Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16,394

CVE-2026-32360

WordPress Rich Showcase for Google Reviews plugin <= 6.9.4.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in richplugins Rich Showcase for Google Reviews widget-google-reviews allows Stored XSS.This issue affects Rich Showcase for Google Reviews: from n/a through <= 6.9.4.3.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Richplugins Wordpress
Products
Rich Showcase For Google Reviews Wordpress
CVE-2026-32362

WordPress WP Sessions Time Monitoring Full Automatic plugin <= 1.1.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in activity-log.com WP Sessions Time Monitoring Full Automatic activitytime allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Sessions Time Monitoring Full Automatic: from n/a through <= 1.1.3.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Activity-log.com Wordpress
Products
Wp Sessions Time Monitoring Full Automatic Wordpress
CVE-2026-32363

WordPress WPLifeCycle plugin <= 3.3.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Funlus Oy WPLifeCycle free-php-version-info allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPLifeCycle: from n/a through <= 3.3.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Funlus Oy Wordpress
Products
Wplifecycle Wordpress
CVE-2026-32365

WordPress Collapsing Archives plugin <= 3.0.7 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in robfelty Collapsing Archives collapsing-archives allows Blind SQL Injection.This issue affects Collapsing Archives: from n/a through <= 3.0.7.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Robfelty Wordpress
Products
Collapsing Archives Wordpress
CVE-2026-32370

WordPress Influencer theme <= 1.1.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in raratheme Influencer influencer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Influencer: from n/a through <= 1.1.7.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Raratheme Wordpress
Products
Influencer Wordpress
CVE-2026-32374

WordPress The Minimal theme <= 1.2.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in raratheme The Minimal the-minimal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Minimal: from n/a through <= 1.2.9.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Raratheme Wordpress
Products
The Minimal Wordpress
CVE-2026-32457

WordPress Advanced Product Fields (Product Addons) for WooCommerce plugin <= 1.6.18 - Broken Access Control vulnerability

Missing Authorization vulnerability in Wombat Plugins Advanced Product Fields (Product Addons) for WooCommerce advanced-product-fields-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Product Fields (Product Addons) for WooCommerce: from n/a through <= 1.6.18.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wombat Plugins Wordpress
Products
Advanced Product Fields Product Addons For Woocommerce Wordpress
CVE-2026-32380

WordPress Numinous theme <= 1.3.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in raratheme Numinous numinous allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Numinous: from n/a through <= 1.3.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Raratheme Wordpress
Products
Numinous Wordpress
CVE-2026-32543

WordPress Responsive Blocks plugin <= 2.2.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in CyberChimps Responsive Blocks responsive-block-editor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Responsive Blocks: from n/a through <= 2.2.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Cyberchimps Wordpress
Products
Responsive Blocks Wordpress
CVE-2026-32455

WordPress MDTF plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter allows DOM-Based XSS.This issue affects MDTF: from n/a through <= 1.3.5.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Realmag777 Wordpress
Products
Mdtf Wordpress
CVE-2026-32462

WordPress Master Addons for Elementor plugin <= 2.1.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liton Arefin Master Addons for Elementor master-addons allows DOM-Based XSS.This issue affects Master Addons for Elementor: from n/a through <= 2.1.3.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Liton Arefin Wordpress
Products
Master Addons For Elementor Wordpress
CVE-2026-32454

WordPress Avada Core plugin < 5.15.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeFusion Avada Core fusion-core allows DOM-Based XSS.This issue affects Avada Core: from n/a through < 5.15.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Theme-fusion Wordpress
Products
Avada Wordpress
CVE-2026-32453

WordPress Avada Core plugin < 5.15.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in ThemeFusion Avada Core fusion-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Avada Core: from n/a through < 5.15.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Theme-fusion Wordpress
Products
Avada Wordpress
CVE-2026-32452

WordPress Fusion Builder plugin < 3.15.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in ThemeFusion Fusion Builder fusion-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fusion Builder: from n/a through < 3.15.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Themefusion Wordpress
Products
Fusion Builder Wordpress
CVE-2026-32440

WordPress WP Food plugin < 2.7.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Ex-Themes WP Food wp-food allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Food: from n/a through < 2.7.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ex-themes Wordpress
Products
Wp Food Wordpress
CVE-2026-32439

WordPress BigHearts theme <= 3.1.14 - Broken Access Control vulnerability

Missing Authorization vulnerability in WebGeniusLab BigHearts bighearts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BigHearts: from n/a through <= 3.1.14.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Webgeniuslab Wordpress
Products
Bighearts Wordpress
CVE-2026-32430

WordPress PowerPack Addons for Elementor plugin <= 2.9.9 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Stored XSS.This issue affects PowerPack Addons for Elementor: from n/a through <= 2.9.9.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Ideabox Wordpress
Products
Powerpack Addons For Elementor Wordpress
CVE-2026-32425

WordPress Payment Gateway Pix For GiveWP plugin <= 2.2.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in linknacional Payment Gateway Pix For GiveWP payment-gateway-pix-for-givewp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payment Gateway Pix For GiveWP: from n/a through <= 2.2.3.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Linknacional Wordpress
Products
Payment Gateway Pix For Givewp Wordpress
CVE-2026-32420

WordPress GamiPress plugin <= 7.6.6 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Ruben Garcia GamiPress gamipress allows Cross Site Request Forgery.This issue affects GamiPress: from n/a through <= 7.6.6.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Ruben Garcia Wordpress
Products
Gamipress Wordpress
CVE-2026-32446

WordPress Contact Form by WPForms plugin <= 1.9.9.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form by WPForms: from n/a through <= 1.9.9.3.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Syed Balkhi Wordpress
Products
Contact Form By Wpforms Wordpress