before 3.6.12 does not perform access control checks in one of its AJAX actions, allowing unauthenticated users to retrieve … | Aug 05, 2026 |
| CVE-2026-16055 | HIGH | 7.5 | The Contest Gallery WordPress plugin before 30.0.7 does not route its front-end login through the standard WordPress authentication flow, issuing an authentication cookie directly after … | Aug 05, 2026 |
| CVE-2026-16036 | HIGH | 7.5 | The miniOrange 2FA WordPress plugin before 6.2.7 does not bind the second factor being configured during the pre-login two-factor challenge to the target account's existing … | Aug 05, 2026 |
| CVE-2026-15372 | HIGH | 7.5 | The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported methods is selected at login, allowing … | Aug 05, 2026 |
| CVE-2026-15360 | CRITICAL | 9.1 | The Ajax Load More WordPress plugin before 8.0.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated … | Aug 05, 2026 |
| CVE-2026-15230 | HIGH | 8.1 | The YayPricing WordPress plugin before 3.5.7 does not perform capability checks on several of its REST API routes, relying only on a shared nonce, allowing … | Aug 05, 2026 |
| CVE-2026-15210 | CRITICAL | 9.1 | The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-time … | Aug 05, 2026 |
| CVE-2026-14553 | HIGH | 8.1 | The zportals WordPress plugin before 6.3.4 does not properly validate uploaded files, trusting the client-supplied content type and preserving the original file extension, allowing any … | Aug 05, 2026 |
| CVE-2025-15677 | LOW | 3.5 | The GeoDirectory WordPress plugin before 2.8.110 does not sanitise and escape a place-category setting before outputting it back in an admin page, allowing high-privilege users … | Aug 05, 2026 |
| CVE-2026-9273 | CRITICAL | 9.3 | The Membership Plugin – Kadence Memberships plugin for WordPress (formerly Restrict Content) is vulnerable to password reset link poisoning leading to account takeover in all … | Aug 05, 2026 |
| CVE-2026-8790 | MEDIUM | 6.1 | The Football Pool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `shouttext` POST parameter of the Shoutbox widget in all versions up … | Aug 05, 2026 |
| CVE-2026-8761 | HIGH | 8.8 | The Dokan plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.0.1. This is due to a missing authorization … | Aug 05, 2026 |