Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (537 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-104747 2 Edge-themes, Wordpress-extensions 2 Haaken, Haaken 2026-10-06 8.1 High
Unauthenticated PHP Object Injection in Haaken <= 1.5 versions.
CVE-2026-104757 2 Carazo, Wordpress-extensions 2 Import And Export Users And Customers, Import And Export Users And Customers 2026-10-06 7.2 High
Editor Privilege Escalation in Import and export users and customers <= 2.5.5 versions.
CVE-2026-104814 2 Epiph, Wordpress-extensions 2 Form Block, Form Block 2026-10-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Form Block <= 1.8.1 versions.
CVE-2026-105057 2 Ben Marshall, Wordpress-extensions 2 Zero Spam, Zero Spam 2026-10-06 5.3 Medium
Unauthenticated Bypass Vulnerability in Zero Spam <= 5.7.11 versions.
CVE-2026-105058 2 John James Jacoby, Wordpress-extensions 2 Wp User Profiles, Wp User Profiles 2026-10-06 8.8 High
Subscriber Privilege Escalation in WP User Profiles <= 2.7.3 versions.
CVE-2026-105059 2 Royalnavneet, Wordpress-extensions 2 Delete All Comments Of Wordpress, Delete All Comments Of Wordpress 2026-10-06 6.5 Medium
Subscriber Broken Access Control in Delete All Comments of wordpress <= 7.1 versions.
CVE-2026-105061 2 Brandtoss, Wordpress-extensions 2 Wpmailster, Wp Mailster 2026-10-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in WP Mailster <= 1.9.0.0 versions.
CVE-2026-105070 2 Dimitri Grassi, Wordpress-extensions 2 Salon Booking System, Salon Booking System 2026-10-06 8.8 High
Unauthenticated Privilege Escalation in Salon booking system <= 10.31.7 versions.
CVE-2026-105071 2 Royal Plugins, Wordpress-extensions 2 Sitevault, Sitevault 2026-10-06 7.5 High
Unauthenticated Sensitive Data Exposure in SiteVault – Backup, Restore, Migration &amp; Cloning <= 1.5.17 versions.
CVE-2026-105317 2 Cozmoslabs, Wordpress-extensions 2 Paid Member Subscriptions, Paid Member Subscriptions 2026-10-06 8.5 High
Subscriber SQL Injection in Paid Member Subscriptions <= 3.1.1 versions.
CVE-2026-104399 2 Stylemix, Wordpress-extensions 2 Motors, Motors 2026-10-06 N/A
Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Motors allows Retrieve Embedded Sensitive Data. This issue affects Motors: from n/a through 1.4.124.
CVE-2026-103355 2 Unlimited-elements, Wordpress-extensions 2 Unlimited Elements For Elementor (free Widgets, Addons, Templates), Unlimited Elements For Elementor 2026-10-06 9.3 Critical
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Blind SQL Injection.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20.
CVE-2026-97276 2 Veronalabs, Wordpress-extensions 2 Wp Statistics, Wp Statistics 2026-10-05 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP Statistics wp-statistics allows Reflected XSS.This issue affects WP Statistics: from n/a through 14.16.14.
CVE-2026-103354 2 Stellarwp, Wordpress-extensions 2 Gutenberg Blocks By Kadence Blocks, Gutenberg Blocks By Kadence Blocks 2026-10-05 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.7.11.1.
CVE-2026-97307 2 Stylemixthemes, Wordpress-extensions 2 Cost Calculator Builder, Cost Calculator Builder 2026-10-05 7.5 High
Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Cost Calculator Builder cost-calculator-builder allows Retrieve Embedded Sensitive Data.This issue affects Cost Calculator Builder: from n/a through 4.0.17.
CVE-2026-103062 2 Cozmoslabs, Wordpress-extensions 2 Translatepress, Translatepress 2026-10-05 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allows Stored XSS.This issue affects TranslatePress: from n/a through 3.3.6.
CVE-2026-96451 2 Ultimatemember, Wordpress-extensions 2 Ultimate Member, Ultimate Member 2026-10-05 8.8 High
Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1.
CVE-2026-104402 2 Farvisun, Wordpress-extensions 2 Mindio Magic Mcp, Mindio Magic Mcp 2026-10-05 4.3 Medium
Insertion of Sensitive Information Into Sent Data vulnerability in farvisun Mindio Magic MCP mindio-magic-mcp allows Retrieve Embedded Sensitive Data.This issue affects Mindio Magic MCP: from n/a through 0.5.6.
CVE-2026-103344 2 Unlimited-elements, Wordpress-extensions 2 Unlimited Elements For Elementor (free Widgets, Addons, Templates), Unlimited Elements For Elementor 2026-10-05 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20.
CVE-2026-86817 1 Wordpress-extensions 1 Five Star Business Profile And Schema 2026-10-05 4.9 Medium
The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly restrict the callbacks used to resolve schema field default values, allowing authenticated users with Author-level access and above to store input that discloses sensitive data, including other users' password hashes and arbitrary site option values, in public output readable by unauthenticated visitors.