| CVE/PSC | Application | Date | Affected versions | Description |
|---|---|---|---|---|
| Actual on: Nov 04, 2026, 03:11:09 | ||||
|
Product Gallery Slider, Additional Variation Images for WooCommerce
vulnerable
|
Nov 04, 2026, 03:11:35 |
Min -
Max 2.3.26
|
Product Gallery Slider & Additional Variation Images for WooCommerce 2.3.23 before 2.3.26 contains a missing authorization vulnerability in Codestar backup AJAX actions csf-export, csf-import and csf-reset. Shop Managers can read the csf_backup_nonce from the settings page and supply arbitrary option names via the 'unique' parameter to read, overwrite or delete WordPress options, including modifying wp_user_roles to escalate to administrator. | |
|
PAYable Payment Gateway for WooCommerce
vulnerable
|
Nov 04, 2026, 02:11:14 |
Min -
Max 1.3.1
|
The Payable Payment Gateway for WooCommerce WordPress plugin before 1.3.1 does not verify the authenticity of an incoming payment notification before marking a WooCommerce order paid or failed, allowing unauthenticated attackers to change the payment status of any order in the store regardless of the payment method it was placed with. | |
|
ClickCease Click Fraud Protection
vulnerable
|
Nov 04, 2026, 01:11:43 |
Min -
Max 3.3.1
|
Missing Authorization vulnerability in eranfl ClickCease Click Fraud Protection clickcease-click-fraud-protection allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ClickCease Click Fraud Protection: from n/a through 3.3.0. | |
|
vulnerable
|
Nov 03, 2026, 23:11:55 |
Min -
Max 261001
|
The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, <= 260927 via the 'item_name' parameter parameter. This is due to insufficient sanitization in strip_php_tags_deep(), which only strips literal '<?' sequences, combined with a post-interpolation placeholder cleanup that reassembles a valid '<?php' opener after the attacker-controlled value has already been embedded in the email template. This makes it possible for authenticated attackers, with cust... | |
|
vulnerable
|
Nov 03, 2026, 19:11:03 |
Min -
Max 1.5.4
|
The WP Fastest Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.5.3. The plugin caches the response of Core’s wp-activate.php without honoring its no-store/no-cache headers, the wp-activate-* cookie, or the WP_INSTALLING state, writing the credential-bearing activation response to a publicly accessible cache file. This makes it possible for unauthenticated attackers to retrieve the plaintext username and twelve-character password of the most ... | |
|
Contact Form builder with drag & drop for WordPress – Kali Forms
vulnerable
|
Nov 03, 2026, 17:11:47 |
Min -
Max 2.4.30
|
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check on its test-email handler, relying only on a nonce that is available to any logged-in user, so a low-privileged user such as a Subscriber can make the site send email to an arbitrary recipient with a spoofed sender address. | |
|
Contact Form builder with drag & drop for WordPress – Kali Forms
vulnerable
|
Nov 03, 2026, 17:11:47 |
Min -
Max 2.4.30
|
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check when its test-email handler resolves and returns a user's email address, relying only on a nonce that is available to any logged-in user, allowing authenticated users with minimal privileges (Subscriber and above) to disclose the email address of any registered user, including administrators. | |
|
Ultimate Addons for Contact Form 7
vulnerable
|
Nov 03, 2026, 16:11:20 |
Min -
Max 3.5.55
|
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the _getObjAttr function in all versions up to, and including, 3.5.54. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This requires the PDF Generator add-on to be active and a Contact Form 7 form to be configured for PDF... | |
|
vulnerable
|
Nov 03, 2026, 12:11:26 |
Min -
Max 2.0.6
|
The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that writes post data, allowing unauthenticated attackers to overwrite the title of arbitrary posts, create arbitrary published posts, and overwrite the Mapster WP Maps WordPress plugin before 2.0.6's stored settings. | |
|
vulnerable
|
Nov 03, 2026, 02:11:21 |
Min -
Max 5.0.0
|
The All-in-One Video Gallery WordPress plugin before 5.0.0 does not check a video's publication status before rendering it on its player page, allowing unauthenticated users to view the title and source URLs of private, draft, pending, scheduled and trashed videos by their ID. | |