Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (15976 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-79632 2 Getwpfunnels, Wordpress 2 Wpfunnels, Wordpress 2026-09-04 5.3 Medium
The WPFunnels WordPress plugin before 3.13.0 does not perform any authorisation or nonce check in one of its opt-in submission handlers, and takes the notification recipients and subject from the request, allowing unauthenticated users to make the site send emails to arbitrary recipients with an arbitrary subject.
CVE-2026-57777 2 Automattic, Wordpress 2 Woocommerce, Wordpress 2026-09-04 7.6 High
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Automattic WooCommerce allows Blind SQL Injection. This issue affects WooCommerce: from n/a before 11.0.
CVE-2026-79630 2 Getwpfunnels, Wordpress 2 Wpfunnels, Wordpress 2026-09-04 5.3 Medium
The WPFunnels WordPress plugin before 3.13.0 does not verify that the product requested through a checkout order bump is the product that bump's discount was configured for, allowing unauthenticated users to obtain any purchasable product at a discount intended for a different one, with the reduced price carried through to the total of the order they place.
CVE-2026-79631 2 Getwpfunnels, Wordpress 2 Wpfunnels, Wordpress 2026-09-04 5.3 Medium
The WPFunnels WordPress plugin before 3.13.0 does not restrict access to the log files it writes to a predictable location under the public uploads directory, allowing unauthenticated users to download customer order details and opt-in form submissions when logging is enabled.
CVE-2026-82193 2 Wordpress, Wpvividplugins 2 Wordpress, Wpvivid — Backup, Migration & Staging 2026-09-04 5.5 Medium
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied file name before using it to build a write path, allowing administrators to write files of permitted types to arbitrary locations on the server and to overwrite existing files.
CVE-2026-81282 2 Villatheme, Wordpress 2 Product Variations Swatches For Woocommerce, Wordpress 2026-09-04 6.5 Medium
Subscriber Cross Site Scripting (XSS) in Product Variations Swatches for WooCommerce <= 1.1.18 versions.
CVE-2026-81292 2 Ido Kobelkowsky, Wordpress 2 Simple Payment, Wordpress 2026-09-04 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Simple Payment <= 2.5.1 versions.
CVE-2026-81300 2 Silverplugins217, Wordpress 2 Calculation For Contact Form 7, Wordpress 2026-09-04 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Calculation For Contact Form 7 <= 1.0 versions.
CVE-2026-81776 2 Advanpix, Wordpress 2 Wp Quicklatex, Wordpress 2026-09-04 7.1 High
Unauthenticated Cross Site Scripting (XSS) in WP QuickLaTeX <= 3.8.8 versions.
CVE-2026-84765 2 John Havlik, Wordpress 2 Breadcrumb Navxt, Wordpress 2026-09-04 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Breadcrumb NavXT <= 7.5.1 versions.
CVE-2026-84767 2 Nexcess, Wordpress 2 Bookit, Wordpress 2026-09-04 5.3 Medium
Unauthenticated Bypass Vulnerability in BookIt <= 2.6.0.3 versions.
CVE-2026-84773 2 Wordpress, 作者 2 Wordpress, Shane Bishop:ewww Image Optimizer 2026-09-04 7.2 High
Unauthenticated Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.6 versions.
CVE-2026-84776 2 Malcare, Wordpress 2 Malcare Security, Wordpress 2026-09-04 7.5 High
Unauthenticated Denial of Service Attack in MalCare Security <= 6.69 versions.
CVE-2026-84779 2 Sheikh Heera, Wordpress 2 Agentimus – Ai Seo, Llms.txt & Mcp For Ai Agents, Wordpress 2026-09-04 8.1 High
Subscriber Broken Access Control in Agentimus – AI SEO, llms.txt &amp; MCP for AI Agents <= 1.51.0 versions.
CVE-2026-84836 2 Kirillbdev, Wordpress 2 Wc Ukraine Shipping, Wordpress 2026-09-04 7.1 High
Subscriber Insecure Direct Object References (IDOR) in WC Ukraine Shipping <= 1.22.3 versions.
CVE-2026-84848 2 Brightvesseldev, Wordpress 2 Quick Event Manager, Wordpress 2026-09-04 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Quick Event Manager <= 9.17 versions.
CVE-2026-85307 2 Kevin Pirnie, Wordpress 2 Kp Agent Ready, Wordpress 2026-09-04 5.3 Medium
Insertion of Sensitive Information Into Sent Data vulnerability in Kevin Pirnie KP Agent Ready allows Retrieve Embedded Sensitive Data. This issue affects KP Agent Ready: from n/a before 1.2.08.
CVE-2026-82194 2 Wordpress, Wpvividplugins 2 Wordpress, Wpvivid — Backup, Migration & Staging 2026-09-04 5.5 Medium
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied path before using it in a file deletion routine, allowing administrators to delete arbitrary files on the server, including files outside the web root.
CVE-2026-84146 2 Wordpress, Xpro 2 Wordpress, Xpro Addons — 140+ Widgets For Elementor 2026-09-04 5.3 Medium
The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.8 does not perform any capability or post-status check before rendering a WooCommerce product summary from a supplied product identifier, allowing unauthenticated visitors to retrieve the title, price, SKU, description and stock details of products that are not publicly published (draft, pending, private or scheduled status).
CVE-2026-85306 2 Cascadiawebservices, Wordpress 2 Mountdev Ai Mcp Connector For Wordpress, Wordpress 2026-09-04 6.5 Medium
Missing Authorization vulnerability in Cascadia Web Services MountDev AI MCP Connector for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MountDev AI MCP Connector for WordPress: from n/a through 1.6.5.