Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (48152 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2026-5158 2 Wordpress, Wpxpo 2 Wordpress, Postx - Gutenberg Blocks For Post Grid 2026-08-07 6.4 Medium
The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'inputPlaceHolder' parameter in all versions up to, and including, 5.0.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2026-61963 2 Davidlingren, Wordpress 2 Media Library Assistant, Wordpress 2026-08-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.38 versions.
CVE-2026-66706 2 Markjaquith, Wordpress 2 Subscribe To Comments, Wordpress 2026-08-06 5.9 Medium
Author Cross Site Scripting (XSS) in Subscribe to Comments <= 2.3.1 versions.
CVE-2026-66663 2 Passionate Programmer Peter, Wordpress 2 Wp Data Access, Wordpress 2026-08-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions.
CVE-2026-66690 2 Nexcess, Wordpress 2 Givewp, Wordpress 2026-08-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.5 versions.
CVE-2026-66711 2026-08-06 7.1 High
Subscriber Cross Site Scripting (XSS) in WooCommerce Multilingual & Multicurrency <= 5.5.6 versions.
CVE-2026-18501 2 Stiofansisland, Wordpress 2 Userswp – Front-end Login Form, User Registration, User Profile & Members Directory Plugin For Wp, Wordpress 2026-08-06 6.4 Medium
The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Badge Widget Variable Substitution in all versions up to, and including, 1.2.69 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2026-18325 2 Wordpress, Wpmudev 2 Wordpress, Forminator Forms – Contact Form, Payment Form & Custom Form Builder 2026-08-06 7.2 High
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Forged Upload Record via Select Field in all versions up to, and including, 1.56.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is possible because Forminator_Core::sanitize_array() skips all filtering for keys prefixed with 'select-', and set_field_data() treats a submitted 'return' member as a trusted internal flag — allowing an unauthenticated attacker to forge and persist a complete upload field record with an arbitrary file_url value without any sanitization or validation.
CVE-2026-66440 2 Wordpress, Xplodedthemes 2 Wordpress, Wpide - File Manager & Code Editor 2026-08-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in WPIDE – File Manager & Code Editor <= 3.5.7 versions.
CVE-2026-28143 2026-08-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.56.0 versions.
CVE-2025-63823 2026-08-06 9.8 Critical
My Safetipin Android Application 5.2.1 contains Hardcoded credentials in the authentication module, which allows remote attackers to bypass authentication and gain unauthorized access to user accounts via predictable OTP values.
CVE-2026-61961 2 Wordpress, Wpdeveloper 2 Wordpress, Embedpress 2026-08-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in EmbedPress <= 4.5.6 versions.
CVE-2026-28178 2 Codesupplyco, Wordpress 2 Powerkit, Wordpress 2026-08-06 6.5 Medium
Contributor Cross Site Scripting (XSS) in Powerkit <= 3.1.0 versions.
CVE-2026-61982 2 Jp-secure, Wordpress 2 Siteguard Wp Plugin, Wordpress 2026-08-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in SiteGuard WP Plugin <= 1.8.6 versions.
CVE-2026-65509 2 Wordpress, Wpdatatables 2 Wordpress, Wpdatatables 2026-08-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 7.5.1 versions.
CVE-2026-66439 2 Berocket, Wordpress 2 Advanced Ajax Product Filters, Wordpress 2026-08-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Advanced AJAX Product Filters <= 3.2.0.3 versions.
CVE-2026-65545 2 Jordy Meow, Wordpress 2 Ai-engine, Wordpress 2026-08-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in AI Engine <= 3.6.8 versions.
CVE-2026-65560 2026-08-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Houzez Property Feed <= 2.5.48 versions.
CVE-2026-66457 2026-08-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Events Manager <= 7.4.1 versions.
CVE-2026-66688 2 Brainstormforce, Wordpress 2 Ultimate Addons For Elementor, Wordpress 2026-08-06 6.5 Medium
Contributor Cross Site Scripting (XSS) in Ultimate Addons for Elementor <= 1.45.2 versions.