Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (15551 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-66638 2 Shabti, Wordpress 2 Frontend Admin By Dynamapps, Wordpress 2026-08-24 6.5 Medium
Contributor Cross Site Scripting (XSS) in Frontend Admin by DynamiApps <= 3.29.10 versions.
CVE-2026-68568 2 Stylemixthemes, Wordpress 2 Masterstudy Lms, Wordpress 2026-08-24 6.3 Medium
Subscriber Privilege Escalation in MasterStudy LMS <= 3.7.41 versions.
CVE-2026-73190 2 Shahjada, Wordpress 2 Wpdm Premium Packages, Wordpress 2026-08-24 7.1 High
Unauthenticated Cross Site Scripting (XSS) in WPDM – Premium Packages <= 7.0.5 versions.
CVE-2026-73378 2 Supsysticcom, Wordpress 2 Contact Form By Supsystic, Wordpress 2026-08-24 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Contact Form by Supsystic < 1.10.0 versions.
CVE-2026-73379 2 Supsysticcom, Wordpress 2 Contact Form By Supsystic, Wordpress 2026-08-24 6.5 Medium
Unauthenticated Bypass Vulnerability in Contact Form by Supsystic < 1.10.0 versions.
CVE-2026-73395 2 Wordpress, Wpdevart 3 Wordpress, Booking Calendar, Booking Calendar, Appointment Booking System 2026-08-24 6.5 Medium
Unauthenticated Insecure Direct Object References (IDOR) in Booking calendar, Appointment Booking System <= 3.2.36 versions.
CVE-2026-18027 2 Webtoffee, Wordpress 2 Woocommerce Pdf Invoices, Packing Slips, Delivery Notes And Shipping Labels, Wordpress 2026-08-24 6.5 Medium
The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.9.8 via the get_image_src_in_base64 function. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The base64-encoded file contents are embedded into the cached invoice HTML and served directly to the attacker via the plugin's own Print/Download invoice endpoints, which require only a valid nonce and access key.
CVE-2026-66584 2 Code4recovery, Wordpress 2 12 Step Meeting List, Wordpress 2026-08-24 7.1 High
Unauthenticated Cross Site Scripting (XSS) in 12 Step Meeting List <= 3.19.16 versions.
CVE-2026-78258 2 Magepeople, Wordpress 2 Booking & Rental Manager, Wordpress 2026-08-24 5.3 Medium
Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.5 versions.
CVE-2026-78270 2 Wordpress, Wpmanageninja 2 Wordpress, Fluentcrm 2026-08-24 7.6 High
Author SQL Injection in FluentCRM Pro <= 3.1.12 versions.
CVE-2026-78272 2 Wordpress, Wpmanageninja 2 Wordpress, Fluent Support 2026-08-24 5.4 Medium
Subscriber Broken Access Control in Fluent Support Pro <= 2.3.1 versions.
CVE-2026-78277 2 Wordpress, Wpmanageninja 2 Wordpress, Fluentcrm 2026-08-24 4.9 Medium
Subscriber Server Side Request Forgery (SSRF) in FluentCRM Pro <= 3.1.12 versions.
CVE-2026-78278 2 Wordpress, Wpmanageninja 2 Wordpress, Fluent Forms 2026-08-24 5.3 Medium
Subscriber Insecure Direct Object References (IDOR) in Fluent Boards Pro <= 2.0.11 versions.
CVE-2026-78279 2 Wordpress, Wpmanageninja 2 Wordpress, Fluent Support 2026-08-24 5.4 Medium
Unauthenticated Cross Site Request Forgery (CSRF) in Fluent Support Pro <= 2.3.1 versions.
CVE-2026-28151 2 Select-themes, Wordpress 2 Tonda Core, Wordpress 2026-08-24 8.1 High
Unauthenticated Local File Inclusion in Tonda < 2.6 versions.
CVE-2026-32477 2 Radiustheme, Wordpress 2 Shopbuilder – Elementor Woocommerce Builder Addons, Wordpress 2026-08-24 8.6 High
Unauthenticated Arbitrary File Deletion in ShopBuilder Pro – Elementor WooCommerce Builder Addons <= 2.2.0 versions.
CVE-2026-32478 2 Wedevs, Wordpress 2 Wp Project Manager, Wordpress 2026-08-24 8.5 High
Subscriber SQL Injection in WP Project Manager Pro <= 4.0.1 versions.
CVE-2026-66650 2 Themerex, Wordpress 2 Freightco, Wordpress 2026-08-24 9.8 Critical
Unauthenticated PHP Object Injection in FreightCo <= 1.1.15 versions.
CVE-2026-4559 2 Wordpress, Wpchill 2 Wordpress, Image Photo Gallery Final Tiles Grid 2026-08-24 6.4 Medium
The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'delay' shortcode attribute in all versions up to, and including, 3.6.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2026-4245 2 Metaphorcreations, Wordpress 2 Post Duplicator, Wordpress 2026-08-24 4.3 Medium
The Post Duplicator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.11. This is due to the `duplicate_post_permissions()` permission callback only verifying the `duplicate_posts` capability without checking whether the requesting user holds `publish_posts` or other status-gated capabilities. This makes it possible for authenticated attackers, with Contributor-level access and above, to create duplicate posts with `future` (scheduled, auto-publishes) or `private` status, bypassing editorial review. Additionally, the REST endpoint does not enforce administrator-configured post-type duplication restrictions, allowing duplication of post types that have been explicitly disabled.