CVE Notifier

CVE-2026-13191 CWE-89 6.5

Create <= 2.5.3 - Authenticated (Author+) SQL Injection via 'order_by' Parameter

The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'order_by' parameter in all versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of suff…

cve.org mischiefmarmot:Create 9 jam lalu

CVE-2026-9832 CWE-347 5.3

Payment Gateway of Stripe for WooCommerce <= 5.0.8 - Unauthenticated Improper Verification of Cryptographic Signature via woocommerce_api_wt_stripe Webhook Endpoint

The Payment Gateway of Stripe for WooCommerce plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in all versions up to, and including, 5.0.8. This is due to the publicly accessible `wo…

cve.org themehigh:Payment · Gateway · of 9 jam lalu

CVE-2026-13770 CWE-79 6.4

AppMySite <= 3.15.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via save_ams_license_key AJAX Handler

The AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via save_ams_license_key AJAX Handler in all versions up to, …

cve.org appmysite:AppMySite · – · WordPress 9 jam lalu

CVE-2026-1242 CWE-863 4.3

BlockSpare - Gutenberg Site Builder Blocks & Starter Sites <= 4.2.6 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Creation

The BlockSpare plugin for WordPress is vulnerable to authorization bypass due to incorrect logic in the permission callback in all versions up to, and including, 4.2.6 due to the use of an AND (&&) operator instead of an…

cve.org blockspare:BlockSpare · – · Gutenberg 9 jam lalu

CVE-2026-4792 CWE-862 5.3

Bread <= 2.9.12 - Missing Authorization to Unauthenticated Information Exposure

The Bread plugin for WordPress is vulnerable to information exposure in versions up to and including 2.9.12. This is due to the lack of authentication and authorization checks on the settings export functionality (downlo…

cve.org radius314:Bread 9 jam lalu

CVE-2026-2278 CWE-862 4.3

VW Writer Blog <= 1.3.8 - Missing Authorization to Authenticated (Subscriber+) Theme Settings Reset

The VW Writer Blog theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'vw_writer_blog_reset_all_settings' function in all versions up to, and including, 1.3.8.…

cve.org vowelweb:VW · Writer · Blog 9 jam lalu

CVE-2026-15947 CWE-862 4.3

Search Atlas SEO <= 2.6.23 - Missing Authorization to Authenticated (Subscriber+) Site-Wide Option Modification via 'metasync_post_types' Parameter

The Metasync plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_instant_indexing_settings() function in versions up to, and including, 2.6.23. This funct…

cve.org shahrukhlinkgraph:Search · Atlas · SEO 9 jam lalu

CVE-2026-15664 CWE-79 7.2

Quill Forms | Conversational Multi Step Forms, Surveys & quizzes <= 5.7.1 - Unauthenticated Stored Cross-Site Scripting via Multiple Choice 'Other' Value

The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Multiple Choice 'Other' Value in all versions up to, and including, 5.7.1 due to …

cve.org mdmag:Quill · Forms · | 9 jam lalu

CVE-2026-11899 CWE-862 4.3

PDF Builder for WooCommerce. Create invoices,packing slips and more <= 2.0.11 - Missing Authorization to Authenticated (Subscriber+) Sensitive Invoice Data Disclosure via GetInvoiceDetail AJAX Handler

The PDF Builder for WooCommerce. Create invoices,packing slips and more plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.0.11. This is due to the plugin not properly veri…

cve.org edgarrojas:PDF · Builder · for 9 jam lalu

CVE-2026-11608 CWE-79 6.1

WP Customer Reviews <= 3.7.8 - Reflected Cross-Site Scripting via 'wpcr3_fname' Parameter

The WP Customer Reviews plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpcr3_fname' parameter in all versions up to, and including, 3.7.8 due to insufficient input sanitization and output e…

cve.org bompus:WP · Customer · Reviews 9 jam lalu

CVE-2026-9615 CWE-862 4.3

Flex Import <= 3.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via 'license_activate_fleximp' and 'license_deactivate_fleximp' AJAX Actions

The Flex Import plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.0. This is due to the license_activate_fleximp() and license_deactivate_fleximp() functions, hooked to t…

cve.org flextheme:Flex · Import 9 jam lalu

CVE-2026-92435 CWE-? N/A

Mailchimp for WooCommerce < 6.1.1 - Unauthenticated Broken Access Control in REST API

The Mailchimp for WooCommerce WordPress plugin before 6.1.1 does not verify that the requesting user holds the required capability in the permission callback for several of its REST API routes, allowing unauthenticated u…

cve.org Unknown:Mailchimp · for · WooCommerce 10 jam lalu