Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (1046 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-118082 2 Buddyboss, Wordpress-extensions 2 Buddyboss Platform, Buddyboss Platform 2026-10-29 8.8 High
Subscriber Privilege Escalation in Buddyboss Platform <= 3.5.0 versions.
CVE-2026-118084 2 Nicdark, Wordpress-extensions 2 Hotel Booking, Hotel Booking 2026-10-29 6.5 Medium
Subscriber Insecure Direct Object References (IDOR) in Hotel Booking <= 3.8 versions.
CVE-2026-39737 2 Crocoblock, Wordpress-extensions 2 Jetelements For Elementor, Jetelements For Elementor 2026-10-29 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.6.
CVE-2026-118092 1 Wordpress-extensions 1 Masterstudy Lms 2026-10-29 4.3 Medium
Missing Authorization vulnerability in StylemixThemes MasterStudy LMS masterstudy-lms-learning-management-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MasterStudy LMS: from n/a through 3.7.55.
CVE-2026-42694 2 Themeum, Wordpress-extensions 2 Kirki, Kirki 2026-10-29 4.3 Medium
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Themeum Kirki kirki allows Code Injection.This issue affects Kirki: from n/a through 6.4.0.
CVE-2026-52708 2 Wedevs, Wordpress-extensions 2 Wp User Frontend, Wp User Frontend 2026-10-29 4.3 Medium
Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through 4.3.13.
CVE-2026-110881 3 Brainstorm Force, Brainstormforce, Wordpress-extensions 3 Suredash, Suredash, Suredash 2026-10-29 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureDash suredash allows Stored XSS.This issue affects SureDash: from n/a through 1.12.3.
CVE-2026-115605 3 Brainstorm Force, Brainstormforce, Wordpress-extensions 3 Suredash, Suredash, Suredash 2026-10-29 4.3 Medium
Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.3.
CVE-2026-114706 2 Wordpress-extensions, Wpchill 2 Strong Testimonials, Strong Testimonials 2026-10-29 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.15.
CVE-2026-56056 2 Mamunur Rashid, Wordpress-extensions 2 The Post Grid, The Post Grid 2026-10-29 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mamunur Rashid The Post Grid the-post-grid allows Stored XSS.This issue affects The Post Grid: from n/a through 7.9.7.
CVE-2026-39735 2 Crocoblock, Wordpress-extensions 2 Jetengine, Jetengine 2026-10-29 6.5 Medium
Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetEngine: from n/a through 3.9.0.1.
CVE-2026-118094 2 Igorfuna, Wordpress-extensions 2 Ad Inserter, Ad Inserter 2026-10-29 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Stored XSS.This issue affects Ad Inserter: from n/a through 2.8.18.
CVE-2026-116863 2 Tribulant, Wordpress-extensions 2 Newsletters, Newsletters 2026-10-29 9.6 Critical
Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Software Newsletters newsletters-lite allows Cross Site Request Forgery.This issue affects Newsletters: from n/a through 4.18.2.
CVE-2026-116404 2 Davidanderson, Wordpress-extensions 2 Redux Framework, Redux Framework 2026-10-29 6.5 Medium
Missing Authorization vulnerability in David Anderson Redux Framework redux-framework allows Lifting Sensitive Data Embedded in Cache.This issue affects Redux Framework: from n/a through 4.5.16.
CVE-2026-115603 2 Advanced Ads Gmbh, Wordpress-extensions 2 Advanced Ads – Tracking, Advanced Ads – Tracking 2026-10-29 8.5 High
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Advanced Ads GmbH Advanced Ads – Tracking advanced-ads-tracking allows Blind SQL Injection.This issue affects Advanced Ads – Tracking: from n/a before 4.0.0.
CVE-2026-103693 1 Wordpress-extensions 2 Frontend Dashboard, Profilegrid 2026-10-29 9.0 Critical
The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 do not prevent an unauthenticated user from storing a serialized PHP object in user metadata that is deserialized when a public profile is viewed, allowing PHP object injection that can lead to arbitrary file write and potential remote code execution.
CVE-2026-92086 2 Web-soudan, Wordpress-extensions 2 Mw Wp Form, Mw Wp Form 2026-10-29 5.3 Medium
The MW WP Form plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.1.7 via the 'post_id' parameter. This makes it possible for unauthenticated attackers to extract personally identifiable information from other users' form inquiry records, including submitted names, email addresses, and free-text message bodies, by enumerating sequential post IDs. Exploitation requires the targeted form to have the querystring setting enabled, but this is a standard documented feature of the plugin.
CVE-2026-115599 2 Thimpress, Wordpress-extensions 2 Learnpress, Learnpress 2026-10-29 7.5 High
Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.11.
CVE-2026-78395 1 Wordpress-extensions 1 Link Library 2026-10-29 5.3 Medium
The Link Library WordPress plugin before 7.10.0 does not re-check the selected library's own login requirement when processing its front-end link submission, allowing unauthenticated users to submit links to a library configured to require login by reusing a form token obtained from another library that does not.
CVE-2026-108685 1 Wordpress-extensions 1 Wp Post Author 2026-10-29 3.7 Low
The WP Post Author WordPress plugin before 4.2.0 does not check that the account was created before updating its profile during front-end registration, allowing unauthenticated users to overwrite the display name, nickname and website of the first user account, which is normally the administrator, when a registration form declares one of those fields.