VulnSea

Tagged “nvd”

CVEs tagged nvd, newest first.

51020 CVEsRSS

CVE-2026-96816High· 7.1
1mo ago

Unauthenticated Cross Site Scripting (XSS) in Trusted Shops Easy Integration for WooCommerce <= 2.0.6 versions.

Unauthenticated Cross Site Scripting (XSS) in Trusted Shops Easy Integration for WooCommerce <= 2.0.6 versions.

▾ Twilightvendidero · trusted-shops-easy-integration-for-woocommerceEPSS 0.18%via NVD
CVE-2026-96818High· 7.5
1mo ago

Unauthenticated Broken Access Control in WP Express Checkout (Accept PayPal Payments) <= 2.4.9 versions.

Unauthenticated Broken Access Control in WP Express Checkout (Accept PayPal Payments) <= 2.4.9 versions.

▾ Twilightmra13 / Team Tips and Tricks HQ · wp-express-checkoutEPSS 0.25%via NVD
CVE-2026-96817High· 8.2
1mo ago

Subscriber Broken Access Control in MakeCommerce for WooCommerce <= 4.1.0 versions.

Subscriber Broken Access Control in MakeCommerce for WooCommerce <= 4.1.0 versions.

▾ TwilightMakeCommerce.net · makecommerceEPSS 0.36%via NVD
CVE-2026-96821Medium· 6.3
1mo ago

Subscriber Privilege Escalation in FluentBoards <= 2.0.12 versions.

Subscriber Privilege Escalation in FluentBoards <= 2.0.12 versions.

▾ SunlitMahmudul Hasan Arif · fluent-boardsEPSS 0.24%via NVD
CVE-2026-96820High· 7.1
1mo ago

Subscriber Cross Site Scripting (XSS) in Awesome Support <= 6.3.9 versions.

Subscriber Cross Site Scripting (XSS) in Awesome Support <= 6.3.9 versions.

▾ Twilightawesomesupport · awesome-supportEPSS 0.23%via NVD
CVE-2026-96819High· 7.1
1mo ago

Subscriber Cross Site Scripting (XSS) in oik <= 4.15.4 versions.

Subscriber Cross Site Scripting (XSS) in oik <= 4.15.4 versions.

▾ Twilightbobbingwide · oikEPSS 0.23%via NVD
CVE-2026-96823High· 7.5
1mo ago

Unauthenticated Arbitrary Content Deletion in Customer Reviews for WooCommerce <= 5.120.0 versions.

Unauthenticated Arbitrary Content Deletion in Customer Reviews for WooCommerce <= 5.120.0 versions.

▾ TwilightCusRev · customer-reviews-woocommerceEPSS 0.31%via NVD
CVE-2026-96822Critical· 9.3
1mo ago

Unauthenticated SQL Injection in Books Gallery <= 4.8.3 versions.

Unauthenticated SQL Injection in Books Gallery <= 4.8.3 versions.

▾ MidnightHossni Mubarak · wp-books-galleryEPSS 0.28%via NVD
CVE-2026-96829Medium· 6.5
1mo ago

Contributor Cross Site Scripting (XSS) in The Plus Addons for Elementor Page Builder Lite <= 6.5.1 versions.

Contributor Cross Site Scripting (XSS) in The Plus Addons for Elementor Page Builder Lite <= 6.5.1 versions.

▾ SunlitPOSIMYTH · the-plus-addons-for-elementor-page-builderEPSS 0.17%via NVD
CVE-2026-96827High· 7.6
1mo ago

Administrator SQL Injection in Admin Notices Manager <= 1.6.0 versions.

Administrator SQL Injection in Admin Notices Manager <= 1.6.0 versions.

▾ TwilightMelapress · admin-notices-managerEPSS 0.27%via NVD
CVE-2026-96824Medium· 6.8
1mo ago

Editor Arbitrary File Deletion in Template Kit – Import <= 1.0.16 versions.

Editor Arbitrary File Deletion in Template Kit – Import <= 1.0.16 versions.

▾ Sunlitenvato · template-kit-importEPSS 0.38%via NVD
CVE-2026-96831High· 8.8
1mo ago

Contributor PHP Object Injection in Themify Builder <= 7.8.1 versions.

Contributor PHP Object Injection in Themify Builder <= 7.8.1 versions.

▾ Twilightthemifyme · themify-builderEPSS 0.34%via NVD
CVE-2026-96830High· 7.1
1mo ago

Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.9 versions.

Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.9 versions.

▾ TwilightNexcess · giveEPSS 0.19%via NVD
CVE-2026-96828High· 7.6
1mo ago

Administrator SQL Injection in Category Discount Woocommerce <= 5.18 versions.

Administrator SQL Injection in Category Discount Woocommerce <= 5.18 versions.

▾ TwilightVidish · woo-product-category-discountEPSS 0.27%via NVD
CVE-2026-96834Medium· 6.5
1mo ago

Subscriber Sensitive Data Exposure in GiveWP <= 4.16.9 versions.

Subscriber Sensitive Data Exposure in GiveWP <= 4.16.9 versions.

