Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16,394

CVE-2026-28126

WordPress RH Frontend Publishing Pro plugin < 4.3.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sizam RH Frontend Publishing Pro rh-frontend allows Reflected XSS.This issue affects RH Frontend Publishing Pro: from n/a through < 4.3.4.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Sizam Wordpress
Products
Rh Frontend Publishing Pro Wordpress
CVE-2026-28125

WordPress Midi theme <= 1.14 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Midi midi allows PHP Local File Inclusion.This issue affects Midi: from n/a through <= 1.14.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Ancorathemes Wordpress
Products
Midi Wordpress
CVE-2026-28124

WordPress Notarius theme <= 1.9 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Notarius notarius allows PHP Local File Inclusion.This issue affects Notarius: from n/a through <= 1.9.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Ancorathemes Wordpress
Products
Notarius Wordpress
CVE-2026-28122

WordPress ListingPro plugin <= 2.9.8 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CridioStudio ListingPro listingpro-plugin allows Reflected XSS.This issue affects ListingPro: from n/a through <= 2.9.8.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Cridio Wordpress
Products
Listingpro Wordpress
CVE-2026-28121

WordPress Anderson theme <= 1.4.2 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Anderson andersonclinic allows PHP Local File Inclusion.This issue affects Anderson: from n/a through <= 1.4.2.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Ancorathemes Wordpress
Products
Anderson Wordpress
CVE-2026-28120

WordPress Dr.Patterson theme <= 1.3.2 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Dr.Patterson dr-patterson allows PHP Local File Inclusion.This issue affects Dr.Patterson: from n/a through <= 1.3.2.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Themerex Wordpress
Products
Dr.patterson Wordpress
CVE-2026-28118

WordPress Welldone theme <= 2.4 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Welldone welldone allows PHP Local File Inclusion.This issue affects Welldone: from n/a through <= 2.4.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Axiomthemes Wordpress
Products
Welldone Wordpress
CVE-2026-28115

WordPress WP Attractive Donations System - Easy Stripe & Paypal donations plugin <= 1.25 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in loopus WP Attractive Donations System - Easy Stripe & Paypal donations WP_AttractiveDonationsSystem allows Blind SQL Injection.This issue affects WP Attractive Donations System - Easy Stripe & Paypal donations: from n/a through <= 1.25.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Loopus Wordpress
Products
Wp Attractive Donations System - Easy Stripe & Paypal Donations Wordpress
CVE-2026-28112

WordPress AllInOne - Banner Rotator plugin <= 3.8 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup AllInOne - Banner Rotator all-in-one-bannerRotator allows Reflected XSS.This issue affects AllInOne - Banner Rotator: from n/a through <= 3.8.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Lambertgroup Wordpress
Products
Allinone - Banner Rotator Wordpress
CVE-2026-28110

WordPress LambertGroup - AllInOne - Banner with Playlist plugin <= 3.8 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup LambertGroup - AllInOne - Banner with Playlist all-in-one-bannerWithPlaylist allows Reflected XSS.This issue affects LambertGroup - AllInOne - Banner with Playlist: from n/a through <= 3.8.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Lambertgroup Wordpress
Products
Lambertgroup - Allinone - Banner With Playlist Wordpress
CVE-2026-28109

WordPress LambertGroup - AllInOne - Content Slider plugin <= 3.8 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup LambertGroup - AllInOne - Content Slider all-in-one-contentSlider allows Reflected XSS.This issue affects LambertGroup - AllInOne - Content Slider: from n/a through <= 3.8.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Lambertgroup Wordpress
Products
Lambertgroup - Allinone - Content Slider Wordpress
CVE-2026-28108

WordPress LambertGroup - AllInOne - Banner with Thumbnails plugin <= 3.8 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup LambertGroup - AllInOne - Banner with Thumbnails all-in-one-thumbnailsBanner allows Reflected XSS.This issue affects LambertGroup - AllInOne - Banner with Thumbnails: from n/a through <= 3.8.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Lambertgroup Wordpress
Products
Lambertgroup - Allinone - Banner With Thumbnails Wordpress
CVE-2026-28104

WordPress Site Suggest plugin <= 1.3.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in Aryan Shirani Bid Abadi Site Suggest site-suggest allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Site Suggest: from n/a through <= 1.3.9.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Aryan Shirani Bid Abadi Wordpress
Products
Site Suggest Wordpress
CVE-2026-28102

WordPress UberSlider Classic plugin <= 2.5 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup UberSlider Classic uberSlider_classic allows Reflected XSS.This issue affects UberSlider Classic: from n/a through <= 2.5.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Lambertgroup Wordpress
Products
Uberslider Classic Wordpress
CVE-2026-28101

WordPress UberSlider MouseInteraction plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup UberSlider MouseInteraction uberSlider_mouseinteraction allows Reflected XSS.This issue affects UberSlider MouseInteraction: from n/a through <= 2.3.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Lambertgroup Wordpress
Products
Uberslider Mouseinteraction Wordpress
CVE-2026-28099

WordPress UberSlider Ultra plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup UberSlider Ultra uberSlider_ultra allows Reflected XSS.This issue affects UberSlider Ultra: from n/a through <= 2.3.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Lambertgroup Wordpress
Products
Uberslider Ultra Wordpress
CVE-2026-28098

WordPress Save Life theme <= 1.2.13 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Save Life save-life allows PHP Local File Inclusion.This issue affects Save Life: from n/a through <= 1.2.13.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Themerex Wordpress
Products
Save Life Wordpress
CVE-2026-28097

WordPress Artrium theme <= 1.0.14 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Artrium artrium allows PHP Local File Inclusion.This issue affects Artrium: from n/a through <= 1.0.14.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Themerex Wordpress
Products
Artrium Wordpress
CVE-2026-28096

WordPress WealthCo theme <= 2.18 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX WealthCo wealthco allows PHP Local File Inclusion.This issue affects WealthCo: from n/a through <= 2.18.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Themerex Wordpress
Products
Wealthco Wordpress
CVE-2026-28092

WordPress Sounder theme <= 1.3.11 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Sounder sounder allows PHP Local File Inclusion.This issue affects Sounder: from n/a through <= 1.3.11.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Themerex Wordpress
Products
Sounder Wordpress