Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,865

CVE-2026-97243

WordPress AllAble Connector plugin <= 0.13.4 - Broken Access Control vulnerability

Subscriber Broken Access Control in AllAble Connector <= 0.13.4 versions.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-97242

WordPress WEBO MCP plugin <= 3.0.18 - Arbitrary File Deletion vulnerability

Author Arbitrary File Deletion in WEBO MCP <= 3.0.18 versions.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-97241

WordPress BackupEase plugin <= 2.2.2 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in BackupEase <= 2.2.2 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-97240

WordPress StifLi Backup Tools plugin <= 2.2.7 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in StifLi Backup Tools <= 2.2.7 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-97239

WordPress MCP Content Manager Lite plugin <= 1.1.0 - Broken Access Control vulnerability

Subscriber Broken Access Control in MCP Content Manager Lite <= 1.1.0 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-97238

WordPress JetEngine plugin <= 3.8.14.3 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in JetEngine <= 3.8.14.3 versions.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-97236

WordPress ThemeREX Addons plugin < 2.45.0 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-97235

WordPress ThemeREX Addons plugin < 2.45.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-97197

WordPress WordPress Backup & Migration plugin <= 1.6.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WordPress Backup & Migration <= 1.6.0 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-97196

WordPress GiveWP plugin <= 4.16.9 - Broken Authentication vulnerability

Improper Validation of Unsafe Equivalence in Input vulnerability in Liquid Web / StellarWP GiveWP allows Authentication Bypass. This issue affects GiveWP: from n/a through 4.16.9.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-97079

WordPress Webba Booking plugin <= 6.5.0 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References (IDOR) in Webba Booking <= 6.5.0 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-97078

WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.17 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References (IDOR) in Client Invoicing by Sprout Invoices <= 20.8.17 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-97077

WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.18 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-97074

WordPress Newsletters, Email Marketing, SMS and Popups by Omnisend plugin <= 1.9.0 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References (IDOR) in Newsletters, Email Marketing, SMS and Popups by Omnisend <= 1.9.0 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-97067

WordPress EWWW Image Optimizer plugin <= 8.7.7 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.7 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-97066

WordPress GiveWP plugin <= 4.16.9 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References (IDOR) in GiveWP <= 4.16.9 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-97065

WordPress Happyforms plugin <= 1.26.15 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Happyforms <= 1.26.15 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-96838

WordPress Blacklist Manager &#8211; WooCommerce Anti-Fraud, Blacklist &amp; Checkout Verification plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in Blacklist Manager &#8211; WooCommerce Anti-Fraud, Blacklist &amp; Checkout Verification <= 2.3.1 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-96837

WordPress CartFlows plugin <= 3.2.0 - Remote Code Execution (RCE) vulnerability

Contributor Remote Code Execution (RCE) in CartFlows <= 3.2.0 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-96836

WordPress Parsi Date plugin <= 6.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Parsi Date <= 6.3 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—