Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (15857 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2026-79630 2 Getwpfunnels, Wordpress 2 Wpfunnels, Wordpress 2026-09-04 5.3 Medium
The WPFunnels WordPress plugin before 3.13.0 does not verify that the product requested through a checkout order bump is the product that bump's discount was configured for, allowing unauthenticated users to obtain any purchasable product at a discount intended for a different one, with the reduced price carried through to the total of the order they place.
CVE-2026-79631 2 Getwpfunnels, Wordpress 2 Wpfunnels, Wordpress 2026-09-04 5.3 Medium
The WPFunnels WordPress plugin before 3.13.0 does not restrict access to the log files it writes to a predictable location under the public uploads directory, allowing unauthenticated users to download customer order details and opt-in form submissions when logging is enabled.
CVE-2026-82193 2 Wordpress, Wpvividplugins 2 Wordpress, Wpvivid — Backup, Migration & Staging 2026-09-04 5.5 Medium
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied file name before using it to build a write path, allowing administrators to write files of permitted types to arbitrary locations on the server and to overwrite existing files.
CVE-2026-81281 2 Silverks, Wordpress 2 Graphene, Wordpress 2026-09-04 6.5 Medium
Subscriber Cross Site Scripting (XSS) in Graphene <= 2.9.4 versions.
CVE-2026-81282 2 Villatheme, Wordpress 2 Product Variations Swatches For Woocommerce, Wordpress 2026-09-04 6.5 Medium
Subscriber Cross Site Scripting (XSS) in Product Variations Swatches for WooCommerce <= 1.1.18 versions.
CVE-2026-81292 2 Ido Kobelkowsky, Wordpress 2 Simple Payment, Wordpress 2026-09-04 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Simple Payment <= 2.5.1 versions.
CVE-2026-81300 2 Silverplugins217, Wordpress 2 Calculation For Contact Form 7, Wordpress 2026-09-04 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Calculation For Contact Form 7 <= 1.0 versions.
CVE-2026-81776 2 Advanpix, Wordpress 2 Wp Quicklatex, Wordpress 2026-09-04 7.1 High
Unauthenticated Cross Site Scripting (XSS) in WP QuickLaTeX <= 3.8.8 versions.
CVE-2026-84238 2 Wordpress, Yith 2 Wordpress, Yith Request A Quote For Woocommerce Premium 2026-09-04 9.8 Critical
Unauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Premium < 4.46.0 versions.
CVE-2026-84765 2 John Havlik, Wordpress 2 Breadcrumb Navxt, Wordpress 2026-09-04 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Breadcrumb NavXT <= 7.5.1 versions.
CVE-2026-84767 2 Nexcess, Wordpress 2 Bookit, Wordpress 2026-09-04 5.3 Medium
Unauthenticated Bypass Vulnerability in BookIt <= 2.6.0.3 versions.
CVE-2026-84773 2 Wordpress, 作者 2 Wordpress, Shane Bishop:ewww Image Optimizer 2026-09-04 7.2 High
Unauthenticated Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.6 versions.
CVE-2026-84776 2 Malcare, Wordpress 2 Malcare Security, Wordpress 2026-09-04 7.5 High
Unauthenticated Denial of Service Attack in MalCare Security <= 6.69 versions.
CVE-2026-84778 2 Migrateguru, Wordpress 2 Migrate Guru – Site Migration & Cloning, Wordpress 2026-09-04 7.5 High
Unauthenticated Denial of Service Attack in Migrate Guru – Site Migration &amp; Cloning <= 6.65 versions.
CVE-2026-84779 2 Sheikh Heera, Wordpress 2 Agentimus – Ai Seo, Llms.txt & Mcp For Ai Agents, Wordpress 2026-09-04 8.1 High
Subscriber Broken Access Control in Agentimus – AI SEO, llms.txt &amp; MCP for AI Agents <= 1.51.0 versions.
CVE-2026-84836 2 Kirillbdev, Wordpress 2 Wc Ukraine Shipping, Wordpress 2026-09-04 7.1 High
Subscriber Insecure Direct Object References (IDOR) in WC Ukraine Shipping <= 1.22.3 versions.
CVE-2026-84847 2 Brightvesseldev, Wordpress 2 Quick Event Manager, Wordpress 2026-09-04 7.5 High
Unauthenticated Broken Access Control in Quick Event Manager <= 9.17 versions.
CVE-2026-84848 2 Brightvesseldev, Wordpress 2 Quick Event Manager, Wordpress 2026-09-04 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Quick Event Manager <= 9.17 versions.
CVE-2026-85307 2 Kevin Pirnie, Wordpress 2 Kp Agent Ready, Wordpress 2026-09-04 5.3 Medium
Insertion of Sensitive Information Into Sent Data vulnerability in Kevin Pirnie KP Agent Ready allows Retrieve Embedded Sensitive Data. This issue affects KP Agent Ready: from n/a before 1.2.08.
CVE-2026-11613 2 Divi Engine, Wordpress 2 Divi Ajax Filter, Wordpress 2026-09-04 9.8 Critical
The Divi Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.1.2 via the 'custom_loop_template' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. This vulnerability is only exploitable when the loop_templates parameter is set to 'custom-template'.