VulnSea

Tagged “nvd”

CVEs tagged nvd, newest first.

25282 CVEsRSS

CVE-2026-94461Medium· 6.5
5d ago

Contributor Cross Site Scripting (XSS) in Ditty <= 3.1.69 versions.

Contributor Cross Site Scripting (XSS) in Ditty <= 3.1.69 versions.

▾ Sunlitmetaphorcreations · ditty-news-tickerEPSS 0.17%via NVD
CVE-2026-94391Medium· 6.5
5d ago

Contributor Cross Site Scripting (XSS) in Ultimate FAQ <= 2.4.14 versions.

Contributor Cross Site Scripting (XSS) in Ultimate FAQ <= 2.4.14 versions.

▾ SunlitRustaurius · ultimate-faqsEPSS 0.17%via NVD
CVE-2026-94500Medium· 6.5
5d ago

Contributor Cross Site Scripting (XSS) in ElementsKit Elementor addons Lite <= 4.0.5 versions.

Contributor Cross Site Scripting (XSS) in ElementsKit Elementor addons Lite <= 4.0.5 versions.

▾ SunlitRoxnor · elementskit-liteEPSS 0.17%via NVD
CVE-2026-94487High· 8.1
5d ago

Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Capabilities <= 2.50.1 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Capabilities <= 2.50.1 versions.

▾ TwilightPublishPress · capability-manager-enhancedEPSS 0.13%via NVD
CVE-2026-94671Medium· 6.5
5d ago

Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions.

Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions.

▾ SunlitRadiusTheme · the-post-gridEPSS 0.17%via NVD
CVE-2026-94498Medium· 6.5
5d ago

Unauthenticated Broken Access Control in AppMySite <= 3.15.4 versions.

Unauthenticated Broken Access Control in AppMySite <= 3.15.4 versions.

▾ SunlitAppMySite · appmysiteEPSS 0.24%via NVD
CVE-2026-94680Medium· 6.5
5d ago

Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions.

Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions.

▾ SunlitRadiusTheme · the-post-gridEPSS 0.17%via NVD
CVE-2026-94679Medium· 5.4
5d ago

Subscriber Broken Access Control in Fluent Support <= 2.3.2 versions.

Subscriber Broken Access Control in Fluent Support <= 2.3.2 versions.

▾ SunlitWPManageNinja · fluent-supportEPSS 0.23%via NVD
CVE-2026-94684Medium· 6.5
5d ago

Contributor Cross Site Scripting (XSS) in Ocean Extra <= 2.6.1 versions.

Contributor Cross Site Scripting (XSS) in Ocean Extra <= 2.6.1 versions.

▾ Sunlitoceanwp · ocean-extraEPSS 0.17%via NVD
CVE-2026-94682Medium· 6.5
5d ago

Contributor Cross Site Scripting (XSS) in Podcast Importer SecondLine <= 1.5.6 versions.

Contributor Cross Site Scripting (XSS) in Podcast Importer SecondLine <= 1.5.6 versions.

▾ SunlitSecondLineThemes · podcast-importer-secondlineEPSS 0.17%via NVD
CVE-2026-95515High· 7.1
5d ago

Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions.

Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions.

▾ TwilightKevin Stover · ninja-formsEPSS 0.18%via NVD
CVE-2026-95513High· 7.5
5d ago

Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 versions.

Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 versions.

▾ Twilightvcita · meeting-scheduler-by-vcitaEPSS 0.26%via NVD
CVE-2026-95523Medium· 6.5
5d ago

Subscriber Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.

Subscriber Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.

▾ SunlitweDevs · wp-user-frontendEPSS 0.34%via NVD
CVE-2026-95514Medium· 5.3
5d ago

Unauthenticated Bypass Vulnerability in Netgsm <= 2.10.0 versions.

Unauthenticated Bypass Vulnerability in Netgsm <= 2.10.0 versions.

▾ Sunlitnetgsm · netgsmEPSS 0.25%via NVD
CVE-2026-95522High· 7.6
5d ago

Shop manager SQL Injection in Easy Digital Downloads <= 3.7.0 versions.

Shop manager SQL Injection in Easy Digital Downloads <= 3.7.0 versions.

▾ TwilightSyed Balkhi · easy-digital-downloadsEPSS 0.29%via NVD
CVE-2026-95527Medium· 6.5
5d ago

Unauthenticated Broken Access Control in Conekta Payment Gateway <= 6.2.4 versions.

Unauthenticated Broken Access Control in Conekta Payment Gateway <= 6.2.4 versions.

