Publikacje w kolejności czasu
Wszystkie technologie
| Oprogramowanie | Podatność i krótki opis | CVSS | EPSS | KEV | Zapisz |
|---|---|---|---|---|---|
| Produkt nieustalony | CVE-2026-110662 The MxChat – AI Chatbot & Content Generation for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'feedback' parameter in all versions up to, and including, 3.2.25 due to insufficient input sanitization and output escaping. This makes it possible for… |
CVSS7,2 | EPSS0,31 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2026-111068 The DesignSetGo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tagName' parameter in all versions up to, and including, 2.11.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access… |
CVSS4,4 | EPSS0,21 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2026-111111 The Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.7.2 due to insufficient input sanitization and output escaping. This makes it… |
CVSS7,2 | EPSS0,24 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2026-111120 The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.8. This is due to missing or incorrect nonce validation on the condtext_update_tmpl function. This makes it possible for unauthenticated attackers… |
CVSS8,8 | EPSS0,32 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2026-111213 The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for… |
CVSS4,3 | EPSS0,22 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2026-109972 The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'date_format' parameter in all versions up to, and including, <= 261011 due to insufficient input sanitization… |
CVSS6,4 | EPSS0,27 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2026-109975 The Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content (block attribute icon.view / icon.layout / icon.gap)' parameter in all versions up to, and including, 2.2.27 due… |
CVSS6,4 | EPSS0,2 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2026-109978 The Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'productRating.iconColor' parameter in all versions up to, and including, 2.2.27 due to insufficient input sanitization… |
CVSS6,4 | EPSS0,24 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2026-109979 The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.0.0 via the 'rp4wp_create_link' parameter of the hidden 'rp4wp_link_related' admin page. The handle_create_link() handler verifies the nonce and that the current… |
CVSS4,3 | EPSS0,3 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2026-109980 The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.0 via the 'rp4wp_view' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the titles and… |
CVSS4,3 | EPSS0,22 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2026-109988 The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fields[section][fields][row][col][type]' parameter in all versions up to, and including, 3.1.8 due to insufficient input sanitization and output… |
CVSS4,4 | EPSS0,21 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2026-110020 The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.1.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with… |
CVSS6,5 | EPSS0,38 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2026-109218 The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 9.1.2 via the add_message function. This is due to an incomplete extension blacklist that fails to detect dangerous extensions when a trailing dot causes the extension-derivation… |
CVSS9,8 | EPSS0,64 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2026-109370 The Document Embedder – let visitors read files without downloading plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'content (post_content containing block JSON documentSource.doc)' parameter in all versions up to, and including, 2.4.0 due to insufficient input… |
CVSS6,4 | EPSS0,22 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2026-109381 The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.8 This is due to the mep_grant_shop_manager_access() function hooking user_has_cap and unconditionally granting manage_options whenever an attacker-controllable request marker… |
CVSS7,2 | EPSS0,43 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2026-109384 The The Innovative Form Builder – IvyForms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the filterFiletypeAndExt function. This is due to insufficient file type validation due to the absence of a dangerous-extension denylist in the… |
CVSS8,8 | EPSS0,73 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2026-109385 The UiChemy – Convert Figma, Prompts and AI Builds to Elementor, Gutenberg and Bricks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'actions[save_builder][data][elements][...][settings][slot_{N}_link][url]' parameter in all versions up to, and including, 5.3.0 due to… |
CVSS6,4 | EPSS0,26 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2026-109590 The Tour Booking Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width', 'height' and 'zoom' shortcode attributes of the [ttbm-hotel-map] shortcode in versions up to, and including, 2.3.6 This is due to insufficient input sanitization and output escaping on user… |
CVSS6,4 | EPSS0,24 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2026-103370 The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpas_files' parameter in all versions up to, and including, 6.4.1 due to insufficient input sanitization and output escaping. This makes it possible for… |
CVSS6,4 | EPSS0,26 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2026-103996 The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' parameter in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for… |
CVSS6,4 | EPSS0,24 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2026-104729 The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tab_index, empty_notice' parameter in all versions up to, and including, 3.16.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with… |
CVSS6,4 | EPSS0,16 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2026-104740 The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'conversion' Shortcode Attribute in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it… |
CVSS6,4 | EPSS0,24 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2026-104743 The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 'tmp_file' parameter parameter. This makes it possible for authenticated attackers, with editor-level access and above, to read the contents of arbitrary files on the server,… |
CVSS4,9 | EPSS0,84 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2026-107710 The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content[title]' parameter in all versions up to, and including, 7.8.14.3 due to insufficient input sanitization and output escaping. This makes it possible for… |
CVSS6,4 | EPSS0,2 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2026-108366 The easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution plugin for WordPress is vulnerable to Authenticated (Contributor+) Stored Cross-Site Scripting via the 'icon' attribute of the easyjobs/job-list Gutenberg block in all versions up to, and including, 2.8.2… |
CVSS6,4 | EPSS0,21 % | KEVBrak wpisu w KEV nie wyklucza ataków |
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 13.11.2026, 11:02 UTC – 13.11.2026, 16:09 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.