Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (13154 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2026-8176 2 Latepoint, Wordpress 2 Latepoint, Wordpress 2026-06-16 7.5 High
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 5.5.1. The plugin chains three independent flaws that together allow an authenticated Agent (Agent+) to overwrite a WordPress Administrator's password without ever invoking an Administrator-only API. This makes it possible for authenticated attackers, with Agent access and above, to elevate their privileges to Administrator.
CVE-2026-40766 2 Stylemixthemes, Wordpress 2 Masterstudy Lms, Wordpress 2026-06-16 8.5 High
Subscriber SQL Injection in MasterStudy LMS <= 3.7.25 versions.
CVE-2026-48880 2 Ahmad, Wordpress 2 Wp Job Portal, Wordpress 2026-06-16 6.5 Medium
Subscriber Cross Site Scripting (XSS) in WP Job Portal <= 2.5.2 versions.
CVE-2026-40798 2 Tomdever, Wordpress 2 Wpforo Forum, Wordpress 2026-06-16 9.3 Critical
Unauthenticated SQL Injection in wpForo Forum <= 3.0.4 versions.
CVE-2026-25440 2 Wordpress, Wpdeveloper 2 Wordpress, Essential Addons For Elementor 2026-06-16 5.3 Medium
Unauthenticated Broken Access Control in Essential Addons for Elementor < 6.6.0 versions.
CVE-2026-39434 2 Webappick, Wordpress 2 Ctx Feed, Wordpress 2026-06-16 7.2 High
Shop manager PHP Object Injection in CTX Feed <= 6.6.26 versions.
CVE-2026-39451 2 Jgwhite33, Wordpress 2 Wp Google Review Slider, Wordpress 2026-06-16 6.3 Medium
Unauthenticated Cross Site Scripting (XSS) in WP Google Review Slider <= 18.0 versions.
CVE-2026-39472 2 Wordpress, Wpovernight 2 Wordpress, Woocommerce Pdf Invoices\& Packing Slips 2026-06-16 7.2 High
Shop manager PHP Object Injection in WooCommerce PDF Invoices & Packing Slips < 5.9.0 versions.
CVE-2026-49768 2 Happyforms, Wordpress 2 Happyforms, Wordpress 2026-06-16 9.8 Critical
Unauthenticated PHP Object Injection in Happyforms <= 1.26.13 versions.
CVE-2026-42384 2 Nsquared, Wordpress 2 Simply Schedule Appointments, Wordpress 2026-06-16 7.5 High
Unauthenticated Sensitive Data Exposure in Simply Schedule Appointments < 1.6.11.2 versions.
CVE-2026-49110 2 Wordpress, Wp Swings 2 Wordpress, Upsell Order Bump Offer For Woocommerce 2026-06-16 7.5 High
Unauthenticated Broken Authentication in Upsell Order Bump Offer for WooCommerce <= 3.1.4 versions.
CVE-2026-39491 2 Artbees, Wordpress 2 Jupiter X Core, Wordpress 2026-06-16 6.5 Medium
Subscriber Cross Site Scripting (XSS) in JupiterX Core <= 4.14.1 versions.
CVE-2026-48870 2 Kingaddons, Wordpress 2 King Addons For Elementor, Wordpress 2026-06-16 6.5 Medium
Subscriber Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.62 versions.
CVE-2026-39512 2 Paolo, Wordpress 2 Geodirectory, Wordpress 2026-06-16 9.3 Critical
Unauthenticated SQL Injection in GeoDirectory <= 2.8.152 versions.
CVE-2026-40762 2 Wordpress, Wpgraphql 2 Wordpress, Wpgraphql 2026-06-16 7.5 High
Unauthenticated SQL Injection in WPGraphQL < 2.11.1 versions.
CVE-2026-39480 2 Inisev, Wordpress 2 Backup Migration, Wordpress 2026-06-16 7.5 High
Unauthenticated Sensitive Data Exposure in Backup Migration <= 2.1.1 versions.
CVE-2026-39503 2 Awesomemotive, Wordpress 2 Easy Digital Downloads, Wordpress 2026-06-16 7.5 High
Unauthenticated Broken Access Control in Easy Digital Downloads <= 3.6.5 versions.
CVE-2026-39447 2 Nsquared, Wordpress 2 Simply Schedule Appointments, Wordpress 2026-06-16 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.10.6 versions.
CVE-2026-34900 2 Liquid Web / Stellarwp, Wordpress 2 Givewp, Wordpress 2026-06-16 7.1 High
Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.14.2 versions.
CVE-2026-23970 2 Themeisle, Wordpress 2 Redirection For Contact Form 7, Wordpress 2026-06-16 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Redirection for Contact Form 7 <= 3.2.8 versions.