Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,467

CVE-2026-97293

WordPress Media LIbrary Assistant plugin <= 3.41 - SQL Injection vulnerability

Contributor SQL Injection in Media LIbrary Assistant <= 3.41 versions.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-97292

WordPress YITH WooCommerce Tab Manager plugin <= 2.15.0 - Cross Site Scripting (XSS) vulnerability

Author Cross Site Scripting (XSS) in YITH WooCommerce Tab Manager <= 2.15.0 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-97270

WordPress CMB2 plugin <= 2.13.0 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in CMB2 <= 2.13.0 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-97267

WordPress Prevent files / folders access plugin <= 2.6.7 - Broken Access Control vulnerability

Subscriber Broken Access Control in Prevent files / folders access <= 2.6.7 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-97266

WordPress Virtue/Ascend/Pinnacle Toolkit plugin <= 4.9.12.1 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12.1 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-97262

WordPress Visual Composer Website Builder plugin <= 45.16.2 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.2 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-97261

WordPress Notivo plugin <= 1.4.2 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Notivo <= 1.4.2 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-97253

WordPress LayerSlider plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kreatura LayerSlider allows Reflected XSS. This issue affects LayerSlider: from n/a through 8.4.0.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-97249

WordPress Paid Member Subscriptions plugin <= 3.0.9 - Bypass Vulnerability vulnerability

Unauthenticated Bypass Vulnerability in Paid Member Subscriptions <= 3.0.9 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-97248

WordPress Booking Activities plugin <= 1.18.7.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Booking Activities <= 1.18.7.1 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-97247

WordPress Blocksy Companion plugin <= 2.1.55 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Blocksy Companion <= 2.1.55 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-97245

WordPress SureCart plugin <= 4.7.2 - Privilege Escalation vulnerability

Shop Worker Privilege Escalation in SureCart <= 4.7.2 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-97244

WordPress Creator LMS plugin <= 1.2.19 - Path Traversal vulnerability

Contributor Path Traversal in Creator LMS <= 1.2.19 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-97243

WordPress AllAble Connector plugin <= 0.13.4 - Broken Access Control vulnerability

Subscriber Broken Access Control in AllAble Connector <= 0.13.4 versions.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-97242

WordPress WEBO MCP plugin <= 3.0.18 - Arbitrary File Deletion vulnerability

Author Arbitrary File Deletion in WEBO MCP <= 3.0.18 versions.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-97241

WordPress BackupEase plugin <= 2.2.2 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in BackupEase <= 2.2.2 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-97240

WordPress StifLi Backup Tools plugin <= 2.2.7 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in StifLi Backup Tools <= 2.2.7 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-97239

WordPress MCP Content Manager Lite plugin <= 1.1.0 - Broken Access Control vulnerability

Subscriber Broken Access Control in MCP Content Manager Lite <= 1.1.0 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-97238

WordPress JetEngine plugin <= 3.8.14.3 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in JetEngine <= 3.8.14.3 versions.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-97236

WordPress ThemeREX Addons plugin < 2.45.0 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—