▾ SunlitConekta Group · conekta-payment-gatewayEPSS 0.25%via NVD
CVE-2026-95525Medium· 6.5
5d ago

Subscriber Arbitrary File Deletion in WP User Frontend <= 4.3.11 versions.

Subscriber Arbitrary File Deletion in WP User Frontend <= 4.3.11 versions.

▾ SunlitweDevs · wp-user-frontendEPSS 0.47%via NVD
CVE-2026-95524Medium· 5.3
5d ago

Unauthenticated Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.

Unauthenticated Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.

▾ SunlitweDevs · wp-user-frontendEPSS 0.25%via NVD
CVE-2026-95530Medium· 6.5
5d ago

Subscriber Cross Site Scripting (XSS) in PixelYourSite – Your smart PIXEL (TAG) Manager <= 11.4.1 versions.

Subscriber Cross Site Scripting (XSS) in PixelYourSite – Your smart PIXEL (TAG) Manager <= 11.4.1 versions.

▾ SunlitPixelYourSite · pixelyoursiteEPSS 0.21%via NVD
CVE-2026-95529High· 7.1
5d ago

Unauthenticated Cross Site Scripting (XSS) in Calculated Fields Form <= 5.5.1.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Calculated Fields Form <= 5.5.1.1 versions.

▾ Twilightcodepeople · calculated-fields-formEPSS 0.18%via NVD
CVE-2026-95528High· 7.1
5d ago

Unauthenticated Cross Site Scripting (XSS) in Core Web Vitals & PageSpeed Booster <= 1.0.31 versions.

Unauthenticated Cross Site Scripting (XSS) in Core Web Vitals & PageSpeed Booster <= 1.0.31 versions.

▾ TwilightMohammed Kaludi · core-web-vitals-pagespeed-boosterEPSS 0.18%via NVD
CVE-2026-95590High· 7.1
5d ago

Subscriber SQL Injection in Tainacan <= 1.2.0 versions.

Subscriber SQL Injection in Tainacan <= 1.2.0 versions.

▾ Twilighttainacan · tainacanEPSS 0.29%via NVD
CVE-2026-95586Medium· 6.5
5d ago

Contributor Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <= 3.5.50 versions.

Contributor Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <= 3.5.50 versions.

▾ SunlitThemefic · ultimate-addons-for-contact-form-7EPSS 0.16%via NVD
CVE-2026-95593High· 7.6
5d ago

Editor SQL Injection in Ultimeter <= 3.0.8 versions.

Editor SQL Injection in Ultimeter <= 3.0.8 versions.

▾ TwilightBen Roberts · ultimeterEPSS 0.29%via NVD
CVE-2026-95592Medium· 5.3
5d ago

Unauthenticated Insecure Direct Object References (IDOR) in Team <= 6.0.0 versions.

Unauthenticated Insecure Direct Object References (IDOR) in Team <= 6.0.0 versions.

▾ SunlitOleh RadiusTheme · tlp-teamEPSS 0.24%via NVD
CVE-2026-95601Critical· 9.3
5d ago

Unauthenticated SQL Injection in Product Filter by WBW <= 3.1.7 versions.

Unauthenticated SQL Injection in Product Filter by WBW <= 3.1.7 versions.

▾ MidnightWBW Plugins · woo-product-filterEPSS 0.25%via NVD
CVE-2026-95600Medium· 5.3
5d ago

Unauthenticated Sensitive Data Exposure in TrustedLogin Connector <= 2.0.3 versions.

Unauthenticated Sensitive Data Exposure in TrustedLogin Connector <= 2.0.3 versions.

▾ SunlitTrustedLogin · trustedlogin-connectorEPSS 0.25%via NVD
CVE-2026-95604High· 7.5
5d ago

Unauthenticated Broken Access Control in Loops & Logic <= 4.2.4 versions.

Unauthenticated Broken Access Control in Loops & Logic <= 4.2.4 versions.

▾ TwilightTangible · tangible-loops-and-logicEPSS 0.33%via NVD
CVE-2026-95603High· 7.2
5d ago

Shop manager PHP Object Injection in Reycob Product Import Export <= 2.3.0 versions.

Shop manager PHP Object Injection in Reycob Product Import Export <= 2.3.0 versions.

▾ TwilightVictor Rodriguez · reycob-product-import-exportEPSS 0.40%via NVD
CVE-2026-95602Medium· 6.5
5d ago

Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects YITH WooCommerce Request A Quote: from n…

Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects YITH WooCommerce Request A Quote: from n…

▾ SunlitYITH · YITH WooCommerce Request A QuoteEPSS 0.28%via NVD
CVEs tagged “nvd” — page 65 · VulnSea