Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (1253 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-115204 1 Wordpress-extensions 1 Azexo Store Locator 2026-11-09 8.8 High
The AZEXO Store Locator WordPress plugin through 1.4 does not perform capability or nonce checks on its AJAX actions and does not sanitise a request header used to build a file path, allowing any authenticated user such as a subscriber to write a file with an arbitrary name, location, and content, leading to remote code execution.
CVE-2026-123482 2 Crocoblock, Wordpress-extensions 2 Jetformbuilder, Jetformbuilder 2026-11-09 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Stored XSS.This issue affects JetFormBuilder: from n/a through 3.6.8.
CVE-2026-118054 2 Thimpress, Wordpress-extensions 2 Learnpress – Course Review, Learnpress 2026-11-09 6.4 Medium
The LearnPress – Course Review plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'review_title (inside `data.args.review_title`)' parameter in all versions up to, and including, 4.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload only executes after an administrator approves the submitted review, though sites with comment_previously_approved auto-approval configured may bypass manual moderation.
CVE-2026-119510 2 Saeed, Wordpress-extensions 2 Mc Woocommerce Wishlist, Mc Woocommerce Wishlist 2026-11-09 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saeed MC Woocommerce Wishlist smart-wishlist-for-more-convert allows Stored XSS.This issue affects MC Woocommerce Wishlist: from n/a through 2.0.3.
CVE-2026-119511 2 Saeed, Wordpress-extensions 2 Mc Woocommerce Wishlist, Mc Woocommerce Wishlist 2026-11-09 5.3 Medium
Missing Authorization vulnerability in Saeed MC Woocommerce Wishlist smart-wishlist-for-more-convert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MC Woocommerce Wishlist: from n/a through 2.0.3.
CVE-2026-119503 2 Welcart, Wordpress-extensions 2 Welcart E-commerce, Welcart E-commerce 2026-11-09 6.5 Medium
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Welcart Welcart e-Commerce usc-e-shop allows Code Injection.This issue affects Welcart e-Commerce: from n/a through 2.12.6.
CVE-2026-123484 2 Crocoblock, Wordpress-extensions 2 Jetformbuilder, Jetformbuilder 2026-11-09 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetFormBuilder jetformbuilder allows DOM-Based XSS.This issue affects JetFormBuilder: from n/a through 3.6.8.
CVE-2026-123483 2 Crocoblock, Wordpress-extensions 2 Jetformbuilder, Jetformbuilder 2026-11-09 5.3 Medium
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through 3.6.8.
CVE-2026-123470 2 Hivepress, Wordpress-extensions 2 Hivepress, Hivepress 2026-11-09 4.3 Medium
Missing Authorization vulnerability in HivePress HivePress hivepress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress: from n/a through 1.8.1.
CVE-2026-119504 2 Dynamiapps, Wordpress-extensions 2 Frontend Admin By Dynamiapps, Frontend Admin By Dynamiapps 2026-11-09 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DynamiApps Frontend Admin by DynamiApps acf-frontend-form-element allows Stored XSS.This issue affects Frontend Admin by DynamiApps: from n/a through 3.30.1.
CVE-2026-119483 2 10web, Wordpress-extensions 2 Form Maker By 10web, Form Maker By 10web 2026-11-09 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Maker by 10Web form-maker allows Stored XSS.This issue affects Form Maker by 10Web: from n/a through 1.15.50.
CVE-2026-54863 2 Mamunur Rashid, Wordpress-extensions 2 Review Schema, Review Schema 2026-11-09 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mamunur Rashid Review Schema review-schema allows Reflected XSS.This issue affects Review Schema: from n/a through 3.1.4.
CVE-2026-123475 2 Pt Norther Lights Production, Wordpress-extensions 2 Mapsvg, Mapsvg 2026-11-09 7.5 High
Missing Authorization vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MapSVG: from n/a through 8.16.3.
CVE-2026-122661 2 Wordpress-extensions, Wpwax 2 Directorist, Directorist 2026-11-09 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Directorist directorist allows Stored XSS.This issue affects Directorist: from n/a through 8.10.7.
CVE-2026-123460 2 Nickboss, Wordpress-extensions 2 Wordpress File Upload, Wordpress File Upload 2026-11-09 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nickboss WordPress File Upload wp-file-upload allows Stored XSS.This issue affects WordPress File Upload: from n/a through 5.2.2.
CVE-2026-119497 2 Wordpress-extensions, Wpwax 2 Directorist, Directorist 2026-11-09 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Directorist directorist allows Stored XSS.This issue affects Directorist: from n/a through 8.10.6.
CVE-2026-97194 1 Wordpress-extensions 1 Secure Custom Fields 2026-11-08 2.7 Low
The Secure Custom Fields WordPress plugin before 6.9.8 does not perform a read-permission check when it renders and formats the values of its relational fields, allowing users with post-editing access (Contributor and above) to disclose the titles and non-public statuses of other users' unpublished posts.
CVE-2026-96963 1 Wordpress-extensions 1 Pie Register 2026-11-08 2.7 Low
The Pie Register WordPress plugin through 3.8.4.15 does not perform an authorisation check in one of its AJAX actions, allowing users with a role as low as contributor to modify existing administrator-created invitation-code records.
CVE-2026-122060 1 Wordpress-extensions 1 Wp Recipe Maker 2026-11-08 5.3 Medium
The WP Recipe Maker WordPress plugin before 10.9.2 does not check whether the post a recipe is embedded in is password protected before returning the recipe through its REST API and structured data output, allowing unauthenticated users to read the full content of recipes in password-protected posts.
CVE-2026-97195 1 Wordpress-extensions 1 Secure Custom Fields 2026-11-08 3.5 Low
The Secure Custom Fields WordPress plugin before 6.9.8 does not sanitize a persisted field definition before emitting part of it as an HTML attribute name, allowing a user able to configure its fields to store a payload that executes as JavaScript in the browser of any user who views a page rendering the affected field, which on multisite lets a site administrator who lacks the unfiltered_html capability inject script into other users' sessions.