▾ SunlitNexcess · giveEPSS 0.35%via NVD
CVE-2026-96833High· 7.2
1mo ago

Editor PHP Object Injection in Ultimate Addons for Contact Form 7 <= 3.5.51 versions.

Editor PHP Object Injection in Ultimate Addons for Contact Form 7 <= 3.5.51 versions.

▾ TwilightThemefic · ultimate-addons-for-contact-form-7EPSS 0.39%via NVD
CVE-2026-96832High· 7.2
1mo ago

Shop manager PHP Object Injection in Content Egg <= 6.3.1 versions.

Shop manager PHP Object Injection in Content Egg <= 6.3.1 versions.

▾ Twilightkeywordrush · content-eggEPSS 0.36%via NVD
CVE-2026-96837High· 8.8
1mo ago

Contributor Remote Code Execution (RCE) in CartFlows <= 3.2.0 versions.

Contributor Remote Code Execution (RCE) in CartFlows <= 3.2.0 versions.

▾ TwilightBrainstorm Force · cartflowsEPSS 0.53%via NVD
CVE-2026-96836High· 7.1
1mo ago

Unauthenticated Cross Site Scripting (XSS) in Parsi Date <= 6.3 versions.

Unauthenticated Cross Site Scripting (XSS) in Parsi Date <= 6.3 versions.

▾ TwilightMorteza Geransayeh · wp-parsidateEPSS 0.19%via NVD
CVE-2026-96835Medium· 6.5
1mo ago

Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.85 versions.

Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.85 versions.

▾ SunlitKingAddons.com · king-addonsEPSS 0.16%via NVD
CVE-2026-97074Medium· 4.3
1mo ago

Subscriber Insecure Direct Object References (IDOR) in Newsletters, Email Marketing, SMS and Popups by Omnisend <= 1.9.0 versions.

Subscriber Insecure Direct Object References (IDOR) in Newsletters, Email Marketing, SMS and Popups by Omnisend <= 1.9.0 versions.

▾ SunlitOmnisend · omnisendEPSS 0.25%via NVD
CVE-2026-96838High· 8.8PoC
1mo ago

Unauthenticated Cross Site Request Forgery (CSRF) in Blacklist Manager &#8211; WooCommerce Anti-Fraud, Blacklist &amp; Checkout Verification <= 2.3.1 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in Blacklist Manager &#8211; WooCommerce Anti-Fraud, Blacklist &amp; Checkout Verification <= 2.3.1 versions.

▾ MidnightYoOhw Studio · wc-blacklist-managerEPSS 0.17%via NVD
CVE-2026-97067Medium· 6.5
1mo ago

Contributor Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.7 versions.

Contributor Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.7 versions.

▾ SunlitShane Bishop · ewww-image-optimizerEPSS 0.17%via NVD
CVE-2026-97066Medium· 5.3
1mo ago

Unauthenticated Insecure Direct Object References (IDOR) in GiveWP <= 4.16.9 versions.

Unauthenticated Insecure Direct Object References (IDOR) in GiveWP <= 4.16.9 versions.

▾ SunlitNexcess · giveEPSS 0.22%via NVD
CVE-2026-97065High· 7.1
1mo ago

Unauthenticated Cross Site Scripting (XSS) in Happyforms <= 1.26.15 versions.

Unauthenticated Cross Site Scripting (XSS) in Happyforms <= 1.26.15 versions.

▾ TwilightHappyforms · happyformsEPSS 0.18%via NVD
CVE-2026-97079Medium· 4.3
1mo ago

Subscriber Insecure Direct Object References (IDOR) in Webba Booking <= 6.5.0 versions.

Subscriber Insecure Direct Object References (IDOR) in Webba Booking <= 6.5.0 versions.

▾ SunlitWebba Appointment Booking · webba-booking-liteEPSS 0.27%via NVD
CVE-2026-97078Medium· 5.3
1mo ago

Unauthenticated Insecure Direct Object References (IDOR) in Client Invoicing by Sprout Invoices <= 20.8.17 versions.

Unauthenticated Insecure Direct Object References (IDOR) in Client Invoicing by Sprout Invoices <= 20.8.17 versions.

▾ SunlitBoldGrid · sprout-invoicesEPSS 0.22%via NVD
CVE-2026-97077High· 7.1
1mo ago

Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.18 versions.

Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.18 versions.

▾ TwilightSpacetime · ad-inserterEPSS 0.19%via NVD
CVE-2026-97240High· 7.5
1mo ago

Unauthenticated Sensitive Data Exposure in StifLi Backup Tools <= 2.2.7 versions.

Unauthenticated Sensitive Data Exposure in StifLi Backup Tools <= 2.2.7 versions.

▾ TwilightEsteban · stifli-backup-toolsEPSS 0.29%via NVD
CVE-2026-97239Medium· 6.5
1mo ago

Subscriber Broken Access Control in MCP Content Manager Lite <= 1.1.0 versions.

Subscriber Broken Access Control in MCP Content Manager Lite <= 1.1.0 versions.

▾ SunlitJose Conti · mcp-content-manager-liteEPSS 0.28%via NVD
CVEs tagged “nvd” — page 308 · VulnSea