Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (7448 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2025-32291 2 Fantasticplugins, Wordpress 2 Sumo Affiliates Pro, Wordpress 2025-06-27 10 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in FantasticPlugins SUMO Affiliates Pro allows Using Malicious Files. This issue affects SUMO Affiliates Pro: from n/a through 10.7.0.
CVE-2025-48140 2 Metalpriceapi, Wordpress 2 Metalpriceapi, Wordpress 2025-06-27 9.9 Critical
Improper Control of Generation of Code ('Code Injection') vulnerability in metalpriceapi MetalpriceAPI allows Code Injection. This issue affects MetalpriceAPI: from n/a through 1.1.4.
CVE-2025-47559 2 Mapsvg, Wordpress 2 Mapsvg, Wordpress 2025-06-27 9.9 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in RomanCode MapSVG allows Upload a Web Shell to a Web Server. This issue affects MapSVG: from n/a through 8.5.32.
CVE-2025-49071 2 Nasatheme, Wordpress 2 Flozen, Wordpress 2025-06-27 10 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in NasaTheme Flozen allows Upload a Web Shell to a Web Server. This issue affects Flozen: from n/a through n/a.
CVE-2025-49444 2 Merkulove, Wordpress 2 Reformer For Elementor, Wordpress 2025-06-27 10 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in merkulove Reformer for Elementor allows Upload a Web Shell to a Web Server. This issue affects Reformer for Elementor: from n/a through 1.0.5.
CVE-2025-49447 2 Fastw3b, Wordpress 2 Fw Food Menu Plugin, Wordpress 2025-06-27 10 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in Fastw3b LLC FW Food Menu allows Using Malicious Files. This issue affects FW Food Menu : from n/a through 6.0.0.
CVE-2025-22504 2 Jumpdemand, Wordpress 2 4ecps Web Forms, Wordpress 2025-06-27 10 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in jumpdemand 4ECPS Web Forms allows Upload a Web Shell to a Web Server.This issue affects 4ECPS Web Forms: from n/a through 0.2.18.
CVE-2025-22654 2 Kodeshpa, Wordpress 2 Simplified Plugin, Wordpress 2025-06-27 10 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in kodeshpa Simplified allows Using Malicious Files. This issue affects Simplified: from n/a through 1.0.6.
CVE-2025-23953 2 Innovative Solutions, Wordpress 2 User Files Plugin, Wordpress 2025-06-27 10 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in Innovative Solutions user files allows Upload a Web Shell to a Web Server. This issue affects user files: from n/a through 2.4.2.
CVE-2025-25106 2 Fancywp, Wordpress 2 Starter Templates, Wordpress 2025-06-27 9.6 Critical
Cross-Site Request Forgery (CSRF) vulnerability in FancyWP Starter Templates by FancyWP allows Cross Site Request Forgery. This issue affects Starter Templates by FancyWP: from n/a through 2.0.0.
CVE-2025-25107 2 Sainwp, Wordpress 2 Onestore Sites, Wordpress 2025-06-27 9.6 Critical
Cross-Site Request Forgery (CSRF) vulnerability in sainwp OneStore Sites allows Cross Site Request Forgery. This issue affects OneStore Sites: from n/a through 0.1.1.
CVE-2025-26916 2 Epc, Wordpress 2 Massive Dynamic Plugin, Wordpress 2025-06-27 9 Critical
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in EPC Massive Dynamic. This issue affects Massive Dynamic: from n/a through 8.2.
CVE-2025-26927 2 Epc, Wordpress 2 Ai Hub Plugin, Wordpress 2025-06-27 10 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in EPC AI Hub allows Upload a Web Shell to a Web Server. This issue affects AI Hub: from n/a through 1.3.3.
CVE-2025-46230 2 Ghozylab, Wordpress 2 Popup Builder, Wordpress 2025-06-27 7.5 High
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in GhozyLab Popup Builder allows PHP Local File Inclusion. This issue affects Popup Builder: from n/a through 1.1.35.
CVE-2025-46260 2 Wordpress, Wowdevs 2 Wordpress, Sky Addons For Elementor 2025-06-27 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wowDevs Sky Addons for Elementor allows Stored XSS. This issue affects Sky Addons for Elementor: from n/a through 3.0.1.
CVE-2025-46472 2 Webangon, Wordpress 2 The Pack Elementor Addons, Wordpress 2025-06-27 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webangon The Pack Elementor addons allows Stored XSS. This issue affects The Pack Elementor addons: from n/a through 2.1.2.
CVE-2025-46513 2 Codebangers, Wordpress 2 All In One Time Clock Lite, Wordpress 2025-06-27 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Codebangers All in One Time Clock Lite allows Cross Site Request Forgery. This issue affects All in One Time Clock Lite: from n/a through 1.3.324.
CVE-2025-5701 2 Siteheart, Wordpress 2 Hypercomments Plugin, Wordpress 2025-06-27 9.8 Critical
The HyperComments plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the hc_request_handler function in all versions up to, and including, 1.2.2. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
CVE-2025-3302 2 Wordpress, Xagio 2 Wordpress, Seo Ai Plugin 2025-06-27 7.2 High
The Xagio SEO – AI Powered SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘HTTP_REFERER’ parameter in all versions up to, and including, 7.1.0.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 7.1.0.0.
CVE-2025-47477 2 Revmakx, Wordpress 2 Backup And Staging By Wp Time Capsule, Wordpress 2025-06-27 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in revmakx Backup and Staging by WP Time Capsule allows Reflected XSS. This issue affects Backup and Staging by WP Time Capsule: from n/a through 1.22.23.