Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,979

CVE-2022-36379

WordPress ЮKassa для WooCommerce plugin <= 2.3.0 - Cross-Site Request Forgery (CSRF) leading to plugin settings update

Cross-Site Request Forgery (CSRF) leading to plugin settings update in YooMoney ЮKassa для WooCommerce plugin <= 2.3.0 at WordPress.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Yookassa
Products
Yukassa For Woocommerce
CVE-2022-36383

WordPress Word Search Puzzles game plugin <= 2.0.1 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities

Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in WHA Word Search Puzzles game plugin <= 2.0.1 at WordPress.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Webhelpagency
Products
Wha Wordsearch
CVE-2022-36355

WordPress Easy Org Chart plugin <= 3.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in PluginlySpeaking Easy Org Chart plugin <= 3.1 at WordPress.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Easy Org Chart Project
Products
Easy Org Chart
CVE-2022-36352

WordPress ProfileGrid Plugin <= 5.0.3 is vulnerable to Broken Access Control

Missing Authorization vulnerability in Profilegrid ProfileGrid – User Profiles, Memberships, Groups and Communities.This issue affects ProfileGrid – User Profiles, Memberships, Groups and Communities: from n/a through 5.0.3.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Metagauss
Products
Profilegrid
CVE-2022-36356

WordPress Culture Object plugin <= 4.0.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Liam Gladdy / Thirty8 Digital Culture Object plugin <= 4.0.1 at WordPress.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Culture Object Project
Products
Culture Object
CVE-2022-36375

WordPress Tabs plugin <= 3.6.0 - Authenticated WordPress Options Change vulnerability

Authenticated (high role user) WordPress Options Change vulnerability in Biplob Adhikari's Tabs plugin <= 3.6.0 at WordPress.

CVSS 3.1 · 7.2 High EPSS 1.3% KEV · Not listed
Vendors
Oxilab
Products
Responsive Tabs
CVE-2022-35726

WordPress Video Gallery plugin <= 1.3.4.5 - Broken Authentication vulnerability

Broken Authentication vulnerability in yotuwp Video Gallery plugin <= 1.3.4.5 at WordPress.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Yotuwp
Products
Video Gallery
CVE-2022-34868

WordPress ЮKassa для WooCommerce plugin <= 2.3.0 - Authenticated Arbitrary Settings Update vulnerability

Authenticated Arbitrary Settings Update vulnerability in YooMoney ЮKassa для WooCommerce plugin <= 2.3.0 at WordPress.

CVSS 3.1 · 8.8 High EPSS 1.1% KEV · Not listed
Vendors
Yookassa
Products
Yukassa For Woocommerce
CVE-2022-34839

WordPress WP OAuth2 Server plugin <= 1.0.1 - Authentication Bypass vulnerability

Authentication Bypass vulnerability in CodexShaper's WP OAuth2 Server plugin <= 1.0.1 at WordPress.

CVSS 3.1 · 5.9 Medium EPSS 1.1% KEV · Not listed
Vendors
Codexshaper
Products
Wp Oauth2 Server
CVE-2022-34344

WordPress Wholesale Suite Plugin <= 2.1.5 is vulnerable to Broken Access Control

Missing Authorization vulnerability in Rymera Web Co Wholesale Suite – WooCommerce Wholesale Prices, B2B, Catalog Mode, Order Form, Wholesale User Roles, Dynamic Pricing & More.This issue affects Wholesale Suite – WooCommerce Wholesale Prices, B2B, Catalog Mode, Order Form, Wholesale User Roles, Dynamic Pricing & More: from n/a through 2.1.5.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Rymera
Products
Wholesale Suite
CVE-2022-34155

WordPress OAuth Single Sign On – SSO (OAuth Client) Plugin <= 6.23.3 is vulnerable to Broken Authentication

Improper Authentication vulnerability in miniOrange OAuth Single Sign On – SSO (OAuth Client) plugin allows Authentication Bypass.This issue affects OAuth Single Sign On – SSO (OAuth Client): from n/a through 6.23.3.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Miniorange
Products
Oauth Single Sign On
CVE-2022-33191

WordPress Testimonials plugin <= 3.0.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Chinmoy Paul's Testimonials plugin <= 3.0.1 at WordPress.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed
Vendors
Testimonials Project
Products
Testimonials
CVE-2022-33201

WordPress MailerLite – Signup forms (official) plugin <= 1.5.7 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in MailerLite – Signup forms (official) plugin <= 1.5.7 at WordPress allows an attacker to change the API key.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mailerlite
Products
Mailerlite Signup Forms
CVE-2022-33900

WordPress Easy Digital Downloads plugin <= 3.0.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability in Easy Digital Downloads plugin <= 3.0.1 at WordPress.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed
Vendors
Awesomemotive
Products
Easy Digital Downloads
CVE-2022-31474

WordPress BackupBuddy Plugin 8.5.8.0-8.7.4.1 is vulnerable to Directory Traversal

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in iThemes BackupBuddy allows Path Traversal.This issue affects BackupBuddy: from 8.5.8.0 through 8.7.4.1.

CVSS 3.1 · 7.5 High EPSS 63.8% KEV · Not listed
Vendors
Ithemes
Products
Backupbuddy
CVE-2022-29420

WordPress Countdown & Clock plugin <= 2.3.2 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Adam Skaat Countdown & Clock (WordPress plugin) countdown-builder allows Stored XSS.This issue affects Countdown & Clock (WordPress plugin): from n/a through 2.3.2.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Edmonsoft
Products
Countdown Builder
CVE-2022-25613

WordPress FV Flowplayer Video Player plugin <= 7.5.18.727 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability

Authenticated Persistent Cross-Site Scripting (XSS) vulnerability in FV Flowplayer Video Player (WordPress plugin) versions <= 7.5.18.727 via &fv_wp_flowplayer_field_splash parameter.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed
Vendors
Foliovision
Products
Fv Flowplayer Video Player
CVE-2021-36898

WordPress Quiz And Survey Master plugin <= 7.3.4 - Auth. SQL Injection (SQLi) vulnerability

Auth. SQL Injection (SQLi) vulnerability in Quiz And Survey Master plugin <= 7.3.4 on WordPress.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed
Vendors
Expresstech
Products
Quiz And Survey Master
CVE-2026-35245

Denial of Service in VirtualBox via RDP

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via RDP to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Oracle
Products
Vm Virtualbox
CVE-2026-22747

Unauthorized User Impersonation when Using X.509 Client Certificates

Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user. This issue affects Spring Security: from 7.0.0 through 7.0.4.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring Security Spring Security