Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (1770 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-123751 1 Wordpress-extensions 1 Wp Duplicate 2026-11-10 9.8 Critical
The WP Duplicate WordPress plugin through 1.1.11 does not properly verify a request authentication value and does not validate the path or type of uploaded files, making it possible for unauthenticated attackers to write arbitrary files to the server and achieve remote code execution. This vulnerability is being actively exploited in the wild.
CVE-2026-121760 2 Wedevs, Wordpress-extensions 2 Wedocs, Wedocs 2026-11-10 7.5 High
Missing Authorization vulnerability in weDevs weDocs wedocs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects weDocs: from n/a through 2.6.1.
CVE-2026-111403 2 Wordpress-extensions, Wpinventory 2 Wp Inventory Manager, Wp Inventory Manager 2026-11-10 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Inventory WP Inventory Manager wp-inventory-manager allows Reflected XSS.This issue affects WP Inventory Manager: from n/a through 2.5.9.
CVE-2026-121780 2 Gijo Varghese, Wordpress-extensions 2 Flying Images, Flying Images 2026-11-10 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gijo Varghese Flying Images nazy-load allows Stored XSS.This issue affects Flying Images: from n/a through 2.4.15.
CVE-2026-123465 2 Mycred, Wordpress-extensions 2 Mycred, Mycred 2026-11-10 7.5 High
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in myCred myCred mycred allows Retrieve Embedded Sensitive Data.This issue affects myCred: from n/a through 4.0.2.
CVE-2026-121764 2 Foliovision, Wordpress-extensions 2 Fv Flowplayer Video Player, Fv Flowplayer Video Player 2026-11-10 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Flowplayer Video Player fv-wordpress-flowplayer allows Stored XSS.This issue affects FV Flowplayer Video Player: from n/a through 7.5.56.7212.
CVE-2026-119514 2 Webful Creations, Wordpress-extensions 2 Repairbuddy, Repairbuddy 2026-11-10 6.3 Medium
Incorrect Privilege Assignment vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Privilege Escalation.This issue affects RepairBuddy: from n/a through 4.1234.
CVE-2026-106466 1 Wordpress-extensions 1 Jwt Auth 2026-11-10 7.5 High
The JWT Auth WordPress plugin through 3.0.2 does not invalidate previously issued refresh tokens when a user changes or resets their password or removes a connected device, allowing an attacker who obtained a refresh token before such an event to keep issuing valid access tokens and retain authenticated access to the account, up to Administrator.
CVE-2026-115252 1 Wordpress-extensions 1 Confection 2026-11-10 10 Critical
The Confection WordPress Cable WordPress plugin from 0.4.0 to 0.4.7 does not perform any capability or nonce checks before saving its settings and writing one of them, unmodified, into a standalone PHP file that it then serves, allowing unauthenticated users to execute arbitrary PHP code on the server.
CVE-2026-106008 1 Wordpress-extensions 1 Fraudlabs Pro Sms Verification 2026-11-10 5.3 Medium
The FraudLabs Pro SMS Verification WordPress plugin from 1.11.2 to 1.12.1 does not perform authorisation or validity checks before marking a WooCommerce order's SMS verification as completed, allowing unauthenticated users to forge the verified state of an order and bypass the plugin's SMS verification control.
CVE-2026-121570 2 Wordpress-extensions, Wpchill 2 Rsvp And Event Management, Rsvp And Event Management 2026-11-10 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill RSVP and Event Management rsvp allows Stored XSS.This issue affects RSVP and Event Management: from n/a through 2.7.17.
CVE-2026-120855 2 Templateinvaders, Wordpress-extensions 2 Ti Woocommerce Wishlist, Ti Woocommerce Wishlist 2026-11-10 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TemplateInvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Stored XSS.This issue affects TI WooCommerce Wishlist: from n/a through 2.14.0.
CVE-2026-119524 2 Aguilatechnologies, Wordpress-extensions 2 Wp Customer Area, Wp Customer Area 2026-11-10 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aguila Technologies WP Customer Area customer-area allows Stored XSS.This issue affects WP Customer Area: from n/a through 8.4.3.
CVE-2026-120856 2 Rymera Web Co, Wordpress-extensions 2 Invoice Gateway For Woocommerce – Invoice Payment Gateway, Invoice Gateway For Woocommerce – Invoice Payment Gateway 2026-11-10 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rymera Web Co Invoice Gateway for WooCommerce – Invoice Payment Gateway invoice-gateway-for-woocommerce allows Reflected XSS.This issue affects Invoice Gateway for WooCommerce – Invoice Payment Gateway: from n/a through 1.1.6.
CVE-2026-120854 2 Iubenda, Wordpress-extensions 2 Iubenda, Iubenda 2026-11-10 7.5 High
Allocation of Resources Without Limits or Throttling vulnerability in iubenda iubenda iubenda-cookie-law-solution allows HTTP DoS.This issue affects iubenda: from n/a through 3.13.6.
CVE-2026-122673 2 Wordpress-extensions, Wpmet 2 Shopengine, Shopengine 2026-11-10 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet ShopEngine shopengine allows Stored XSS.This issue affects ShopEngine: from n/a through 4.9.8.
CVE-2026-111833 2 Boldgrid, Wordpress-extensions 2 Weforms, Weforms 2026-11-10 7.5 High
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bold Grid weForms weforms allows Path Traversal.This issue affects weForms: from n/a through 1.6.28.
CVE-2026-112359 2 Amauri, Wordpress-extensions 2 Wpmobile.app, Wpmobile.app 2026-11-10 7.5 High
Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPMobile.App: from n/a through 11.86.
CVE-2026-115204 1 Wordpress-extensions 1 Azexo Store Locator 2026-11-09 8.8 High
The AZEXO Store Locator WordPress plugin through 1.4 does not perform capability or nonce checks on its AJAX actions and does not sanitise a request header used to build a file path, allowing any authenticated user such as a subscriber to write a file with an arbitrary name, location, and content, leading to remote code execution.
CVE-2026-123482 2 Crocoblock, Wordpress-extensions 2 Jetformbuilder, Jetformbuilder 2026-11-09 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Stored XSS.This issue affects JetFormBuilder: from n/a through 3.6.8.