CVE Intelligence
Home / CVEs

CVE Database

Published vulnerabilities with severity, known exploitation and official sources.

Severity
Clear

5.112 result(s)

Export this search: RSS · CSV · STIX
CVE-2026-95526 High · 7.3 CWE-862 Oct 6, 2026
WordPress BEAR plugin <= 1.2.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in BEAR <= 1.2.2 versions.
CVE-2026-62072 High · 8.8 CWE-862 Oct 6, 2026
WordPress Progress Planner plugin <= 1.10.0 - Broken Access Control vulnerability
Subscriber Broken Access Control in Progress Planner <= 1.10.0 versions.
CVE-2026-48199 High · 7.5 CWE-862 Oct 6, 2026
WordPress Sermon'e plugin <= 1.0.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Sermon'e <= 1.0.2 versions.
CVE-2026-42638 High · 7.5 CWE-862 Oct 6, 2026
WordPress Easy Digital Downloads plugin <= 3.7.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Awesomemotive Easy Digital Downloads easy-digital-downloads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Digital Downloads: from n/a through 3.7.1.
CVE-2026-42637 Medium · 6.5 CWE-862 Oct 6, 2026
WordPress PayPlug for WooCommerce (Official) plugin <= 3.1.0 - Settings Change vulnerability
Unauthenticated Settings Change in PayPlug for WooCommerce (Official) <= 3.1.0 versions.
CVE-2026-41560 High · 7.5 CWE-862 Oct 6, 2026
WordPress WXD Backup Lite plugin <= 1.0.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in WXD Backup Lite <= 1.0.2 versions.
CVE-2026-39798 Medium · 6.5 CWE-862 Oct 6, 2026
WordPress TrueBooker plugin <= 1.2.9 - Settings Change vulnerability
Unauthenticated Settings Change in TrueBooker <= 1.2.9 versions.
CVE-2026-39796 High · 7.5 CWE-862 Oct 6, 2026
WordPress Advanced Posts Listing – Show Post List Easily plugin <= 1.0.8 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Advanced Posts Listing – Show Post List Easily <= 1.0.8 versions.
CVE-2026-39794 High · 7.5 CWE-862 Oct 6, 2026
WordPress WooCommerce Multivendor Marketplace – REST API plugin <= 1.6.3 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in WooCommerce Multivendor Marketplace – REST API <= 1.6.3 versions.
CVE-2026-39787 Medium · 6.5 CWE-862 Oct 6, 2026
WordPress 10Web Social Photo Feed plugin <= 1.4.35 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in 10Web Social Photo Feed <= 1.4.35 versions.
CVE-2026-39762 Medium · 6.5 CWE-862 Oct 6, 2026
WordPress Autoship Cloud for WooCommerce Subscription Products plugin <= 2.17.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Patterns In The Cloud Autoship Cloud for WooCommerce Subscription Products autoship-cloud allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Autoship Cloud for WooCommerce Subscription Products: from n/a through 2.17.1.
CVE-2026-39751 High · 7.5 CWE-862 Oct 6, 2026
WordPress PayPlug for WooCommerce (Official) plugin <= 3.1.0 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in PayPlug for WooCommerce (Official) <= 3.1.0 versions.
CVE-2026-39749 Medium · 6.5 CWE-862 Oct 6, 2026
WordPress App for Cloudflare® plugin <= 1.10.1 - Broken Access Control vulnerability
Subscriber Broken Access Control in App for Cloudflare® <= 1.10.1 versions.
CVE-2026-39730 High · 7.1 CWE-862 Oct 6, 2026
WordPress Wise Chat plugin <= 3.4.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in Marcin Wise Chat wise-chat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wise Chat: from n/a through 3.4.3.
CVE-2026-32578 High · 7.1 CWE-862 Oct 6, 2026
WordPress ECPay Ecommerce for WooCommerce plugin <= 1.1.2606090 - Broken Access Control vulnerability
Subscriber Broken Access Control in ECPay Ecommerce for WooCommerce <= 1.1.2606090 versions.
CVE-2026-25433 High · 7.1 CWE-862 Oct 6, 2026
WordPress WP2LEADS plugin <= 3.5.7 - Broken Access Control vulnerability
Subscriber Broken Access Control in WP2LEADS <= 3.5.7 versions.
CVE-2026-105059 Medium · 6.5 CWE-862 Oct 6, 2026
WordPress Delete All Comments of wordpress plugin <= 7.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in royalnavneet Delete All Comments of wordpress delete-all-comments-of-website allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Delete All Comments of wordpress: from n/a through 7.1.
CVE-2026-104406 High · 7.3 CWE-862 Oct 6, 2026
WordPress picu plugin <= 3.10.1 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in picu <= 3.10.1 versions.
CVE-2026-104387 High · 7.2 CWE-862 Oct 6, 2026
WordPress PowerPress Podcasting plugin <= 11.17.9 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in PowerPress Podcasting <= 11.17.9 versions.
CVE-2026-102915 High · 8.5 CWE-862 Oct 6, 2026
WordPress WPO365 plugin <= 44.1 - Broken Access Control vulnerability
Subscriber Broken Access Control in WPO365 <= 44.1 versions.
CVE-2026-89289 Medium · 5.3 CWE-862 Oct 6, 2026
Fast Courier <= 5.2.3 - Unauthenticated Order Fulfillment Update via order-status-update REST Endpoint
The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfillment data, allowing unauthenticated attackers to overwrite the courier status and customer-facing tracking details of any WooCommerce order by supplying its id.
CVE-2026-25267 High · 7.8 CWE-862 Oct 6, 2026
Missing Authorization in Core
Memory corruption when non-secure loader rewrites page tables before secure memory initialization.
CVE-2026-39789 High · 7.5 CWE-862 Oct 6, 2026
WordPress Fluent Affiliate Pro plugin <= 1.6.4 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Fluent Affiliate Pro <= 1.6.4 versions.
CVE-2026-39723 High · 7.5 CWE-862 Oct 6, 2026
WordPress Morning for WooCommerce plugin <= 2.4.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Green Invoice Morning for WooCommerce wc-gateway-greeninvoice allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Morning for WooCommerce: from n/a through 2.4.1.
CVE-2026-39599 Medium · 4.3 CWE-862 Oct 6, 2026
WordPress WDS MCP Content Manager plugin <= 3.10.4 - Broken Access Control vulnerability
Contributor Broken Access Control in WDS MCP Content Manager <= 3.10.4 versions.