VulnSea

Tagged “nvd”

CVEs tagged nvd, newest first.

51020 CVEsRSS

CVE-2026-39795Critical· 9.3
1mo ago

Unauthenticated SQL Injection in SendPress Newsletters <= 1.26.1.20 versions.

Unauthenticated SQL Injection in SendPress Newsletters <= 1.26.1.20 versions.

▾ Midnightbrewlabs · sendpressEPSS 0.30%via NVD
CVE-2026-39794High· 7.5
1mo ago

Unauthenticated Broken Access Control in WooCommerce Multivendor Marketplace – REST API <= 1.6.3 versions.

Unauthenticated Broken Access Control in WooCommerce Multivendor Marketplace – REST API <= 1.6.3 versions.

▾ TwilightWC Lovers · wcfm-marketplace-rest-apiEPSS 0.38%via NVD
CVE-2026-41559High· 7.5
1mo ago

Unauthenticated Sensitive Data Exposure in SafeSnap – Verified WordPress Backup &amp; Restore <= 2.1.2 versions.

Unauthenticated Sensitive Data Exposure in SafeSnap – Verified WordPress Backup &amp; Restore <= 2.1.2 versions.

▾ TwilightPluginjoy · safesnapEPSS 0.30%via NVD
CVE-2026-39798Medium· 6.5
1mo ago

Unauthenticated Settings Change in TrueBooker <= 1.2.9 versions.

Unauthenticated Settings Change in TrueBooker <= 1.2.9 versions.

▾ SunlitThemetechMount · truebooker-appointment-bookingEPSS 0.24%via NVD
CVE-2026-39796High· 7.5
1mo ago

Unauthenticated Broken Access Control in Advanced Posts Listing – Show Post List Easily <= 1.0.8 versions.

Unauthenticated Broken Access Control in Advanced Posts Listing – Show Post List Easily <= 1.0.8 versions.

▾ TwilightFlipper Code – WordPress Development Company · advanced-posts-listingEPSS 0.29%via NVD
CVE-2026-42413High· 7.5
1mo ago

Unauthenticated Sensitive Data Exposure in Snapshotify &#8211; All-in-One Backup &amp; Restore &amp; Migrate <= 1.3.2 versions.

Unauthenticated Sensitive Data Exposure in Snapshotify &#8211; All-in-One Backup &amp; Restore &amp; Migrate <= 1.3.2 versions.

▾ TwilightDaftPlug · snapshotifyEPSS 0.30%via NVD
CVE-2026-41562High· 7.5
1mo ago

Unauthenticated Sensitive Data Exposure in Norvis Backup <= 1.1.0 versions.

Unauthenticated Sensitive Data Exposure in Norvis Backup <= 1.1.0 versions.

▾ Twilightnorvisgabriel · norvis-backupEPSS 0.30%via NVD
CVE-2026-40807High· 7.1
1mo ago

Unauthenticated Cross Site Scripting (XSS) in CF7 Views &#8211; Complete Entry Management for Contact Form 7 <= 3.2.6 versions.

Unauthenticated Cross Site Scripting (XSS) in CF7 Views &#8211; Complete Entry Management for Contact Form 7 <= 3.2.6 versions.

▾ TwilightAman · cf7-viewsEPSS 0.18%via NVD
CVE-2026-42415Critical· 9.3
1mo ago

Unauthenticated SQL Injection in Porto Theme - Functionality <= 3.9.3 versions.

Unauthenticated SQL Injection in Porto Theme - Functionality <= 3.9.3 versions.

▾ Midnightp-themes · porto-functionalityEPSS 0.24%via NVD
CVE-2026-41560High· 7.5
1mo ago

Unauthenticated Broken Access Control in WXD Backup Lite <= 1.0.2 versions.

Unauthenticated Broken Access Control in WXD Backup Lite <= 1.0.2 versions.

▾ Twilightwxdlabs · wxd-backup-liteEPSS 0.29%via NVD
CVE-2026-41555Critical· 9.3
1mo ago

Unauthenticated SQL Injection in Newsletter Subscription Form – User Subscriptions Form, Capture Email <= 1.5.9 versions.

Unauthenticated SQL Injection in Newsletter Subscription Form – User Subscriptions Form, Capture Email <= 1.5.9 versions.

▾ MidnightWeblizar – WordPress Themes & Plugin · newsletter-subscription-formEPSS 0.24%via NVD
CVE-2026-42638High· 7.5
1mo ago

Missing Authorization vulnerability in Awesomemotive Easy Digital Downloads easy-digital-downloads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Digital Downloads: from n/a through 3.7.1.

Missing Authorization vulnerability in Awesomemotive Easy Digital Downloads easy-digital-downloads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Digital Downloads: from n/a through 3.7.1.

▾ TwilightAwesomemotive · easy-digital-downloadsEPSS 0.25%via NVD
CVE-2026-42416High· 8.5
1mo ago

Subscriber SQL Injection in UDesign Core <= 4.15.0 versions.

Subscriber SQL Injection in UDesign Core <= 4.15.0 versions.

▾ TwilightAndonDesign · u-design-coreEPSS 0.27%via NVD
CVE-2026-42414High· 8.5
1mo ago

Subscriber SQL Injection in ListingPro <= 2.9.12 versions.

Subscriber SQL Injection in ListingPro <= 2.9.12 versions.

