Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (14349 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2026-57384 2 Membershipsoftware, Wordpress 2 Wishlist Member X, Wordpress 2026-07-23 6.5 Medium
Subscriber Cross Site Scripting (XSS) in WishList Member X <= 3.32.0 versions.
CVE-2026-57735 2 Soflyy, Wordpress 2 Breakdance, Wordpress 2026-07-23 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Breakdance <= 2.7.1 versions.
CVE-2026-57809 2 Affiliatewp, Wordpress 2 Affiliatewp, Wordpress 2026-07-23 7.1 High
Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.34.0 versions.
CVE-2026-61950 2 Themetechmount, Wordpress 2 Truebooker, Wordpress 2026-07-23 9.3 Critical
Unauthenticated SQL Injection in TrueBooker <= 1.2.3 versions.
CVE-2026-65449 2 Romancode, Wordpress 2 Mapsvg, Wordpress 2026-07-23 6.5 Medium
Contributor Cross Site Scripting (XSS) in MapSVG <= 8.14.0 versions.
CVE-2026-65487 2 Themegoods, Wordpress 2 Photography, Wordpress 2026-07-23 5.3 Medium
Unauthenticated Broken Access Control in Photography <= 7.7.6 versions.
CVE-2026-65519 2 Gt3themes, Wordpress 2 Photo Gallery, Wordpress 2026-07-23 6.5 Medium
Author Cross Site Scripting (XSS) in Photo Gallery <= 2.7.7.29 versions.
CVE-2026-65512 2 Melapress, Wordpress 2 Wp Activity Log, Wordpress 2026-07-23 5.4 Medium
Unauthenticated Cross Site Request Forgery (CSRF) in WP Activity Log <= 5.6.4 versions.
CVE-2026-65460 2 Wordpress, Zarinpal 2 Wordpress, Zarinpal Gateway 2026-07-23 4.3 Medium
Unauthenticated Cross Site Request Forgery (CSRF) in Zarinpal Gateway <= 5.1.0 versions.
CVE-2026-65453 2 Motovnet, Wordpress 2 Ebook Store, Wordpress 2026-07-23 5.3 Medium
Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions.
CVE-2026-15145 2 Wordpress, Wpdevteam 2 Wordpress, Essential Addons For Elementor – Popular Elementor Templates & Widgets 2026-07-23 6.4 Medium
The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Fancy Text Widget in all versions up to, and including, 6.6.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2026-27355 2 Metaphorcreations, Wordpress 2 Ditty, Wordpress 2026-07-23 5.3 Medium
Unauthenticated Broken Access Control in Ditty <= 3.1.66 versions.
CVE-2026-65528 2 Bannersky, Wordpress 2 Bsk Pdf Manager, Wordpress 2026-07-23 6.5 Medium
Contributor Cross Site Scripting (XSS) in BSK PDF Manager <= 3.8 versions.
CVE-2026-65530 2 Templatespare, Wordpress 2 Templatespare, Wordpress 2026-07-23 4.3 Medium
Subscriber Broken Access Control in TemplateSpare <= 4.2.2 versions.
CVE-2026-65051 2 Ninjaforms, Wordpress 2 Ninja Forms, Wordpress 2026-07-23 6.5 Medium
Ninja Forms WordPress plugin version 3.14.8 contains a client-side enforcement of server-side security vulnerability that allows unauthenticated attackers to bypass all form validation by merging attacker-controlled field metadata over server-loaded form definitions before validation runs. Attackers can craft a malicious AJAX submission overriding field types, removing required flags, and disabling CAPTCHA checks through the nopriv AJAX endpoint to trigger form actions such as email notifications and database storage with unverified, attacker-controlled content.
CVE-2026-59541 2 Hakan Ozevin, Wordpress 2 Wp Base Booking, Wordpress 2026-07-23 8.8 High
Subscriber Privilege Escalation in WP BASE Booking <= 6.3.1 versions.
CVE-2026-57428 2 Boldgrid, Wordpress 2 Sprout Clients, Wordpress 2026-07-23 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Sprout Clients <= 3.2.3 versions.
CVE-2026-61946 2 Easy-appointments, Wordpress 2 Easy Appointments, Wordpress 2026-07-23 6.5 Medium
Unauthenticated Insecure Direct Object References (IDOR) in Easy Appointments <= 3.12.27 versions.
CVE-2026-65456 2 Pickplugins, Wordpress 2 Product Slider For Woocommerce, Wordpress 2026-07-23 4.3 Medium
Contributor Insecure Direct Object References (IDOR) in Product Slider for WooCommerce <= 1.13.62 versions.
CVE-2026-9066 2 Wordpress, Wpcompress 2 Wordpress, Wp Compress 2026-07-23 6.1 Medium
The WP Compress WordPress plugin before 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build the URLs of JavaScript files emitted on the page, leading to Reflected XSS. When a visitor follows a crafted link, the WP Compress WordPress plugin before 7.10.04's loader injects script elements pointing to an attacker-controlled origin, which lets the attacker execute arbitrary JavaScript in the visitor's session on the target site.