Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,860

CVE-2026-5191

Tiled Gallery Carousel Without JetPack <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-image-title'

The Tiled Gallery Carousel Without JetPack plugin for WordPress is vulnerable to stored cross-site scripting via the 'data-image-title' parameter in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Raja3c Wordpress
Products
Tiled Gallery Carousel Without Jetpack Wordpress
CVE-2025-52759

WordPress Accordion FAQ plugin <= 2.2.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UnboundStudio Accordion FAQ allows Reflected XSS. This issue affects Accordion FAQ: from n/a through 2.2.1.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Unboundstudio Wordpress
Products
Accordion Faq Wordpress
CVE-2025-52766

WordPress Printeers Print & Ship plugin <= 1.17.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Printeers Printeers Print & Ship allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Printeers Print & Ship: from n/a through 1.17.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Printeers Wordpress
Products
Printeers Print & Ship Wordpress
CVE-2025-53209

WordPress Masteriyo LMS PRO plugin <= 2.20.0 - Privilege Escalation Vulnerability

Incorrect Privilege Assignment vulnerability in Themeisle Masteriyo LMS PRO allows Privilege Escalation. This issue affects Masteriyo LMS PRO: from n/a through 2.20.0.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Themeisle Wordpress
Products
Masteriyo Lms Pro Wordpress
CVE-2025-53302

WordPress Constructor theme <= 1.6.5 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Anton Shevchuk Constructor allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Constructor: from n/a through 1.6.5.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Anton Shevchuk Wordpress
Products
Constructor Wordpress
CVE-2025-53346

WordPress Thim Core Plugin <= 2.3.3 - Broken Access Control Vulnerability

Missing Authorization vulnerability in ThimPress Thim Core allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Thim Core: from n/a through 2.3.3.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Thimpress Wordpress
Products
Thim Core Wordpress
CVE-2025-53440

WordPress Confidant theme <= 1.4 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Confidant allows PHP Local File Inclusion. This issue affects Confidant: from n/a through 1.4.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Axiomthemes Wordpress
Products
Confidant Wordpress
CVE-2025-58024

WordPress Accordion FAQ Plugin <= 2.2.1 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in UnboundStudio Accordion FAQ allows PHP Local File Inclusion. This issue affects Accordion FAQ: from n/a through 2.2.1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Unboundstudio Wordpress
Products
Accordion Faq Wordpress
CVE-2025-58705

WordPress Crafti theme <= 1.12 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Crafti allows PHP Local File Inclusion. This issue affects Crafti: from n/a through 1.12.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Axiomthemes Wordpress
Products
Crafti Wordpress
CVE-2026-42670

WordPress Five Star Restaurant Reservations plugin <= 2.7.14 - Payment Bypass vulnerability

Missing Authorization vulnerability in Etoile Web Design Incorporated Five Star Restaurant Reservations allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Five Star Restaurant Reservations: from n/a through 2.7.14.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Etoile Web Design Incorporated Wordpress
Products
Five Star Restaurant Reservations Wordpress
CVE-2026-42684

WordPress WP Job Portal plugin <= 2.5.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ahmad WP Job Portal allows Blind SQL Injection. This issue affects WP Job Portal: from n/a through 2.5.1.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Ahmad Wordpress
Products
Wp Job Portal Wordpress
CVE-2026-42685

WordPress WP Job Portal plugin <= 2.5.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ahmad WP Job Portal allows Reflected XSS. This issue affects WP Job Portal: from n/a through 2.5.1.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Ahmad Wordpress
Products
Wp Job Portal Wordpress
CVE-2026-39550

WordPress Aperitif theme <= 1.6 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Elated-Themes Aperitif allows Object Injection. This issue affects Aperitif: from n/a through 1.6.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Elated-themes Wordpress
Products
Aperitif Wordpress
CVE-2026-39551

WordPress Töbel theme <= 1.8.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Elated-Themes Töbel allows Object Injection. This issue affects Töbel: from n/a through 1.8.1.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Elated-themes Wordpress
Products
Töbel Wordpress
CVE-2026-8993

Improper URL Handler Processing in D.Launcher 2 enables NTLM Credential Disclosure and SSRF attacks

D.Launcher 2 component of Slovak eID client ecosystem contains Improper URL Handler Processing vulnerability. Application registers multiple custom URL handlers that could be exploited to initiate full NTLM autentication or SMB connection to attacker infrastructure and to conduct SSRF (Server Side Request Forgery) attacks. User interaction is required as potential victim needs to open a specially crafted URL.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Ditec
Products
D.launcher 2
CVE-2026-39552

WordPress Blueprint theme < 1.1.5 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Code Supply Co. Blueprint allows PHP Local File Inclusion. This issue affects Blueprint: from n/a before 1.1.5.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Code Supply Co. Wordpress
Products
Blueprint Wordpress
CVE-2026-39553

WordPress WaveRide theme <= 1.4 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes WaveRide allows PHP Local File Inclusion. This issue affects WaveRide: from n/a through 1.4.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Select-themes Wordpress
Products
Waveride Wordpress
CVE-2026-9844

Vulnerability in navify® Digital Pathology

Use of default credentials vulnerability in Roche Diagnostics navify Digital Pathology (RabbitMQ Management interface modules) allows Default Usernames and Passwords. This issue affects navify Digital Pathology: from 2.0.0 before 2.4.1.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Roche Diagnostics
Products
Navify Digital Pathology
CVE-2025-58707

WordPress Spin theme <= 1.8 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Spin allows PHP Local File Inclusion. This issue affects Spin: from n/a through 1.8.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Axiomthemes Wordpress
Products
Spin Wordpress
CVE-2025-58897

WordPress Fermentio theme <= 1.5.0 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Fermentio allows PHP Local File Inclusion. This issue affects Fermentio: from n/a through 1.5.0.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Axiomthemes Wordpress
Products
Fermentio Wordpress