Search

Expected end of text, found '/' (at char 47), (line:1, col:48)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (425712 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-54854 2 Cozmoslabs, Wordpress-extensions 2 Profile Builder, Profile Builder 2026-11-12 6.3 Medium
Contributor Privilege Escalation in Profile Builder <= 4.0.5 versions.
CVE-2026-54855 2 Cozmoslabs, Wordpress-extensions 2 Profile Builder, Profile Builder 2026-11-12 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Profile Builder <= 4.0.5 versions.
CVE-2026-78527 2 Gsplugins, Wordpress-extensions 2 Gs Testimonial Slider, Gs Testimonial Slider 2026-11-12 8.8 High
Contributor PHP Object Injection in GS Testimonial Slider <= 3.3.10 versions.
CVE-2026-90888 2 Leadsnap, Wordpress-extensions 2 Leadsnap, Leadsnap 2026-11-12 9.8 Critical
Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions.
CVE-2026-94175 2 Saad Iqbal, Wordpress-extensions 2 All In One Login, All In One Login 2026-11-12 7.1 High
Unauthenticated Cross Site Scripting (XSS) in All In One Login <= 2.4.1 versions.
CVE-2026-107868 2 Wordpress-extensions, Yithemes 2 Yith Woocommerce Product Add Ons, Yith Woocommerce Product Add-ons 2026-11-12 5.3 Medium
Unauthenticated Bypass Vulnerability in YITH WooCommerce Product Add-Ons <= 4.34.0 versions.
CVE-2026-115947 2 Realmag777, Wordpress-extensions 2 Husky, Husky 2026-11-12 6.5 Medium
Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions.
CVE-2026-116401 2 Realmag777, Wordpress-extensions 2 Husky, Husky 2026-11-12 7.5 High
Unauthenticated Broken Access Control in HUSKY <= 1.4.6 versions.
CVE-2026-116851 2 Implecode, Wordpress-extensions 2 Ecommerce Product Catalog, Ecommerce Product Catalog 2026-11-12 7.1 High
Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.6.5 versions.
CVE-2026-116852 2 Marketingfire, Wordpress-extensions 2 Widget-options, Widget Options 2026-11-12 9.1 Critical
Author Remote Code Execution (RCE) in Widget Options <= 4.2.5 versions.
CVE-2026-116854 2 Aguilatechnologies, Wordpress-extensions 2 Wp Customer Area, Wp Customer Area 2026-11-12 6.5 Medium
Subscriber Cross Site Scripting (XSS) in WP Customer Area <= 8.4.0 versions.
CVE-2026-116861 2 Wordpress-extensions, Wpdesk 2 Flexible Chat, Flexible Chat 2026-11-12 7.5 High
Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 versions.
CVE-2026-116862 2 Acato, Wordpress-extensions 2 Wp Rest Cache, Wp Rest Cache 2026-11-12 7.5 High
Unauthenticated Broken Access Control in WP REST Cache <= 2026.3.1 versions.
CVE-2026-118086 2 Hakan Ozevin, Wordpress-extensions 2 Wp Base Booking, Wp Base Booking 2026-11-12 8.8 High
Subscriber Privilege Escalation in WP BASE Booking <= 6.5.2 versions.
CVE-2026-118089 2 Rextheme, Wordpress-extensions 2 Product Feed Manager, Product Feed Manager 2026-11-12 7.2 High
Shop manager PHP Object Injection in Product Feed Manager <= 7.14.1 versions.
CVE-2026-109234 2 Tigroumeow, Wordpress-extensions 2 Meow Lightbox, Meow Lightbox 2026-11-12 7.2 High
The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (bbPress reply body)' parameter in all versions up to, and including, 5.6.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the administrator to have enabled Output Buffering, the HtmlDomParser engine, and Aggressive Resolve, as well as a stored-HTML submission surface (such as bbPress anonymous replies) whose kses allow-list preserves img attributes; given these preconditions, a one-shot unauthenticated submission can execute arbitrary JavaScript in the context of any user who views the affected page.
CVE-2026-118043 1 Wordpress-extensions 1 Bulk Media Register 2026-11-12 7.2 High
The Bulk Media Register WordPress plugin before 2.01 does not properly validate a user-supplied path before moving a file on the server, allowing users with the Author role to move or rename arbitrary files, including outside the WordPress root, which can defeat directory-level access controls and disclose protected files.
CVE-2026-118185 1 Wordpress-extensions 1 Security Optimizer 2026-11-12 7.5 High
The Security Optimizer WordPress plugin before 1.6.9 does not limit the number of two-factor authentication codes that can be submitted for a pending login, allowing an attacker who already knows a user's password to brute force the second factor and take over the account.
CVE-2026-118437 1 Wordpress-extensions 1 Buddyforms 2026-11-12 3.7 Low
The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before deleting guest-uploaded attachments, allowing unauthenticated attackers to permanently delete media files uploaded by other unauthenticated visitors.
CVE-2026-118438 1 Wordpress-extensions 1 Firelight Lightbox 2026-11-12 6.8 Medium
The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before processing them in the browser, which could allow users with contributor-level access and above to inject arbitrary web scripts that execute when another user views or previews the affected content.