Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (15341 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-16575 2 Dokan, Wordpress 2 Ai Powered Woocommerce Multivendor Marketplace Solution:dokan: Ai Powered Woocommerce Multivendor Marketplace Solution, Wordpress 2026-08-21 N/A
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not restrict access to per-vendor commission configuration returned by one of its unauthenticated store REST endpoints, allowing any unauthenticated user to disclose a vendor's commission type and, when category-based commission is configured, the per-category and default commission rates.
CVE-2026-16577 2 Dokan, Wordpress 2 Ai Powered Woocommerce Multivendor Marketplace Solution:dokan: Ai Powered Woocommerce Multivendor Marketplace Solution, Wordpress 2026-08-21 N/A
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not validate a client-supplied payment amount against the vendor's actual outstanding balance when recording a reverse-withdrawal payment, allowing a vendor to credit their reverse-withdrawal ledger with an arbitrary amount and clear their real commission debt without paying.
CVE-2026-16576 2 Dokan, Wordpress 2 Ai Powered Woocommerce Multivendor Marketplace Solution:dokan: Ai Powered Woocommerce Multivendor Marketplace Solution, Wordpress 2026-08-21 N/A
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not correctly check user capabilities on some of its admin REST API routes, checking only for a WooCommerce management capability instead of the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14-installation capability, allowing users such as Shop Managers to install and activate arbitrary Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 from WordPress.org.
CVE-2026-18409 2 Wordpress, Wpforms 2 Wordpress, Wpforms Pro 2026-08-21 7.2 High
The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values in all versions up to, and including, 2.0.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit relies on the plugin's own wp_kses_allowed_html filter widening the 'post' allowlist to permit iframe elements with a data-src attribute, which is not on WordPress's URI-attribute sanitization list, allowing a javascript: URI stored in data-src to survive kses processing and subsequently be promoted to a live src attribute by the bundled admin script view-entry.min.js.
CVE-2026-61986 2 Wasiliy Strecker, Wordpress 2 Contest Gallery, Wordpress 2026-08-20 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.5 versions.
CVE-2026-74012 2 Steve Burge, Wordpress 2 Taxopress, Wordpress 2026-08-20 8.8 High
Deserialization of Untrusted Data vulnerability in TaxoPress allows Object Injection. This issue affects TaxoPress: from n/a through 3.51.0.
CVE-2026-74011 2 Revmakx, Wordpress 2 Infinitewp Client, Wordpress 2026-08-20 7.6 High
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in revmakx InfiniteWP Client allows Blind SQL Injection. This issue affects InfiniteWP Client: from n/a through 1.13.9.
CVE-2026-73993 2 Roxnor, Wordpress 2 Fundengine, Wordpress 2026-08-20 9.8 Critical
Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.
CVE-2026-73992 2 Jonathan Daggerhart, Wordpress 2 Query Wrangler, Wordpress 2026-08-20 9.9 Critical
Subscriber Remote Code Execution (RCE) in Query Wrangler <= 1.5.57 versions.
CVE-2026-68566 2 Repute Infosystems, Wordpress 2 Bookingpress Appointment Booking Pro, Wordpress 2026-08-20 9.3 Critical
Unauthenticated SQL Injection in BookingPress Appointment Booking Pro <= 6.0.2 versions.
CVE-2026-66682 2 Tychesoftwares, Wordpress 2 Abandoned Cart Pro For Woocommerce, Wordpress 2026-08-20 9.8 Critical
Unauthenticated Privilege Escalation in Abandoned Cart Pro for WooCommerce <= 10.4.0 versions.
CVE-2026-66649 2 E-plugins, Wordpress 2 Directory Pro, Wordpress 2026-08-20 9.3 Critical
Unauthenticated SQL Injection in Directory Pro <= 2.5.8 versions.
CVE-2026-66615 2 Eric Teubert, Wordpress 2 Podlove Podcast Publisher, Wordpress 2026-08-20 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Podlove Podcast Publisher <= 4.5.4 versions.
CVE-2026-66600 2 Davidlingren, Wordpress 2 Media Library Assistant, Wordpress 2026-08-20 9.1 Critical
Author Arbitrary File Upload in Media LIbrary Assistant <= 3.39 versions.
CVE-2026-66597 2 Melograno Venture Studio, Wordpress 2 Wpdatatables, Wordpress 2026-08-20 7.1 High
Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 6.5.1.4 versions.
CVE-2026-66582 2 Cozmoslabs, Wordpress 2 Translatepress, Wordpress 2026-08-20 7.1 High
Unauthenticated Cross Site Scripting (XSS) in TranslatePress <= 3.3.2 versions.
CVE-2026-28150 2 Uxper, Wordpress 2 Golo Framework, Wordpress 2026-08-20 8.1 High
Unauthenticated Local File Inclusion in Golo Framework < 1.7.5 versions.
CVE-2025-15688 2 Themegoods, Wordpress 2 Capella, Wordpress 2026-08-20 9.3 Critical
Unauthenticated SQL Injection in Capella <= 2.5.5 versions.
CVE-2026-73347 2 Themetechmount, Wordpress 2 Truebooker, Wordpress 2026-08-20 9.8 Critical
Unauthenticated Privilege Escalation in TrueBooker <= 1.2.6 versions.
CVE-2026-73185 2 Wordpress, Wpo-hr 2 Wordpress, Ngg Smart Image Search 2026-08-20 9.3 Critical
Unauthenticated SQL Injection in NGG Smart Image Search < 4.0.0 versions.