Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (16306 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-12561 2 Tagdiv, Wordpress 2 Tagdiv Composer, Wordpress 2026-08-25 6.4 Medium
The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the vc_raw_html shortcode in all versions up to and including 5.4.5. This is due to insufficient input sanitization and output escaping in the vc_raw_html::render() method, which base64-decodes shortcode content (after a strip_tags() that is bypassed because the encoded payload contains no tags on save) and concatenates the result directly into the page HTML. Because WordPress's save-time wp_kses_post() filter only sees the inert base64 text inside a normal shortcode bracket and does not decode it, the dangerous tags survive into post_content and are emitted unescaped at render time. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page (for example, when an Editor or Administrator previews the pending post).
CVE-2026-66641 2 Deepen Bajracharya, Wordpress 2 Video Conferencing With Zoom, Wordpress 2026-08-24 6.5 Medium
Contributor Cross Site Scripting (XSS) in Video Conferencing with Zoom <= 4.6.8 versions.
CVE-2026-66667 2 Wordpress, Wpdeveloper 2 Wordpress, Templately 2026-08-24 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Templately <= 3.7.1 versions.
CVE-2026-73345 2 Saad Iqbal, Wordpress 2 License Manager For Woocommerce, Wordpress 2026-08-24 7.1 High
Customer SQL Injection in License Manager for WooCommerce <= 3.0.18 versions.
CVE-2026-73365 2 Crocoblock. Jetimpex Inc., Wordpress 2 Jetappointment, Wordpress 2026-08-24 9.3 Critical
Unauthenticated SQL Injection in JetAppointment <= 2.5.2 versions.
CVE-2026-73380 2 Supsysticcom, Wordpress 2 Popup By Supsystic, Wordpress 2026-08-24 9.8 Critical
Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions.
CVE-2026-73381 2 Supsysticcom, Wordpress 2 Popup By Supsystic, Wordpress 2026-08-24 9.1 Critical
Unauthenticated Broken Authentication in Popup by Supsystic <= 1.13.0 versions.
CVE-2026-66599 2 Liquid Web / Stellarwp, Wordpress 2 Wpcomplete, Wordpress 2026-08-24 7.1 High
Unauthenticated Cross Site Scripting (XSS) in WPComplete <= 2.9.5.6 versions.
CVE-2026-66671 2 Elated-themes, Wordpress 2 Verdure Core, Wordpress 2026-08-24 8.1 High
Unauthenticated Local File Inclusion in Verdure Core <= 1.2 versions.
CVE-2026-28153 2 Notification Master, Wordpress 2 Notification Master – Real-time Wordpress Notifications With Email, Sms, Webhooks & More, Wordpress 2026-08-24 7.5 High
Unauthenticated Broken Access Control in Notification Master &#8211; Real-Time WordPress Notifications With Email, SMS, Webhooks &amp; More <= 1.7.1 versions.
CVE-2026-28171 2 Vanquish, Wordpress 2 Woocommerce File Approval, Wordpress 2026-08-24 8.6 High
Unauthenticated Arbitrary File Deletion in WooCommerce File Approval <= 10.7 versions.
CVE-2026-28190 2 Themebing, Wordpress 2 Prolancer Element, Wordpress 2026-08-24 7.1 High
Subscriber Broken Access Control in ProLancer Element <= 1.4.8 versions.
CVE-2026-32471 2 Themebing, Wordpress 2 Prolancer Element, Wordpress 2026-08-24 8.5 High
Subscriber SQL Injection in ProLancer Element <= 1.4.8 versions.
CVE-2026-32476 2 Amplebyte Pvt Limited, Wordpress 2 Brave Conversion Engine (pro), Wordpress 2026-08-24 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Brave Conversion Engine (PRO) <= 0.8.6 versions.
CVE-2026-32558 2 Redefiningtheweb, Wordpress 2 Affiliate Pro - Affiliate Program For Woocommerce & Wordpress, Wordpress 2026-08-24 9.8 Critical
Unauthenticated Privilege Escalation in Affiliate Pro - Affiliate Program for WooCommerce & WordPress <= 8.9.1 versions.
CVE-2026-66585 2 Wordpress, Wpcafe 2 Wordpress, Wp Cafe Pro 2026-08-24 7.5 High
Unauthenticated Sensitive Data Exposure in WP Cafe Pro < 3.0.15 versions.
CVE-2026-66587 2 Wordpress, Wpcafe 2 Wordpress, Wp Cafe Pro 2026-08-24 9.8 Critical
Unauthenticated Local File Inclusion in WP Cafe Pro < 3.0.15 versions.
CVE-2026-66648 2 Mvpthemes, Wordpress 2 Jawn, Wordpress 2026-08-24 9.8 Critical
Unauthenticated Privilege Escalation in Jawn <= 1.4.2 versions.
CVE-2026-66670 2 Elated-themes, Wordpress 2 Måne, Wordpress 2026-08-24 8.1 High
Unauthenticated Local File Inclusion in Måne <= 1.7 versions.
CVE-2026-28192 2 Piotnet, Wordpress 2 Piotnet Addons For Elementor, Wordpress 2026-08-24 9.6 Critical
Unauthenticated Arbitrary File Upload in Piotnet Addons For Elementor Pro <= 7.1.67 versions.