Search vulnerabilities

Expected end of text, found '–' (at char 11), (line:1, col:12)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,959

CVE-2026-62037

WordPress Document Embedder plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Document Embedder <= 2.4.0 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-62034

WordPress Before After Image Comparison – Image comparison for WP plugin <= 1.1.21 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Before After Image Comparison – Image comparison for WP <= 1.1.21 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-62030

WordPress StreamCast plugin <= 2.4.5 - Server Side Request Forgery (SSRF) vulnerability

Unauthenticated Server Side Request Forgery (SSRF) in StreamCast <= 2.4.5 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-62027

WordPress Team Section Block plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Team Section Block <= 2.0.4 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-62020

WordPress TouchUp theme < 1.4 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in TouchUp < 1.4 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-57806

WordPress Martfury - WooCommerce Marketplace WordPress theme theme <= 3.3.9 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in drfuri Martfury - WooCommerce Marketplace WordPress Theme martfury allows Reflected XSS.This issue affects Martfury - WooCommerce Marketplace WordPress Theme: from n/a through 3.3.9.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-57742

WordPress Kids Planet theme <= 2.2.14.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group Kids Planet allows Reflected XSS. This issue affects Kids Planet: from n/a through 2.2.14.2.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Themerex Group
Products
Kids Planet
CVE-2026-48194

WordPress DukaMarket theme <= 1.3.0 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in DukaMarket <= 1.3.0 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-48193

WordPress Uminex theme <= 1.0.9 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Uminex <= 1.0.9 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-45440

WordPress WP Ultimate CSV Importer plugin <= 9.2 - SQL Injection vulnerability

Administrator SQL Injection in WP Ultimate CSV Importer <= 9.2 versions.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-42777

WordPress Aalto theme <= 1.8 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Aalto <= 1.8 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-42724

WordPress CleanSkin theme <= 1.5.0 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in CleanSkin <= 1.5.0 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-42723

WordPress CleanSkin theme <= 1.5.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-42722

WordPress Frontend Admin by DynamiApps plugin <= 3.29.13 - SQL Injection vulnerability

Administrator SQL Injection in Frontend Admin by DynamiApps <= 3.29.13 versions.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-42718

WordPress Booster for WooCommerce plugin <= 8.4.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Booster for WooCommerce <= 8.4.0 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-42717

WordPress Leyka plugin <= 3.32.3 - SQL Injection vulnerability

Administrator SQL Injection in Leyka <= 3.32.3 versions.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-42716

WordPress Payever - WooCommerce Gateway plugin <= 4.8.2 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway <= 4.8.2 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-42715

WordPress Photo Gallery by 10Web plugin <= 1.8.47 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Photo Gallery by 10Web <= 1.8.47 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-42712

WordPress Qode Tours plugin <= 3.1.3.2 - SQL Injection vulnerability

Subscriber SQL Injection in Qode Tours <= 3.1.3.2 versions.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-42711

WordPress Slider by 10Web plugin <= 1.2.63 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Slider by 10Web <= 1.2.63 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—