Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (15162 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-66469 2 Afonso Matos, Wordpress 2 Arvow Ai Seo Writer, Wordpress 2026-08-14 7.5 High
Unauthenticated Broken Access Control in Arvow AI SEO Writer <= 1.5.3 versions.
CVE-2026-66654 2 Tangiblewp, Wordpress 2 Vehica Core, Wordpress 2026-08-14 6 Medium
Subscriber Server Side Request Forgery (SSRF) in Vehica Core <= 1.0.104 versions.
CVE-2026-66661 2 Onokazu, Wordpress 2 Directories Pro, Wordpress 2026-08-14 7.7 High
Subscriber Privilege Escalation in Directories Pro <= 2.0.5 versions.
CVE-2026-66691 2 Scriptsbundle, Wordpress 2 Nokri, Wordpress 2026-08-14 9.8 Critical
Unauthenticated Broken Access Control in Nokri <= 1.6.6 versions.
CVE-2025-10308 2 Alian, Wordpress 2 Astro Booking Engine, Wordpress 2026-08-14 4.3 Medium
The Astro Booking Engine plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.0. This is due to missing nonce validation on the options deletion functionality. This makes it possible for unauthenticated attackers to delete all plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVE-2026-28184 2 10web, Wordpress 2 Form Maker By 10web, Wordpress 2026-08-14 N/A
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2026-27539 2 Welcart, Wordpress 2 Welcart E-commerce, Wordpress 2026-08-13 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Welcart e-Commerce <= 2.11.31 versions.
CVE-2026-27999 2 Themefic, Wordpress 2 Tourfic, Wordpress 2026-08-13 6.5 Medium
Subscriber Broken Access Control in Tourfic <= 2.23.1 versions.
CVE-2026-61962 2 Hakan Ozevin, Wordpress 2 Wp Base Booking, Wordpress 2026-08-13 10 Critical
Unauthenticated Arbitrary Code Execution in WP BASE Booking <= 6.3.0 versions.
CVE-2026-28188 2 Themefic, Wordpress 2 Hydra Booking, Wordpress 2026-08-13 7.3 High
Unauthenticated Broken Access Control in Hydra Booking <= 1.2.2 versions.
CVE-2026-66471 2 Themepoints, Wordpress 2 Accordion, Wordpress 2026-08-13 6.5 Medium
Subscriber Cross Site Scripting (XSS) in Accordion <= 3.0.6 versions.
CVE-2026-66689 2 Acymailing Newsletter Team, Wordpress 2 Anti Spam And List Cleaner – Acychecker, Wordpress 2026-08-13 6.3 Medium
Unauthenticated Broken Access Control in Anti Spam and list cleaner &#8211; AcyChecker <= 2.0.0 versions.
CVE-2026-66697 2 Colissimo, Wordpress 2 Colissimo Officiel : Méthodes De Livraison Pour Woocommerce, Wordpress 2026-08-13 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.10.0 versions.
CVE-2026-3639 2 Buildwps, Wordpress 2 Ppwp – Password Protect Pages, Wordpress 2026-08-13 6.4 Medium
The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `ppwp` shortcode attributes in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2026-28001 2 Wordpress, Wpdirectorykit 2 Wordpress, Wp Directory Kit 2026-08-13 9.3 Critical
Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.
CVE-2026-28182 2 Acymailing Newsletter Team, Wordpress 2 Acymailing Smtp Newsletter, Wordpress 2026-08-13 6.5 Medium
Subscriber Cross Site Scripting (XSS) in AcyMailing SMTP Newsletter <= 10.11.1 versions.
CVE-2026-28187 2 Echoplugins, Wordpress 2 Knowledge Base For Documentation, Faqs With Ai Assistance, Wordpress 2026-08-13 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Knowledge Base for Documentation, FAQs with AI Assistance <= 17.211.0 versions.
CVE-2026-61969 2 Webilia Inc., Wordpress 2 Listdom, Wordpress 2026-08-13 9.3 Critical
Unauthenticated SQL Injection in Listdom <= 5.6.0 versions.
CVE-2026-61979 2 Miniorange, Wordpress 2 Saml Sp Single Sign On, Wordpress 2026-08-13 8.1 High
Unauthenticated Privilege Escalation in SAML SP Single Sign On <= 5.4.3 versions.
CVE-2026-73344 2 Passionate Programmer Peter, Wordpress 2 Wp Data Access, Wordpress 2026-08-13 5.9 Medium
Author Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions.