Export limit exceeded: 387037 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 48834 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 15796 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (15796 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-66651 2 Multivendorx, Wordpress 2 Multivendorx, Wordpress 2026-08-18 6.5 Medium
Unauthenticated Broken Access Control in MultiVendorX <= 5.0.14 versions.
CVE-2026-73355 2 Wordpress, Wp.insider 2 Wordpress, Affiliates Manager 2026-08-18 9.3 Critical
Unauthenticated SQL Injection in Affiliates Manager <= 2.9.53 versions.
CVE-2026-73348 2 Nexcess, Wordpress 2 Givewp, Wordpress 2026-08-18 6.5 Medium
Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.
CVE-2026-73351 2 Miniorange, Wordpress 2 Wordpress Social Login And Register, Wordpress 2026-08-18 7.1 High
Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.1 versions.
CVE-2026-73356 2 Cloudways, Wordpress 2 Breeze, Wordpress 2026-08-18 8.2 High
Unauthenticated Arbitrary Content Deletion in Breeze <= 2.5.12 versions.
CVE-2026-73361 2 Wordpress, Wpzoom 2 Wordpress, Recipe Card Blocks For Gutenberg & Elementor 2026-08-18 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Recipe Card Blocks for Gutenberg & Elementor <= 3.4.18 versions.
CVE-2026-73362 2 Kaizencoders, Wordpress 2 Url Shortify, Wordpress 2026-08-18 7.1 High
Unauthenticated Cross Site Scripting (XSS) in URL Shortify <= 2.5.0 versions.
CVE-2026-73393 2 Wedevs, Wordpress 2 Subscribe2, Wordpress 2026-08-18 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Subscribe2 <= 10.46 versions.
CVE-2026-73400 2 Jetmonsters, Wordpress 2 Restaurant Menu By Motopress, Wordpress 2026-08-18 8.1 High
Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress <= 2.4.11 versions.
CVE-2026-66637 2 Alex, Wordpress 2 Featured Video Plus, Wordpress 2026-08-18 6.5 Medium
Contributor Cross Site Scripting (XSS) in Featured Video Plus <= 2.3.3 versions.
CVE-2026-66629 2 Themeum, Wordpress 2 Kirki, Wordpress 2026-08-18 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Kirki <= 6.2.3 versions.
CVE-2026-32553 2 Brainstorm Force, Wordpress 2 Ottokit, Wordpress 2026-08-18 7.2 High
Unauthenticated Server Side Request Forgery (SSRF) in OttoKit <= 1.1.35 versions.
CVE-2026-15748 2 Wordpress, Wpmudev 2 Wordpress, Forminator Forms – Contact Form, Payment Form & Custom Form Builder 2026-08-18 9.8 Critical
The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handle_file_upload function. This is due to insufficient file type validation in handle_file_upload, where the dangerous-extension blocklist performs exact-key matching that is bypassed by pipe-alternative MIME type keys, combined with a public submission handler that trusts attacker-controlled upload field configuration injected via a forged Select field value. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
CVE-2026-68565 2 Paolo, Wordpress 2 Geodirectory, Wordpress 2026-08-18 6.5 Medium
Contributor Cross Site Scripting (XSS) in GeoDirectory <= 2.8.172 versions.
CVE-2026-32465 2 G5theme, Wordpress 2 Essential Real Estate, Wordpress 2026-08-18 8.8 High
Customer PHP Object Injection in Essential Real Estate <= 5.3.3 versions.
CVE-2026-32481 2 Ezoic, Wordpress 2 Ezoic, Wordpress 2026-08-18 7.5 High
Unauthenticated Broken Authentication in Ezoic <= 2.22.11 versions.
CVE-2026-32549 2 Codexpert, Wordpress 2 Thumbpress, Wordpress 2026-08-18 7.5 High
Unauthenticated Broken Access Control in ThumbPress < 6.5 versions.
CVE-2026-28571 2 Wordpress, Wppool 2 Wordpress, Formychat 2026-08-18 7.5 High
Unauthenticated Broken Access Control in FormyChat <= 2.15.7 versions.
CVE-2026-15384 2 Manual Image Crop Project, Wordpress 2 Manual Image Crop, Wordpress 2026-08-18 5.7 Medium
The Manual Image Crop WordPress plugin before 1.15 does not perform any capability check or nonce verification on the authenticated AJAX action that crops attachment images; its only guard passes for any logged-in user. A subscriber-level user can therefore supply an arbitrary attachment ID and overwrite that attachment's generated intermediate-size image (for example its thumbnail) and mutate its stored metadata, regardless of who owns the media. This is a cross-user integrity/defacement issue over the Media Library. The action also has no nonce, so it is additionally susceptible to CSRF.
CVE-2026-6229 2 Wordpress, Wproyal 2 Wordpress, Royal Addons For Elementor – Addons And Templates Kit For Elementor 2026-08-17 7.2 High
The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1057. This is due to insufficient validation of user-supplied URLs in the render_csv_data() function, which can be bypassed by including 'docs.google.com/spreadsheets' in a query parameter, and the subsequent use of these URLs in fopen() calls without blocking internal or private network addresses. This makes it possible for authenticated attackers, with Contributor-level access and above, to make requests to arbitrary URLs and retrieve sensitive information from internal services.