Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (11922 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2025-14973 1 Wordpress 1 Wordpress 2026-01-27 6.8 Medium
The Recipe Card Blocks Lite WordPress plugin before 3.4.13 does not sanitize and escape a parameter before using it in a SQL statement, allowing contributors and above to perform SQL injection attacks.
CVE-2025-15516 2 Plugins360, Wordpress 2 All-in-one Video Gallery, Wordpress 2026-01-26 4.3 Medium
The All-in-One Video Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_callback_store_user_meta() function in versions 4.1.0 to 4.6.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary string-based user meta keys for their own account.
CVE-2019-25297 2 Opinionstage, Wordpress 2 Poll, Survey & Quiz Maker, Wordpress 2026-01-26 N/A
Poll, Survey & Quiz Maker Plugin by Opinion Stage Wordpress plugin versions prior to 19.6.25 contain a stored cross-site scripting (XSS) vulnerability via multiple parameters due to insufficient input validation and output escaping. An unauthenticated attacker can inject arbitrary script into content that executes when a victim views an affected page.
CVE-2023-47762 2 Wordpress, Wpdeveloper 2 Wordpress, Betterdocs 2026-01-23 4.3 Medium
Missing Authorization vulnerability in WPDeveloper BetterDocs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BetterDocs: from n/a through 2.5.2.
CVE-2022-46838 2 Joomsky, Wordpress 2 Js Help Desk, Wordpress 2026-01-23 9.1 Critical
Missing Authorization vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.1.
CVE-2022-46840 2 Joomsky, Wordpress 2 Js Help Desk, Wordpress 2026-01-23 5.4 Medium
Missing Authorization vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.1.
CVE-2023-45104 2 Wordpress, Wpdeveloper 2 Wordpress, Betterlinks 2026-01-23 7.3 High
Missing Authorization vulnerability in WPDeveloper BetterLinks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BetterLinks: from n/a through 1.6.0.
CVE-2023-47179 2 Byconsole, Wordpress 2 Wooodt Lite, Wordpress 2026-01-23 8.8 High
Missing Authorization vulnerability in ByConsole WooODT Lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooODT Lite: from n/a through 2.4.6.
CVE-2024-43227 2 Wordpress, Wpdeveloper 2 Wordpress, Betterdocs 2026-01-23 6.5 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPDeveloper BetterDocs allows Stored XSS.This issue affects BetterDocs: from n/a through 3.5.8.
CVE-2022-47151 2 Joomsky, Wordpress 2 Js Help Desk, Wordpress 2026-01-23 8.6 High
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.1.
CVE-2023-25444 2 Joomsky, Wordpress 2 Js Help Desk, Wordpress 2026-01-23 9.1 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin allows Using Malicious Files.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.7.
CVE-2023-47788 2 Automattic, Wordpress 2 Jetpack, Wordpress 2026-01-23 4.3 Medium
Missing Authorization vulnerability in Automattic Jetpack.This issue affects Jetpack: from n/a before 12.7.
CVE-2024-43161 2 Averta, Wordpress 2 Depicter Slider, Wordpress 2026-01-23 5.9 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Averta Depicter Slider allows Stored XSS.This issue affects Depicter Slider: from n/a through 3.1.2.
CVE-2023-47774 2 Automattic, Wordpress 2 Jetpack, Wordpress 2026-01-22 5.4 Medium
Improper Restriction of Rendered UI Layers or Frames vulnerability in Automattic Jetpack allows Clickjacking.This issue affects Jetpack: from n/a before 12.7.
CVE-2023-39309 2 Avada, Wordpress 2 Fusion Builder, Wordpress 2026-01-21 8.5 High
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ThemeFusion Fusion Builder.This issue affects Fusion Builder: from n/a through 3.11.1.
CVE-2023-25701 2 Watchtowerhq, Wordpress 2 Watchtower, Wordpress 2026-01-21 9.8 Critical
Improper Privilege Management vulnerability in WhatArmy WatchTowerHQ allows Privilege Escalation.This issue affects WatchTowerHQ: from n/a through 3.6.16.
CVE-2025-8944 2 Oceanwp, Wordpress 3 Oceanwp, Oceanwp Plugin, Wordpress 2026-01-20 4.3 Medium
The OceanWP WordPress theme before 4.1.2 is vulnerable to an option update due to a missing capability check on one of its AJAX request handler, allowing any authenticated users, such as subscriber to update the darkMod` setting.
CVE-2011-10041 1 Wordpress 1 Wordpress 2026-01-20 N/A
Uploadify WordPress plugin versions up to and including 1.0 contain an arbitrary file upload vulnerability in process_upload.php due to missing file type validation. An unauthenticated remote attacker can upload arbitrary files to the affected WordPress site, which may allow remote code execution by uploading executable content to a web-accessible location.
CVE-2025-68562 2 Romancode, Wordpress 2 Mapsvg, Wordpress 2026-01-20 9.9 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in RomanCode MapSVG allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through 8.7.3.
CVE-2025-64254 1 Wordpress 1 Wordpress 2026-01-20 8.8 High
Missing Authorization vulnerability in Ronald Huereca Photo Block photo-block allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Photo Block: from n/a through <= 1.5.1.