▾ TwilightCridioStudio · listingpro-pluginEPSS 0.27%via NVD
CVE-2026-41561High· 7.5
1mo ago

Unauthenticated Sensitive Data Exposure in Museder RestoreOne <= 2.7.276 versions.

Unauthenticated Sensitive Data Exposure in Museder RestoreOne <= 2.7.276 versions.

▾ TwilightAdrian Lin · museder-restoreoneEPSS 0.30%via NVD
CVE-2026-42635High· 7.1
1mo ago

Unauthenticated Cross Site Scripting (XSS) in WooCommerce Simple Auctions <= 3.0.10 versions.

Unauthenticated Cross Site Scripting (XSS) in WooCommerce Simple Auctions <= 3.0.10 versions.

▾ Twilightwpgenie · woocommerce-simple-auctionsEPSS 0.23%via NVD
CVE-2026-42418High· 7.1
1mo ago

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Socialrocket Social Rocket social-rocket allows Reflected XSS.This issue affects Social Rocket: from n/a through 1.3.5.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Socialrocket Social Rocket social-rocket allows Reflected XSS.This issue affects Social Rocket: from n/a through 1.3.5.

▾ TwilightSocialrocket · social-rocketEPSS 0.23%via NVD
CVE-2026-42417Critical· 9.3
1mo ago

Unauthenticated SQL Injection in ARMember Premium <= 7.8 versions.

Unauthenticated SQL Injection in ARMember Premium <= 7.8 versions.

▾ Midnightreputeinfosystems · armemberEPSS 0.31%via NVD
CVE-2026-42637Medium· 6.5
1mo ago

Unauthenticated Settings Change in PayPlug for WooCommerce (Official) <= 3.1.0 versions.

Unauthenticated Settings Change in PayPlug for WooCommerce (Official) <= 3.1.0 versions.

▾ SunlitPayplug · payplugEPSS 0.32%via NVD
CVE-2026-42636High· 7.1
1mo ago

Unauthenticated Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.4.6 versions.

Unauthenticated Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.4.6 versions.

▾ TwilightWP Legal Pages · gdpr-cookie-consentEPSS 0.23%via NVD
CVE-2026-42634High· 7.1
1mo ago

Unauthenticated Cross Site Scripting (XSS) in Video Background Block – Use video as background in the section

Unauthenticated Cross Site Scripting (XSS) in Video Background Block – Use video as background in the section. <= 2.0.3 versions.

▾ TwilightbPlugins · video-background-blockEPSS 0.23%via NVD
CVE-2026-94675High· 7.1
1mo ago

Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack <= 6.2.13 versions.

Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack <= 6.2.13 versions.

▾ TwilightFluent Forms Free vs Pro · fluentformproEPSS 0.18%via NVD
CVE-2026-62072High· 8.8
1mo ago

Subscriber Broken Access Control in Progress Planner <= 1.10.0 versions.

Subscriber Broken Access Control in Progress Planner <= 1.10.0 versions.

▾ TwilightProgress Planner · progress-plannerEPSS 0.32%via NVD
CVE-2026-48199High· 7.5
1mo ago

Unauthenticated Broken Access Control in Sermon'e <= 1.0.2 versions.

Unauthenticated Broken Access Control in Sermon'e <= 1.0.2 versions.

▾ TwilightBeplusthemes · sermoneEPSS 0.37%via NVD
CVE-2026-95594High· 8.1
1mo ago

Incorrect Privilege Assignment vulnerability in Cozy Vision Technologies Pvt

Incorrect Privilege Assignment vulnerability in Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications sms-alert allows Privilege Escalation.This issue affects SMS Alert Order Notifications: from n/a through 4.0.0.

▾ TwilightCozy Vision Technologies Pvt. Ltd. · sms-alertEPSS 0.21%via NVD
CVE-2026-95526High· 7.3
1mo ago

Unauthenticated Broken Access Control in BEAR <= 1.2.2 versions.

Unauthenticated Broken Access Control in BEAR <= 1.2.2 versions.

▾ TwilightRealMag777 · woo-bulk-editorEPSS 0.21%via NVD
CVE-2026-66588High· 7.5
1mo ago

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. False-positive.

▾ TwilightDream-Theme · dt-the7EPSS 0.30%via NVD
CVE-2026-97308Medium· 4.8
1mo ago

Unauthenticated Bypass Vulnerability in Login Lockdown <= 2.17 versions.

Unauthenticated Bypass Vulnerability in Login Lockdown <= 2.17 versions.

▾ SunlitWebFactory · login-lockdownEPSS 0.18%via NVD
CVE-2026-102915High· 8.5
1mo ago

Subscriber Broken Access Control in WPO365 <= 44.1 versions.

Subscriber Broken Access Control in WPO365 <= 44.1 versions.

▾ TwilightMarco van Wieren · wpo365-loginEPSS 0.22%via NVD
CVE-2026-100518Medium· 5.3
1mo ago

Unauthenticated Broken Authentication in Advanced Google reCAPTCHA <= 5.40 versions.

Unauthenticated Broken Authentication in Advanced Google reCAPTCHA <= 5.40 versions.

▾ SunlitWebFactory · advanced-google-recaptchaEPSS 0.26%via NVD
CVEs tagged “nvd” — page 237 · VulnSea