Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (12330 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2026-42652 2 Wordpress, Wpeverest 2 Wordpress, User Registration 2026-04-29 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpeverest User Registration user-registration allows Reflected XSS.This issue affects User Registration: from n/a through <= 5.1.5.
CVE-2026-7106 2 Jgrodgers, Wordpress 2 Highland Software Custom Role Manager, Wordpress 2026-04-29 8.8 High
The Highland Software Custom Role Manager plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 1.0.0. This is due to insufficient authorization checks in the hscrm_save_user_roles() function, which is hooked to the personal_options_update action accessible by any authenticated user. This makes it possible for authenticated attackers, with Subscriber-level access or higher, to potentially modify user roles via the profile update form.
CVE-2026-42642 2 Stellarwp, Wordpress 2 Givewp, Wordpress 2026-04-29 5.3 Medium
Missing Authorization vulnerability in StellarWP GiveWP give allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GiveWP: from n/a through <= 4.14.5.
CVE-2026-42412 2 Wedevs, Wordpress 2 Wp User Frontend, Wordpress 2026-04-29 6.5 Medium
Missing Authorization vulnerability in weDevs WP User Frontend allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP User Frontend: from n/a through 4.3.1.
CVE-2026-42377 2 Brainstormforce, Wordpress 2 Sureforms, Wordpress 2026-04-29 7.3 High
Missing Authorization vulnerability in Brainstorm Force SureForms Pro allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects SureForms Pro: from n/a through 2.8.0.
CVE-2025-14359 1 Wordpress 1 Wordpress 2026-04-29 8.1 High
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in brandexponents Oshine allows PHP Local File Inclusion. This issue affects Oshine: from n/a before 7.3.0.
CVE-2025-31421 1 Wordpress 1 Wordpress 2026-04-29 5.8 Medium
Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Oblak Studio Srbtranslatin srbtranslatin allows Retrieve Embedded Sensitive Data.This issue affects Srbtranslatin: from n/a through <= 3.2.0.
CVE-2025-31420 1 Wordpress 1 Wordpress 2026-04-29 7.6 High
Incorrect Privilege Assignment vulnerability in Tomdever wpForo Forum wpforo allows Privilege Escalation.This issue affects wpForo Forum: from n/a through <= 2.4.2.
CVE-2024-37418 3 Andymoyle, Church Admin Project, Wordpress 3 Church Admin, Church Admin, Wordpress 2026-04-29 9.9 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.4.6.
CVE-2025-68029 2 Wordpress, Wpswings 2 Wordpress, Wallet System For Woocommerce 2026-04-29 N/A
Insertion of Sensitive Information Into Sent Data vulnerability in WP Swings Wallet System for WooCommerce wallet-system-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Wallet System for WooCommerce: from n/a through <= 2.7.3.
CVE-2025-63030 1 Wordpress 1 Wordpress 2026-04-29 7.1 High
Cross-Site Request Forgery (CSRF) vulnerability in Saad Iqbal New User Approve new-user-approve allows Cross Site Request Forgery.This issue affects New User Approve: from n/a through <= 3.2.3.
CVE-2026-40778 2 Majesticsupport, Wordpress 2 Majestic Support, Wordpress 2026-04-29 5.3 Medium
Missing Authorization vulnerability in Majestic Support Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Majestic Support: from n/a through <= 1.1.2.
CVE-2026-40784 2 Mahmudul Hasan Arif, Wordpress 2 Fluentboards, Wordpress 2026-04-29 8.1 High
Authorization Bypass Through User-Controlled Key vulnerability in Mahmudul Hasan Arif FluentBoards fluent-boards allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentBoards: from n/a through <= 1.91.2.
CVE-2026-40786 2 Long Watch Studio, Wordpress 2 Myrewards, Wordpress 2026-04-29 4.3 Medium
Missing Authorization vulnerability in Long Watch Studio MyRewards woorewards allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MyRewards: from n/a through <= 5.7.3.
CVE-2026-40742 2 Neliosoftware, Wordpress 2 Nelio Ab Testing, Wordpress 2026-04-29 5.3 Medium
Missing Authorization vulnerability in Nelio Software Nelio AB Testing nelio-ab-testing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Nelio AB Testing: from n/a through <= 8.2.8.
CVE-2026-40764 2 Syed Balkhi, Wordpress 2 Contact Form By Wpforms, Wordpress 2026-04-29 8.1 High
Cross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Cross Site Request Forgery.This issue affects Contact Form by WPForms: from n/a through <= 1.10.0.2.
CVE-2026-40728 2 Blockart, Wordpress 2 Magazine Blocks, Wordpress 2026-04-29 4.3 Medium
Missing Authorization vulnerability in BlockArt Magazine Blocks magazine-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Magazine Blocks: from n/a through <= 1.8.3.
CVE-2026-40729 2 Bplugins, Wordpress 2 3d Viewer – Embed 3d Models, Wordpress 2026-04-29 4.3 Medium
Missing Authorization vulnerability in bPlugins 3D viewer – Embed 3D Models 3d-viewer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 3D viewer – Embed 3D Models: from n/a through <= 1.8.5.
CVE-2026-39701 2 Andrew, Wordpress 2 Shopwp, Wordpress 2026-04-29 5.3 Medium
Missing Authorization vulnerability in Andrew ShopWP wpshopify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShopWP: from n/a through <= 5.2.4.
CVE-2026-39704 2 Nfusionsolutions, Wordpress 2 Precious Metals Automated Product Pricing – Pro, Wordpress 2026-04-29 5.3 Medium
Missing Authorization vulnerability in nfusionsolutions Precious Metals Automated Product Pricing – Pro precious-metals-automated-product-pricing-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Precious Metals Automated Product Pricing – Pro: from n/a through <= 4.0.5.