CVE Database
29323 results
| CVE ID | Severity | CVSS | Description | MITRE TTPs | Flags | Published |
|---|---|---|---|---|---|---|
| CVE-2026-107710 | MEDIUM | 6.4 | The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to … |
T1190
T1203
|
|
2026-10-28 |
| CVE-2026-104743 | MEDIUM | 4.9 | The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and in… |
T1190
T1059
+1
|
|
2026-10-28 |
| CVE-2026-104740 | MEDIUM | 6.4 | The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vu… |
T1190
T1203
|
|
2026-10-28 |
| CVE-2026-104729 | MEDIUM | 6.4 | The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the… |
T1190
T1203
|
|
2026-10-28 |
| CVE-2026-103996 | MEDIUM | 6.4 | The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vu… |
T1190
T1203
|
|
2026-10-28 |
| CVE-2026-103370 | MEDIUM | 6.4 | The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stor… |
T1190
T1203
|
|
2026-10-28 |
| CVE-2026-100175 | MEDIUM | 5.4 | The Postie plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Email Body URL Auto… |
T1078
T1548
|
|
2026-10-28 |
| CVE-2026-15323 | HIGH | 7.5 | The Product Designer for WooCommerce WordPress | Lumise plugin for WordPress is vulnerable to Direct… |
T1190
T1059
+1
|
|
2026-10-28 |
| CVE-2026-115281 | MEDIUM | 6.8 | The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not sanitize and cast a block and sho… |
T1190
T1005
+1
|
|
2026-10-28 |
| CVE-2026-115255 | MEDIUM | 5.3 | The WP Roster WordPress plugin before 2.35 does not perform any capability or nonce checks on one of… |
T1078
T1548
|
|
2026-10-28 |
| CVE-2026-115225 | MEDIUM | 5.8 | The Customer Engagement System WordPress plugin before 2.0.2 does not restrict access to its MailCh… |
T1078
T1548
|
|
2026-10-28 |
| CVE-2026-115224 | MEDIUM | 4.1 | The Customer Engagement System WordPress plugin before 2.0.2 does not safely build the SQL statemen… |
T1190
T1203
|
|
2026-10-28 |
| CVE-2026-113813 | MEDIUM | 6.5 | The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not perform any capability… |
T1190
T1059
+1
|
|
2026-10-28 |
| CVE-2026-113494 | LOW | 2.7 | The GeoDirectory WordPress plugin before 2.8.195 does not perform any status or ownership check whe… |
T1190
T1203
|
|
2026-10-28 |
| CVE-2026-113488 | MEDIUM | 6.8 | The GeoDirectory WordPress plugin before 2.8.196 does not properly escape a post badge shortcode at… |
T1190
T1203
|
|
2026-10-28 |
| CVE-2026-113487 | MEDIUM | 6.8 | The GeoDirectory WordPress plugin before 2.8.196 does not properly sanitise or escape a post badge … |
T1190
T1203
|
|
2026-10-28 |
| CVE-2026-113486 | MEDIUM | 6.5 | The Media Library Assistant WordPress plugin before 3.42 does not verify a CSRF nonce on its Empty T… |
T1190
T1203
|
|
2026-10-28 |
| CVE-2026-113485 | MEDIUM | 6.5 | The Media Library Assistant WordPress plugin before 3.42 does not consistently validate its CSRF non… |
T1190
T1203
|
|
2026-10-28 |
| CVE-2026-111967 | MEDIUM | 6.8 | The MP3 Audio Player WordPress plugin before 5.16 does not escape one of its audio player shortcode… |
T1190
T1203
|
|
2026-10-28 |
| CVE-2026-111961 | LOW | 3.8 | The Royal MCP WordPress plugin before 1.5.10 does not perform an object-level permission check befo… |
T1190
T1203
|
|
2026-10-28 |