Search vulnerabilities

Expected end of text, found ':' (at char 27), (line:1, col:28)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,850

CVE-2026-9597

Deactivated guest accounts can authenticate via magic-link token in Mattermost REST API login endpoint

Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4 fail to verify whether a guest account is deactivated before creating a session in the magic-link token login path, which allows a deactivated guest user to obtain a fully functional session via a magic-link token issued prior to deactivation.. Mattermost Advisory ID: MMSA-2026-00681

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Server
CVE-2026-57745

WordPress RT-Theme 18 | Extensions plugin <= 2.5 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows Reflected XSS.This issue affects RT-Theme 18 | Extensions: from n/a through <= 2.5.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Stmcan Wordpress
Products
Rt-theme 18 | Extensions Wordpress
CVE-2026-57738

WordPress 777 theme <= 1.13.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in axiomthemes 777 triple-seven allows Object Injection.This issue affects 777: from n/a through <= 1.13.0.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Axiomthemes Wordpress
Products
777 Wordpress
CVE-2026-57385

WordPress Vitepos plugin <= 3.4.2 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in appsbd Vitepos vitepos-lite allows Blind SQL Injection.This issue affects Vitepos: from n/a through <= 3.4.2.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Appsbd Wordpress
Products
Vitepos Wordpress
CVE-2026-57363

WordPress ChatBot plugin <= 8.3.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuantumCloud ChatBot chatbot allows Stored XSS.This issue affects ChatBot: from n/a through <= 8.3.7.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Quantumcloud Wordpress
Products
Chatbot Wordpress
CVE-2026-57372

WordPress WPJAM Basic plugin <= 7.0 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery (SSRF) vulnerability in denishua WPJAM Basic wpjam-basic allows Server Side Request Forgery.This issue affects WPJAM Basic: from n/a through <= 7.0.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Denishua Wordpress
Products
Wpjam Basic Wordpress
CVE-2026-57709

WordPress Membership For WooCommerce plugin <= 3.1.0 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP Swings Membership For WooCommerce membership-for-woocommerce allows Path Traversal.This issue affects Membership For WooCommerce: from n/a through <= 3.1.0.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpswings
Products
Wordpress Membership For Woocommerce
CVE-2026-57698

WordPress Abandoned Cart Recovery for WooCommerce plugin <= 1.1.12 - Broken Authentication vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in VillaTheme Abandoned Cart Recovery for WooCommerce woo-abandoned-cart-recovery allows Authentication Abuse.This issue affects Abandoned Cart Recovery for WooCommerce: from n/a through <= 1.1.12.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Villatheme Wordpress
Products
Abandoned Cart Recovery For Woocommerce Wordpress
CVE-2026-57668

WordPress NEX-Forms plugin <= 9.2.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms nex-forms-express-wp-form-builder allows Stored XSS.This issue affects NEX-Forms: from n/a through <= 9.2.2.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-57419

WordPress Stock Locations for WooCommerce plugin <= 3.1.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in Fahad Mahmood Stock Locations for WooCommerce stock-locations-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stock Locations for WooCommerce: from n/a through <= 3.1.8.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fahadmahmood8 Wordpress
Products
Stock Locations For Woocommerce Wordpress
CVE-2026-57388

WordPress Hydra Booking plugin <= 1.1.44 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Hydra Booking hydra-booking allows Stored XSS.This issue affects Hydra Booking: from n/a through <= 1.1.44.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Themefic Wordpress
Products
Hydra Booking Wordpress
CVE-2026-57381

WordPress PropertyHive plugin <= 2.2.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Property Hive PropertyHive propertyhive allows Reflected XSS.This issue affects PropertyHive: from n/a through <= 2.2.3.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Propertyhive Wordpress
Products
Propertyhive Wordpress
CVE-2026-57401

WordPress SureDash plugin <= 1.8.0 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Brainstorm Force SureDash suredash allows Path Traversal.This issue affects SureDash: from n/a through <= 1.8.0.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Brainstorm Force Wordpress
Products
Suredash Wordpress
CVE-2026-57375

WordPress MStore API plugin <= 4.18.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in FluxBuilder MStore API mstore-api allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MStore API: from n/a through <= 4.18.4.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fluxbuilder Wordpress
Products
Mstore Api Wordpress
CVE-2026-57398

WordPress Real Estate Manager Pro plugin <= 12.8.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebCodingPlace Real Estate Manager Pro real-estate-manager-pro allows Reflected XSS.This issue affects Real Estate Manager Pro: from n/a through <= 12.8.3.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-57773

WordPress Advanced Shipment Tracking for WooCommerce plugin <= 4.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Zorem Advanced Shipment Tracking for WooCommerce woo-advanced-shipment-tracking allows Blind SQL Injection.This issue affects Advanced Shipment Tracking for WooCommerce: from n/a through <= 4.0.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Wordpress Zorem
Products
Wordpress Advanced Shipment Tracking For Woocommerce
CVE-2026-57410

WordPress MailerPress plugin <= 2.0.2 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in MailerPress Team MailerPress mailerpress allows Privilege Escalation.This issue affects MailerPress: from n/a through <= 2.0.2.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Mailerpress Team Wordpress
Products
Mailerpress Wordpress
CVE-2026-57380

WordPress Extensions for Leaflet Map plugin <= 5.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hupe13 Extensions for Leaflet Map extensions-leaflet-map allows DOM-Based XSS.This issue affects Extensions for Leaflet Map: from n/a through <= 5.1.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Hupe13 Wordpress
Products
Extensions For Leaflet Map Wordpress
CVE-2026-57416

WordPress SiteGround Email Marketing plugin <= 1.7.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SiteGround SiteGround Email Marketing siteground-email-marketing allows Stored XSS.This issue affects SiteGround Email Marketing: from n/a through <= 1.7.5.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Siteground Wordpress
Products
Email-marketing Wordpress
CVE-2026-57422

WordPress Bopo – WooCommerce Product Bundle Builder plugin <= 1.2.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Bopo – WooCommerce Product Bundle Builder bopo-woo-product-bundle-builder allows Reflected XSS.This issue affects Bopo – WooCommerce Product Bundle Builder: from n/a through <= 1.2.0.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Villatheme Wordpress
Products
Bopo – Woocommerce Product Bundle Builder Wordpress