Explore CVE records

MedPublished 25 Mar 2026, 23:14 WIB

CVE-2026-32492

WordPress My Tickets plugin <= 2.1.1 - Bypass Vulnerability vulnerability

Authentication Bypass by Spoofing vulnerability in Joe Dolson My Tickets my-tickets allows Identity Spoofing.This issue affects My Tickets: from n/a through <= 2.1.1.

Excerpt language: en.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 16:52 WIB

Official record

MedPublished 25 Mar 2026, 23:14 WIB

CVE-2026-32491

WordPress WP Review Slider plugin <= 13.9 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jgwhite33 WP Review Slider wp-facebook-reviews allows Stored XSS.This issue affects WP Review Slider: from n/a through <= 13.9.

Excerpt language: en.

MedPublished 25 Mar 2026, 23:14 WIB

CVE-2026-32490

WordPress WP TripAdvisor Review Slider plugin <= 14.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jgwhite33 WP TripAdvisor Review Slider wp-tripadvisor-review-slider allows Stored XSS.This issue affects WP TripAdvisor Review Slider: from n/a through <= 14.1.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 16:52 WIB

Official record

MedPublished 25 Mar 2026, 23:14 WIB

CVE-2026-32489

WordPress B Blocks plugin < 2.0.30 - Broken Access Control vulnerability

Missing Authorization vulnerability in bPlugins B Blocks b-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects B Blocks: from n/a through < 2.0.30.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 16:52 WIB

Official record

HighPublished 25 Mar 2026, 23:14 WIB

CVE-2026-32488

WordPress User Registration plugin <= 4.4.9 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in wpeverest User Registration user-registration allows Privilege Escalation.This issue affects User Registration: from n/a through <= 4.4.9.

Excerpt language: en.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 16:52 WIB

Official record

HighPublished 25 Mar 2026, 23:14 WIB

CVE-2026-32485

WordPress WP User Frontend plugin <= 4.2.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through <= 4.2.8.

Excerpt language: en.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 16:52 WIB

Official record

HighPublished 25 Mar 2026, 23:14 WIB

CVE-2026-32484

WordPress weForms plugin <= 1.6.26 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in BoldGrid weForms weforms allows Object Injection.This issue affects weForms: from n/a through <= 1.6.26.

Excerpt language: en.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 16:52 WIB

Official record

MedPublished 25 Mar 2026, 23:14 WIB

CVE-2026-32483

WordPress Contact Form Email plugin <= 1.3.63 - Broken Access Control vulnerability

Missing Authorization vulnerability in codepeople Contact Form Email contact-form-to-email allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form Email: from n/a through <= 1.3.63.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 16:52 WIB

Official record

CritPublished 25 Mar 2026, 23:14 WIB

CVE-2026-32482

WordPress Ona theme < 1.24 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in deothemes Ona ona allows Upload a Web Shell to a Web Server.This issue affects Ona: from n/a through < 1.24.

Excerpt language: en.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 16:52 WIB

Official record

HighPublished 25 Mar 2026, 23:14 WIB

CVE-2026-32441

WordPress Comments Import & Export plugin <= 2.4.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in WebToffee Comments Import & Export comments-import-export-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Comments Import & Export: from n/a through <= 2.4.9.

Excerpt language: en.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 16:51 WIB

Official record

HighPublished 25 Mar 2026, 23:14 WIB

CVE-2026-31921

WordPress Product Rearrange for WooCommerce plugin <= 1.2.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Devteam HaywoodTech Product Rearrange for WooCommerce products-rearrange-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Rearrange for WooCommerce: from n/a through <= 1.2.2.

Excerpt language: en.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 16:51 WIB

Official record

CritPublished 25 Mar 2026, 23:14 WIB

CVE-2026-31920

WordPress Product Rearrange for WooCommerce plugin <= 1.2.2 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Devteam HaywoodTech Product Rearrange for WooCommerce products-rearrange-woocommerce allows Blind SQL Injection.This issue affects Product Rearrange for WooCommerce: from n/a through <= 1.2.2.

Excerpt language: en.

CVSS9.3v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 16:51 WIB

Official record

MedPublished 25 Mar 2026, 23:14 WIB

CVE-2026-31914

WordPress WP Courses LMS plugin <= 3.2.26 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hookandhook WP Courses LMS wp-courses allows DOM-Based XSS.This issue affects WP Courses LMS: from n/a through <= 3.2.26.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 16:51 WIB

Official record

HighPublished 25 Mar 2026, 23:14 WIB

CVE-2026-31913

WordPress Scape theme < 1.5.16 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Whitebox-Studio Scape scape allows Path Traversal.This issue affects Scape: from n/a through < 1.5.16.

Excerpt language: en.

CVSS8.6v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 16:51 WIB

Official record

CritPublished 25 Mar 2026, 23:14 WIB

CVE-2026-27095

WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.6.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in magepeopleteam Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Object Injection.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through <= 5.6.0.

Excerpt language: en.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:15 WIB

Official record

HighPublished 25 Mar 2026, 23:14 WIB

CVE-2026-27088

WordPress Darna Framework plugin <= 2.9 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in G5Theme Darna Framework darna-framework allows Reflected XSS.This issue affects Darna Framework: from n/a through <= 2.9.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:15 WIB

Official record

HighPublished 25 Mar 2026, 23:14 WIB

CVE-2026-27087

WordPress Wolverine Framework plugin <= 1.9 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in G5Theme Wolverine Framework wolverine-framework allows Reflected XSS.This issue affects Wolverine Framework: from n/a through <= 1.9.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:15 WIB

Official record

CritPublished 25 Mar 2026, 23:14 WIB

CVE-2026-27084

WordPress Buisson theme <= 1.1.11 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Buisson buisson allows Object Injection.This issue affects Buisson: from n/a through <= 1.1.11.

Excerpt language: en.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:15 WIB

Official record

CritPublished 25 Mar 2026, 23:14 WIB

CVE-2026-27083

WordPress Work & Travel Company theme <= 1.2 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Work & Travel Company work-travel-company allows Object Injection.This issue affects Work & Travel Company: from n/a through <= 1.2.

Excerpt language: en.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:15 WIB

Official record

CritPublished 25 Mar 2026, 23:14 WIB

CVE-2026-27082

WordPress Love Story theme <= 1.3.12 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Love Story lovestory allows Object Injection.This issue affects Love Story: from n/a through <= 1.3.12.

Excerpt language: en.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:15 WIB

Official record

Find the CVE cohort

Severity

Matching records by UTC month

Signal coverage

Find the CVE cohort

Matching cohort composition

Severity

Matching records by UTC month

Signal coverage