Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (1228 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-62055 2 Liquid Web / Stellarwp, Wordpress-extensions 2 Event Tickets, Event Tickets 2026-10-30 4.3 Medium
Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.2.
CVE-2026-119482 2 Crocoblock, Wordpress-extensions 2 Jetformbuilder, Jetformbuilder 2026-10-30 5.3 Medium
Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder: from n/a through 3.6.7.1.
CVE-2026-114422 1 Wordpress-extensions 1 Enable Media Replace 2026-10-30 7.5 High
The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine, allowing unauthenticated users to inject a PHP object that is instantiated when a user with upload access performs a routine media replacement, resulting in PHP Object Injection and local file inclusion of existing PHP/HTML files, which can be escalated to remote code execution where an attacker-influenced PHP or HTML file is present on the server. This is a regression of CVE-2023-4643, which was fixed in 4.1.3 and reintroduced in 4.1.4.
CVE-2026-118087 2 Geminilabs, Wordpress-extensions 2 Site Reviews, Site Reviews 2026-10-30 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gemini Labs Site Reviews site-reviews allows Stored XSS.This issue affects Site Reviews: from n/a through 8.3.5.
CVE-2026-54862 2 Codection, Wordpress-extensions 2 Import And Export Users And Customers, Import And Export Users And Customers 2026-10-30 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codection Import and export users and customers import-users-from-csv-with-meta allows Stored XSS.This issue affects Import and export users and customers: from n/a through 2.5.9.
CVE-2026-109216 2 Metabox, Wordpress-extensions 2 Meta Box, Meta Box 2026-10-29 4.9 Medium
The Meta Box – A Framework for Dynamic Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'profile_background[<attacker-chosen key>]' parameter in all versions up to, and including, 5.15.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitability depends on a consuming plugin or theme built on Meta Box that exposes the background field to lower-privileged users and renders stored values via the rwmb_the_value()/format_single_value() pattern; the effective minimum privilege is whatever role that consumer permits, demonstrated at Subscriber level.
CVE-2026-39736 2 Crocoblock, Wordpress-extensions 2 Jetengine, Jetengine 2026-10-29 8.5 High
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows SQL Injection.This issue affects JetEngine: from n/a through 3.9.0.1.
CVE-2026-48884 2 Wedevs, Wordpress-extensions 2 Wp User Frontend, Wp User Frontend 2026-10-29 5.3 Medium
Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through 4.3.13.
CVE-2026-42690 2 Thimpress, Wordpress-extensions 2 Learnpress, Learnpress 2026-10-29 5.4 Medium
Subscriber Broken Access Control in LearnPress <= 4.4.10 versions.
CVE-2026-39737 2 Crocoblock, Wordpress-extensions 2 Jetelements For Elementor, Jetelements For Elementor 2026-10-29 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.6.
CVE-2026-118092 1 Wordpress-extensions 1 Masterstudy Lms 2026-10-29 4.3 Medium
Missing Authorization vulnerability in StylemixThemes MasterStudy LMS masterstudy-lms-learning-management-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MasterStudy LMS: from n/a through 3.7.55.
CVE-2026-52708 2 Wedevs, Wordpress-extensions 2 Wp User Frontend, Wp User Frontend 2026-10-29 4.3 Medium
Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through 4.3.13.
CVE-2026-110881 3 Brainstorm Force, Brainstormforce, Wordpress-extensions 3 Suredash, Suredash, Suredash 2026-10-29 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureDash suredash allows Stored XSS.This issue affects SureDash: from n/a through 1.12.3.
CVE-2026-115605 3 Brainstorm Force, Brainstormforce, Wordpress-extensions 3 Suredash, Suredash, Suredash 2026-10-29 4.3 Medium
Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.3.
CVE-2026-56056 2 Mamunur Rashid, Wordpress-extensions 2 The Post Grid, The Post Grid 2026-10-29 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mamunur Rashid The Post Grid the-post-grid allows Stored XSS.This issue affects The Post Grid: from n/a through 7.9.7.
CVE-2026-39735 2 Crocoblock, Wordpress-extensions 2 Jetengine, Jetengine 2026-10-29 6.5 Medium
Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetEngine: from n/a through 3.9.0.1.
CVE-2026-118094 2 Igorfuna, Wordpress-extensions 2 Ad Inserter, Ad Inserter 2026-10-29 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Stored XSS.This issue affects Ad Inserter: from n/a through 2.8.18.
CVE-2026-116863 2 Tribulant, Wordpress-extensions 2 Newsletters, Newsletters 2026-10-29 9.6 Critical
Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Software Newsletters newsletters-lite allows Cross Site Request Forgery.This issue affects Newsletters: from n/a through 4.18.2.
CVE-2026-116404 2 Davidanderson, Wordpress-extensions 2 Redux Framework, Redux Framework 2026-10-29 6.5 Medium
Missing Authorization vulnerability in David Anderson Redux Framework redux-framework allows Lifting Sensitive Data Embedded in Cache.This issue affects Redux Framework: from n/a through 4.5.16.
CVE-2026-115603 2 Advanced Ads Gmbh, Wordpress-extensions 2 Advanced Ads – Tracking, Advanced Ads – Tracking 2026-10-29 8.5 High
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Advanced Ads GmbH Advanced Ads – Tracking advanced-ads-tracking allows Blind SQL Injection.This issue affects Advanced Ads – Tracking: from n/a before 4.0.0.