Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,865

CVE-2026-96450

WordPress pixfort Core plugin < 4.3.3 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in pixfort Core < 4.3.3 versions.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-96352

WordPress YITH WooCommerce Ajax Search plugin <= 2.28.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in YITH WooCommerce Ajax Search <= 2.28.0 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-96351

WordPress Classified Listing plugin <= 6.1.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 6.1.3 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-96350

WordPress Estatik plugin <= 4.3.5 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in Estatik <= 4.3.5 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-96349

WordPress SiteSkite plugin <= 2.1.8 - Remote Code Execution (RCE) vulnerability

Unauthenticated Remote Code Execution (RCE) in SiteSkite <= 2.1.8 versions.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-96348

WordPress Bookly plugin <= 28.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Bookly <= 28.2 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-96347

WordPress Bookly plugin <= 28.2 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References (IDOR) in Bookly <= 28.2 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-96346

WordPress WP ERP plugin <= 1.17.9 - SQL Injection vulnerability

Author SQL Injection in WP ERP <= 1.17.9 versions.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-96345

WordPress Estatik plugin <= 4.3.5 - SQL Injection vulnerability

Administrator SQL Injection in Estatik <= 4.3.5 versions.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-96344

WordPress eCommerce Product Catalog plugin <= 3.6.0 - PHP Object Injection vulnerability

Custom role PHP Object Injection in eCommerce Product Catalog <= 3.6.0 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-96343

WordPress WP ERP plugin <= 1.17.9 - PHP Object Injection vulnerability

Custom role PHP Object Injection in WP ERP <= 1.17.9 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-96338

WordPress Profile Builder plugin <= 4.0.2 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in Profile Builder <= 4.0.2 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-95587

WordPress Hostinger Migrator plugin <= 1.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Hostinger Migrator <= 1.0 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-95531

WordPress Conversational Forms for ChatBot plugin <= 1.5.0 - PHP Object Injection vulnerability

Subscriber PHP Object Injection in Conversational Forms for ChatBot <= 1.5.0 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-95104

Stack‑Based Buffer Overflow in Buffalo Wi-Fi Products Causing DoS via Unauthorized HTTP Requests

Stack-based buffer overflow vulnerability exists in BUFFALO Wi-Fi products. A non-authenticated crafted HTTP request may cause a denial-of-service (DoS) condition.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Buffalo
Products
Wex-g300 Wsr-300hp
CVE-2026-94683

WordPress DesignSetGo plugin <= 2.8.0 - PHP Object Injection vulnerability

Contributor PHP Object Injection in DesignSetGo <= 2.8.0 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-94681

WordPress WP Store Locator plugin < 3.0.0 - Denial of Service Attack vulnerability

Unauthenticated Denial of Service Attack in WP Store Locator < 3.0.0 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-94678

WordPress Go Live Update Urls plugin <= 7.0.8 - PHP Object Injection vulnerability

Contributor PHP Object Injection in Go Live Update Urls <= 7.0.8 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-94677

WordPress Kadence WooCommerce Email Designer plugin <= 1.5.19.1 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-94674

WordPress Pixel Manager for WooCommerce plugin <= 1.69.0 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Pixel Manager for WooCommerce <= 1.69.0 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—