VulnSea

Tagged “nvd”

CVEs tagged nvd, newest first.

51020 CVEsRSS

CVE-2026-97197High· 7.5
1mo ago

Unauthenticated Broken Access Control in WordPress Backup & Migration <= 1.6.0 versions.

Unauthenticated Broken Access Control in WordPress Backup & Migration <= 1.6.0 versions.

▾ TwilightWebToffee · wp-migration-duplicatorEPSS 0.29%via NVD
CVE-2026-97243Medium· 5.4
1mo ago

Subscriber Broken Access Control in AllAble Connector <= 0.13.4 versions.

Subscriber Broken Access Control in AllAble Connector <= 0.13.4 versions.

▾ Sunlitflexyma · allable-connectorEPSS 0.22%via NVD
CVE-2026-97242Medium· 6.8
1mo ago

Author Arbitrary File Deletion in WEBO MCP <= 3.0.18 versions.

Author Arbitrary File Deletion in WEBO MCP <= 3.0.18 versions.

▾ Sunlitphuongwebo · webo-mcpEPSS 0.35%via NVD
CVE-2026-97241High· 7.5
1mo ago

Unauthenticated Sensitive Data Exposure in BackupEase <= 2.2.2 versions.

Unauthenticated Sensitive Data Exposure in BackupEase <= 2.2.2 versions.

▾ TwilightPrecisionWP · backupeaseEPSS 0.29%via NVD
CVE-2026-97246Medium· 4.9
1mo ago

Subscriber PHP Object Injection in ShortPixel Image Optimizer <= 6.5.5 versions.

Subscriber PHP Object Injection in ShortPixel Image Optimizer <= 6.5.5 versions.

▾ SunlitShortPixel · shortpixel-image-optimiserEPSS 0.21%via NVD
CVE-2026-97245High· 7.2
1mo ago

Shop Worker Privilege Escalation in SureCart <= 4.7.2 versions.

Shop Worker Privilege Escalation in SureCart <= 4.7.2 versions.

▾ TwilightSureCart · surecartEPSS 0.33%via NVD
CVE-2026-97244High· 7.5
1mo ago

Contributor Path Traversal in Creator LMS <= 1.2.19 versions.

Contributor Path Traversal in Creator LMS <= 1.2.19 versions.

▾ TwilightWPFunnels · creatorlmsEPSS 0.29%via NVD
CVE-2026-97249Medium· 5.3
1mo ago

Unauthenticated Bypass Vulnerability in Paid Member Subscriptions <= 3.0.9 versions.

Unauthenticated Bypass Vulnerability in Paid Member Subscriptions <= 3.0.9 versions.

▾ SunlitCozmoslabs · paid-member-subscriptionsEPSS 0.19%via NVD
CVE-2026-97248Critical· 9.8
1mo ago

Unauthenticated PHP Object Injection in Booking Activities <= 1.18.7.1 versions.

Unauthenticated PHP Object Injection in Booking Activities <= 1.18.7.1 versions.

▾ MidnightBooking Activities Team · booking-activitiesEPSS 0.38%via NVD
CVE-2026-97247Medium· 6.5
1mo ago

Unauthenticated Broken Access Control in Blocksy Companion <= 2.1.55 versions.

Unauthenticated Broken Access Control in Blocksy Companion <= 2.1.55 versions.

▾ SunlitCreative Themes · blocksy-companionEPSS 0.20%via NVD
CVE-2026-97266Medium· 6.5
1mo ago

Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12.1 versions.

Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12.1 versions.

▾ SunlitNexcess · virtue-toolkitEPSS 0.13%via NVD
CVE-2026-97262Medium· 6.5
1mo ago

Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.2 versions.

Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.2 versions.

▾ SunlitVisual Composer · visualcomposerEPSS 0.13%via NVD
CVE-2026-97250High· 7.1
1mo ago

Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions.

Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions.

▾ TwilightDylan Kuhn · geo-mashupEPSS 0.14%via NVD
CVE-2026-97270Medium· 6.5
1mo ago

Subscriber Cross Site Scripting (XSS) in CMB2 <= 2.13.0 versions.

Subscriber Cross Site Scripting (XSS) in CMB2 <= 2.13.0 versions.

▾ SunlitJustin Sternberg · cmb2EPSS 0.17%via NVD
CVE-2026-97267Medium· 4.3
1mo ago

Subscriber Broken Access Control in Prevent files / folders access <= 2.6.7 versions.

Subscriber Broken Access Control in Prevent files / folders access <= 2.6.7 versions.

▾ SunlitminiOrange · prevent-file-accessEPSS 0.21%via NVD
CVE-2026-97261Medium· 5.3
1mo ago

Unauthenticated Sensitive Data Exposure in Notivo <= 1.4.2 versions.

