Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (16160 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-18109 2 Boldgrid, Wordpress 2 W3 Total Cache, Wordpress 2026-08-14 7.2 High
The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 2.10.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the Lazy Load Images feature of W3 Total Cache is enabled, as the unsafe re-emission occurs exclusively within the LazyLoad mutator's img tag rewriting step.
CVE-2026-65480 2 Codexthemes, Wordpress 2 Thegem, Wordpress 2026-08-14 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem allows DOM-Based XSS. This issue affects TheGem: from n/a before 5.12.1.1.
CVE-2026-73532 2 Wordpress, Wpmanageninja 2 Wordpress, Fluent Forms 2026-08-14 9.8 Critical
Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file (libs/class-license-sync.php), loaded via a require_once directive added to fluentformpro.php, that established a backdoor REST API endpoint, dropped persistent PHP files in mu-plugins and uploads directories, installed a passwordless administrator account, and registered scheduled tasks that survived plugin removal.
CVE-2026-28003 2 Wordpress, Yonifre 2 Wordpress, Maspik – Spam Blacklist 2026-08-14 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Maspik – Spam blacklist <= 2.9.1 versions.
CVE-2026-28155 2 Lasso Analytics, Inc., Wordpress 2 Do Lasso, Wordpress 2026-08-14 6.5 Medium
Unauthenticated Insecure Direct Object References (IDOR) in Do Lasso <= 358 versions.
CVE-2026-28156 2 Lasso Analytics, Inc., Wordpress 2 Do Lasso, Wordpress 2026-08-14 8.5 High
Subscriber SQL Injection in Do Lasso <= 358 versions.
CVE-2026-28157 2 Lasso Analytics, Inc., Wordpress 2 Do Lasso, Wordpress 2026-08-14 7.5 High
Subscriber Path Traversal in Do Lasso <= 358 versions.
CVE-2026-28158 2 Lasso Analytics, Inc., Wordpress 2 Do Lasso, Wordpress 2026-08-14 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Do Lasso <= 358 versions.
CVE-2026-28159 2 Aonetheme, Wordpress 2 Service Finder Booking, Wordpress 2026-08-14 6.5 Medium
Subscriber Broken Access Control in Service Finder Booking <= 6.2 versions.
CVE-2026-28161 2 Aonetheme, Wordpress 2 Service Finder Booking, Wordpress 2026-08-14 8.8 High
Subscriber Privilege Escalation in Service Finder Booking <= 6.2 versions.
CVE-2026-28168 2 Imran Tauqeer, Wordpress 2 Cubewp, Wordpress 2026-08-14 8.5 High
Subscriber SQL Injection in CubeWP <= 1.1.30 versions.
CVE-2026-28185 2 Rtcamp, Wordpress 2 Log In With Google, Wordpress 2026-08-14 9.8 Critical
Unauthenticated Broken Authentication in Log in with Google <= 1.4.2 versions.
CVE-2026-28186 2 Themefic, Wordpress 2 Travelfic Toolkit, Wordpress 2026-08-14 8.1 High
Subscriber Broken Access Control in Travelfic Toolkit <= 1.5.1 versions.
CVE-2026-61978 2 Webhosting4ugr, Wordpress 2 Secure Card Gateway For Epay Paycenter (piraeus Bank), Wordpress 2026-08-14 6.5 Medium
Unauthenticated Broken Access Control in Secure Card Gateway for ePay Paycenter (Piraeus Bank) <= 1.0.32 versions.
CVE-2026-65580 2 Bracketweb, Wordpress 2 Agrion, Wordpress 2026-08-14 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Agrion <= 1.0.0 versions.
CVE-2026-66431 2 Woompaloompa, Wordpress 2 Bitcoin Lightning Payment Gateway For Woocommerce (via Clink), Wordpress 2026-08-14 7.5 High
Unauthenticated Broken Access Control in Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) <= 1.0.7 versions.
CVE-2026-66446 2 If-so Dynamic Content, Wordpress 2 If-so Dynamic Content Personalization, Wordpress 2026-08-14 9.3 Critical
Subscriber SQL Injection in If-So Dynamic Content Personalization <= 1.10 versions.
CVE-2026-66455 2 Rockiger, Wordpress 2 Reactpress, Wordpress 2026-08-14 6 Medium
Subscriber Broken Access Control in ReactPress <= 3.4.0 versions.
CVE-2026-66459 2 Space Codes, Wordpress 2 Ai For Seo, Wordpress 2026-08-14 6.5 Medium
Unauthenticated Broken Access Control in AI for SEO <= 2.4.2 versions.
CVE-2026-66462 2 Bookingwp, Wordpress 2 Woocommerce Appointments, Wordpress 2026-08-14 7.5 High
Unauthenticated Sensitive Data Exposure in WooCommerce Appointments <= 5.3.8 versions.