Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16,394

CVE-2026-1071

Carta Online <= 2.13.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings

The Carta Online plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.13.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Cartaonline Wordpress
Products
Carta Online Wordpress
CVE-2026-28102

WordPress UberSlider Classic plugin <= 2.5 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup UberSlider Classic uberSlider_classic allows Reflected XSS.This issue affects UberSlider Classic: from n/a through <= 2.5.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Lambertgroup Wordpress
Products
Uberslider Classic Wordpress
CVE-2026-28128

WordPress Verse theme <= 1.7.0 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Verse verse allows PHP Local File Inclusion.This issue affects Verse: from n/a through <= 1.7.0.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Themerex Wordpress
Products
Verse Wordpress
CVE-2026-28137

WordPress MediCenter - Health Medical Clinic WordPress Theme theme <= 14.9 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuanticaLabs MediCenter - Health Medical Clinic medicenter allows Reflected XSS.This issue affects MediCenter - Health Medical Clinic: from n/a through <= 14.9.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Quanticalabs Wordpress
Products
Medicenter - Health Medical Clinic Wordpress
CVE-2026-28037

WordPress EventON plugin <= 4.9.12 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ashanjay EventON eventon allows Reflected XSS.This issue affects EventON: from n/a through <= 4.9.12.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Ashanjay Wordpress
Products
Eventon Wordpress
CVE-2026-28060

WordPress S.King theme <= 1.5.3 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX S.King stephanie-king allows PHP Local File Inclusion.This issue affects S.King: from n/a through <= 1.5.3.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Themerex Wordpress
Products
S.king Wordpress
CVE-2026-28047

WordPress Victo theme <= 1.4.16 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magentech Victo victo allows PHP Local File Inclusion.This issue affects Victo: from n/a through <= 1.4.16.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Magentech Wordpress
Products
Victo Wordpress
CVE-2026-3072

Media Library Assistant <= 3.33 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Taxonomy Modification

The Media Library Assistant plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the mla_update_compat_fields_action() function in all versions up to, and including, 3.33. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify taxonomy terms on arbitrary attachments.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Davidlingren Wordpress
Products
Media Library Assistant Wordpress
CVE-2026-28109

WordPress LambertGroup - AllInOne - Content Slider plugin <= 3.8 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup LambertGroup - AllInOne - Content Slider all-in-one-contentSlider allows Reflected XSS.This issue affects LambertGroup - AllInOne - Content Slider: from n/a through <= 3.8.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Lambertgroup Wordpress
Products
Lambertgroup - Allinone - Content Slider Wordpress
CVE-2026-28115

WordPress WP Attractive Donations System - Easy Stripe & Paypal donations plugin <= 1.25 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in loopus WP Attractive Donations System - Easy Stripe & Paypal donations WP_AttractiveDonationsSystem allows Blind SQL Injection.This issue affects WP Attractive Donations System - Easy Stripe & Paypal donations: from n/a through <= 1.25.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Loopus Wordpress
Products
Wp Attractive Donations System - Easy Stripe & Paypal Donations Wordpress
CVE-2026-2830

WP All Import <= 4.0.0 - Reflected Cross-Site Scripting via 'filepath'

The WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘filepath’ parameter in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpallimport
Products
Wordpress Wp All Import – Drag & Drop Import For Csv, Xml, Excel & Google Sheets
CVE-2026-28117

WordPress smart SEO theme <= 2.9 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes smart SEO smartSEO allows PHP Local File Inclusion.This issue affects smart SEO: from n/a through <= 2.9.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Axiomthemes Wordpress
Products
Smart Seo Wordpress
CVE-2026-28028

WordPress MoneyFlow theme <= 1.0 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX MoneyFlow moneyflow allows PHP Local File Inclusion.This issue affects MoneyFlow: from n/a through <= 1.0.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Themerex Wordpress
Products
Moneyflow Wordpress
CVE-2026-28066

WordPress Legrand theme <= 2.17 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Legrand legrand allows PHP Local File Inclusion.This issue affects Legrand: from n/a through <= 2.17.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Themerex Wordpress
Products
Legrand Wordpress
CVE-2026-3222

WP Maps <= 4.9.1 - Unauthenticated SQL Injection via 'location_id' Parameter

The WP Maps plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'location_id' parameter in all versions up to, and including, 4.9.1. This is due to the plugin's database abstraction layer (`FlipperCode_Model_Base::is_column()`) treating user input wrapped in backticks as column names, bypassing the `esc_sql()` escaping function. Additionally, the `wpgmp_ajax_call` AJAX handler (registered for unauthenticated users via `wp_ajax_nopriv`) allows calling arbitrary class methods including `wpgmp_return_final_capability`, which passes the unsanitized `location_id` GET parameter directly to a database query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Flippercode Wordpress
Products
Wp Maps – Store Locator,google Maps,openstreetmap,mapbox,listing,directory & Filters Wordpress
CVE-2026-1085

True Ranker <= 2.2.9 - Cross-Site Request Forgery to Unauthorized True Ranker Disconnection

The True Ranker plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.9. This is due to missing nonce validation on the seolocalrank-signout action. This makes it possible for unauthenticated attackers to disconnect the administrator's True Ranker account via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Optimizza Wordpress
Products
True Ranker Wordpress
CVE-2026-28114

WordPress WooCommerce License Manager plugin <= 7.0.6 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in firassaidi WooCommerce License Manager fs-license-manager allows Upload a Web Shell to a Web Server.This issue affects WooCommerce License Manager: from n/a through <= 7.0.6.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Firassaidi Wordpress
Products
Woocommerce License Manager Wordpress
CVE-2026-2324

LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.7 - Cross-Site Request Forgery in Booking Form Settings Update to Stored Cross-Site Scripting

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.2.7. This is due to missing or incorrect nonce validation on the reload_preview() function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Latepoint Wordpress
Products
Latepoint – Calendar Booking Plugin For Appointments And Events Wordpress
CVE-2026-28094

WordPress RexCoin theme <= 1.2.6 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX RexCoin rexcoin allows PHP Local File Inclusion.This issue affects RexCoin: from n/a through <= 1.2.6.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Themerex Wordpress
Products
Rexcoin Wordpress
CVE-2026-28100

WordPress UberSlider PerpetuumMobile plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup UberSlider PerpetuumMobile uberSlider_perpetuummobile allows Reflected XSS.This issue affects UberSlider PerpetuumMobile: from n/a through <= 2.3.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Lambertgroup Wordpress
Products
Uberslider Perpetuummobile Wordpress