Unauthenticated Sensitive Data Exposure in Notivo <= 1.4.2 versions.

▾ SunlitVillaTheme · woo-notificationEPSS 0.19%via NVD
CVE-2026-97274Critical· 9.8
1mo ago

Unauthenticated Bypass Vulnerability in OAuth Single Sign On – SSO (OAuth Client) <= 7.1.2 versions.

Unauthenticated Bypass Vulnerability in OAuth Single Sign On – SSO (OAuth Client) <= 7.1.2 versions.

▾ MidnightminiOrange · miniorange-login-with-eve-online-google-facebookEPSS 0.29%via NVD
CVE-2026-97272High· 7.1
1mo ago

Unauthenticated Cross Site Scripting (XSS) in Premmerce Permalink Manager for WooCommerce <= 2.3.13 versions.

Unauthenticated Cross Site Scripting (XSS) in Premmerce Permalink Manager for WooCommerce <= 2.3.13 versions.

▾ TwilightPremmerce · woo-permalink-managerEPSS 0.14%via NVD
CVE-2026-97271High· 7.1
1mo ago

Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.

Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.

▾ TwilightWPFunnels · wpfunnelsEPSS 0.14%via NVD
CVE-2026-97285Medium· 5.4
1mo ago

Contributor Broken Access Control in The Events Calendar <= 6.17.5 versions.

Contributor Broken Access Control in The Events Calendar <= 6.17.5 versions.

▾ SunlitNexcess · the-events-calendarEPSS 0.20%via NVD
CVE-2026-97282Medium· 5.3
1mo ago

Unauthenticated Insecure Direct Object References (IDOR) in Review Schema <= 3.1.0 versions.

Unauthenticated Insecure Direct Object References (IDOR) in Review Schema <= 3.1.0 versions.

▾ SunlitRadiusTheme · review-schemaEPSS 0.17%via NVD
CVE-2026-97279Medium· 6.5
1mo ago

Contributor Cross Site Scripting (XSS) in Polylang <= 3.8.9 versions.

Contributor Cross Site Scripting (XSS) in Polylang <= 3.8.9 versions.

▾ SunlitChouby · polylangEPSS 0.15%via NVD
CVE-2026-97289High· 7.1
1mo ago

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows DOM-Based XSS.This issue affects Quiz And Survey Master: from n/a through 11…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows DOM-Based XSS.This issue affects Quiz And Survey Master: from n/a through 11…

▾ TwilightExpressTech Systems · quiz-master-nextEPSS 0.14%via NVD
CVE-2026-97287High· 8.5
1mo ago

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Blind SQL Injection. This issue affects Event Tickets: from n/a through 5.29.5.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Blind SQL Injection. This issue affects Event Tickets: from n/a through 5.29.5.

▾ TwilightNexcess · event-ticketsEPSS 0.25%via NVD
CVE-2026-97286Medium· 6.5PoC
1mo ago

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.11.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.11.

▾ TwilightWP Chill · strong-testimonialsEPSS 0.18%via NVD
CVE-2026-97288Medium· 6.5
1mo ago

Contributor Cross Site Scripting (XSS) in OAuth Server <= 4.5.1 versions.

Contributor Cross Site Scripting (XSS) in OAuth Server <= 4.5.1 versions.

▾ SunlitJayson T Cote · oauth2-providerEPSS 0.13%via NVD
CVE-2026-97292Medium· 6.5
1mo ago

Author Cross Site Scripting (XSS) in YITH WooCommerce Tab Manager <= 2.15.0 versions.

Author Cross Site Scripting (XSS) in YITH WooCommerce Tab Manager <= 2.15.0 versions.

▾ SunlitYITHEMES · yith-woocommerce-tab-managerEPSS 0.13%via NVD
CVE-2026-97299Medium· 5.4
1mo ago

Unauthenticated Cross Site Request Forgery (CSRF) in Razorpay Payment Links for WooCommerce <= 2.1.5 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in Razorpay Payment Links for WooCommerce <= 2.1.5 versions.

▾ SunlitKnitPay · rzp-woocommerceEPSS 0.10%via NVD
CVE-2026-97298Medium· 6.5
1mo ago

Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.86 versions.

Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.86 versions.

▾ SunlitKingAddons · king-addonsEPSS 0.13%via NVD
CVE-2026-97293High· 8.5
1mo ago

Contributor SQL Injection in Media LIbrary Assistant <= 3.41 versions.

Contributor SQL Injection in Media LIbrary Assistant <= 3.41 versions.

▾ TwilightDavid Lingren · media-library-assistantEPSS 0.24%via NVD
CVEs tagged “nvd” — page 309 · VulnSea