Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (1255 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-111833 2 Boldgrid, Wordpress-extensions 2 Weforms, Weforms 2026-11-10 7.5 High
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bold Grid weForms weforms allows Path Traversal.This issue affects weForms: from n/a through 1.6.28.
CVE-2026-112359 2 Amauri, Wordpress-extensions 2 Wpmobile.app, Wpmobile.app 2026-11-10 7.5 High
Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPMobile.App: from n/a through 11.86.
CVE-2026-115204 1 Wordpress-extensions 1 Azexo Store Locator 2026-11-09 8.8 High
The AZEXO Store Locator WordPress plugin through 1.4 does not perform capability or nonce checks on its AJAX actions and does not sanitise a request header used to build a file path, allowing any authenticated user such as a subscriber to write a file with an arbitrary name, location, and content, leading to remote code execution.
CVE-2026-123482 2 Crocoblock, Wordpress-extensions 2 Jetformbuilder, Jetformbuilder 2026-11-09 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Stored XSS.This issue affects JetFormBuilder: from n/a through 3.6.8.
CVE-2026-118054 2 Thimpress, Wordpress-extensions 2 Learnpress – Course Review, Learnpress 2026-11-09 6.4 Medium
The LearnPress – Course Review plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'review_title (inside `data.args.review_title`)' parameter in all versions up to, and including, 4.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload only executes after an administrator approves the submitted review, though sites with comment_previously_approved auto-approval configured may bypass manual moderation.
CVE-2026-119510 2 Saeed, Wordpress-extensions 2 Mc Woocommerce Wishlist, Mc Woocommerce Wishlist 2026-11-09 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saeed MC Woocommerce Wishlist smart-wishlist-for-more-convert allows Stored XSS.This issue affects MC Woocommerce Wishlist: from n/a through 2.0.3.
CVE-2026-119511 2 Saeed, Wordpress-extensions 2 Mc Woocommerce Wishlist, Mc Woocommerce Wishlist 2026-11-09 5.3 Medium
Missing Authorization vulnerability in Saeed MC Woocommerce Wishlist smart-wishlist-for-more-convert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MC Woocommerce Wishlist: from n/a through 2.0.3.
CVE-2026-119503 2 Welcart, Wordpress-extensions 2 Welcart E-commerce, Welcart E-commerce 2026-11-09 6.5 Medium
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Welcart Welcart e-Commerce usc-e-shop allows Code Injection.This issue affects Welcart e-Commerce: from n/a through 2.12.6.
CVE-2026-123484 2 Crocoblock, Wordpress-extensions 2 Jetformbuilder, Jetformbuilder 2026-11-09 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetFormBuilder jetformbuilder allows DOM-Based XSS.This issue affects JetFormBuilder: from n/a through 3.6.8.
CVE-2026-123483 2 Crocoblock, Wordpress-extensions 2 Jetformbuilder, Jetformbuilder 2026-11-09 5.3 Medium
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through 3.6.8.
CVE-2026-123470 2 Hivepress, Wordpress-extensions 2 Hivepress, Hivepress 2026-11-09 4.3 Medium
Missing Authorization vulnerability in HivePress HivePress hivepress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress: from n/a through 1.8.1.
CVE-2026-119504 2 Dynamiapps, Wordpress-extensions 2 Frontend Admin By Dynamiapps, Frontend Admin By Dynamiapps 2026-11-09 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DynamiApps Frontend Admin by DynamiApps acf-frontend-form-element allows Stored XSS.This issue affects Frontend Admin by DynamiApps: from n/a through 3.30.1.
CVE-2026-119483 2 10web, Wordpress-extensions 2 Form Maker By 10web, Form Maker By 10web 2026-11-09 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Maker by 10Web form-maker allows Stored XSS.This issue affects Form Maker by 10Web: from n/a through 1.15.50.
CVE-2026-54863 2 Mamunur Rashid, Wordpress-extensions 2 Review Schema, Review Schema 2026-11-09 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mamunur Rashid Review Schema review-schema allows Reflected XSS.This issue affects Review Schema: from n/a through 3.1.4.
CVE-2026-123475 2 Pt Norther Lights Production, Wordpress-extensions 2 Mapsvg, Mapsvg 2026-11-09 7.5 High
Missing Authorization vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MapSVG: from n/a through 8.16.3.
CVE-2026-122661 2 Wordpress-extensions, Wpwax 2 Directorist, Directorist 2026-11-09 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Directorist directorist allows Stored XSS.This issue affects Directorist: from n/a through 8.10.7.
CVE-2026-123460 2 Nickboss, Wordpress-extensions 2 Wordpress File Upload, Wordpress File Upload 2026-11-09 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nickboss WordPress File Upload wp-file-upload allows Stored XSS.This issue affects WordPress File Upload: from n/a through 5.2.2.
CVE-2026-119497 2 Wordpress-extensions, Wpwax 2 Directorist, Directorist 2026-11-09 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Directorist directorist allows Stored XSS.This issue affects Directorist: from n/a through 8.10.6.
CVE-2026-97194 1 Wordpress-extensions 1 Secure Custom Fields 2026-11-08 2.7 Low
The Secure Custom Fields WordPress plugin before 6.9.8 does not perform a read-permission check when it renders and formats the values of its relational fields, allowing users with post-editing access (Contributor and above) to disclose the titles and non-public statuses of other users' unpublished posts.
CVE-2026-96963 1 Wordpress-extensions 1 Pie Register 2026-11-08 2.7 Low
The Pie Register WordPress plugin through 3.8.4.15 does not perform an authorisation check in one of its AJAX actions, allowing users with a role as low as contributor to modify existing administrator-created invitation-code records.