Search vulnerabilities

Expected end of text, found 'öhme' (at char 15), (line:1, col:16)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,910

CVE-2026-56072

WordPress WoodMart theme <= 8.5.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WoodMart <= 8.5.3 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Wordpress Xtemos
Products
Wordpress Woodmart
CVE-2026-57312

WordPress Everest Forms plugin <= 3.4.8 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Everest Forms <= 3.4.8 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpeverest
Products
Wordpress Everest Forms
CVE-2026-57313

WordPress SureCart plugin <= 4.2.2 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in SureCart <= 4.2.2 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Surecart Wordpress
Products
Surecart Wordpress
CVE-2026-57319

WordPress FOX plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in FOX <= 1.4.8 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Realmag777 Wordpress
Products
Fox Wordpress
CVE-2026-57324

WordPress GIFT4U plugin <= 1.0.10 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in GIFT4U <= 1.0.10 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Villatheme Wordpress
Products
Gift4u Wordpress
CVE-2026-37454

MSI NBFoundation Service Insecure Permissions Enable Remote Information Disclosure via 3DES-ECB

Insecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 allows a remote attacker to obtain sensitive information via the 3DES-ECB encryption

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Msi
Products
Center Nbfoundation Service
CVE-2026-45256

Missing permission check in thr_kill2(2)

When used to deliver a signal to a specific thread, thr_kill2(2) called p_cansignal() to determine whether the operation was permitted but did not check the result before delivering the signal. The signal was sent even when the permission check failed. The system call returned the resulting error to the caller, but by then the signal had already been delivered. The missing check allows an unprivileged local user who knows or can guess a target's process and thread IDs to send any signal to a process they would not normally be permitted to signal, including processes owned by other users or by root. The same check enforces jail boundaries, so a jailed process can signal processes on the host or in other jails. Thread IDs are allocated globally and sequentially, and so can be discovered by brute force with no visibility into the target. An attacker can stop or terminate arbitrary processes, including critical system daemons, resulting in a Denial of Service (DoS).

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Freebsd
Products
Freebsd
CVE-2025-68052

WordPress Eagle Booking plugin <= 1.3.4.3 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in Eagle Booking <= 1.3.4.3 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Eagle-themes Wordpress
Products
Eagle Booking Wordpress
CVE-2026-57622

WordPress WPCafe plugin <= 3.0.14 - Broken Access Control vulnerability

Subscriber Broken Access Control in WPCafe <= 3.0.14 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Arraytics Wordpress
Products
Wpcafe Wordpress
CVE-2026-57634

WordPress PPWP plugin <= 1.9.19 - Insecure Direct Object References (IDOR) vulnerability

Contributor Insecure Direct Object References (IDOR) in PPWP <= 1.9.19 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress Wp Folio Team
Products
Wordpress Ppwp
CVE-2026-56044

WordPress Blog2Social plugin <= 8.9.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Blog2Social <= 8.9.2 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Adenion Wordpress
Products
Blog2social Wordpress
CVE-2026-56045

WordPress Automatic plugin < 3.135.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Automatic < 3.135.1 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Valvepress Wordpress
Products
Automatic Wordpress