Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16,307

CVE-2026-22394

WordPress Evently theme <= 1.7 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Evently evently allows PHP Local File Inclusion.This issue affects Evently: from n/a through <= 1.7.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Mikado-themes Wordpress
Products
Evently Wordpress
CVE-2026-27370

WordPress Chaty plugin <= 3.5.1 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Premio Chaty chaty allows Retrieve Embedded Sensitive Data.This issue affects Chaty: from n/a through <= 3.5.1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Premio Wordpress
Products
Chaty Wordpress
CVE-2026-22434

WordPress Crown Art theme <= 1.2.11 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Crown Art crown-art allows PHP Local File Inclusion.This issue affects Crown Art: from n/a through <= 1.2.11.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Ancorathemes Wordpress
Products
Crown Art Wordpress
CVE-2026-27396

WordPress Directory Pro plugin <= 2.5.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in e-plugins Directory Pro directory-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Directory Pro: from n/a through <= 2.5.6.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
E-plugins Wordpress
Products
Directory Pro Wordpress
CVE-2026-27390

WordPress WeDesignTech Ultimate Booking Addon plugin <= 1.0.1 - Account Takeover vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in designthemes WeDesignTech Ultimate Booking Addon wedesigntech-ultimate-booking-addon allows Authentication Abuse.This issue affects WeDesignTech Ultimate Booking Addon: from n/a through <= 1.0.1.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Designthemes Wordpress
Products
Wedesigntech Ultimate Booking Addon Wordpress
CVE-2026-27384

WordPress W3 Total Cache plugin <= 2.9.1 - Arbitrary Code Execution vulnerability

Improper Validation of Specified Quantity in Input vulnerability in BoldGrid W3 Total Cache w3-total-cache allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects W3 Total Cache: from n/a through <= 2.9.1.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed
Vendors
Boldgrid Wordpress
Products
W3 Total Cache Wordpress
CVE-2026-27382

WordPress Metro theme <= 2.13 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RadiusTheme Metro metro allows DOM-Based XSS.This issue affects Metro: from n/a through <= 2.13.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Radiustheme Wordpress
Products
Metro Wordpress
CVE-2026-27376

WordPress Claue - Clean, Minimal Elementor WooCommerce Theme theme <= 2.2.7 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JanStudio Claue - Clean, Minimal Elementor WooCommerce Theme claue allows Reflected XSS.This issue affects Claue - Clean, Minimal Elementor WooCommerce Theme: from n/a through <= 2.2.7.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Janstudio Wordpress
Products
Claue - Clean, Minimal Elementor Woocommerce Theme Wordpress
CVE-2026-27361

WordPress Responsive Posts Carousel Pro plugin <= 15.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in WebCodingPlace Responsive Posts Carousel Pro responsive-posts-carousel-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Responsive Posts Carousel Pro: from n/a through <= 15.1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Webcodingplace Wordpress
Products
Responsive Posts Carousel Pro Wordpress
CVE-2026-27354

WordPress WooCommerce Coming Soon Product with Countdown plugin <= 5.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebCodingPlace WooCommerce Coming Soon Product with Countdown woo-coming-soon-product allows Stored XSS.This issue affects WooCommerce Coming Soon Product with Countdown: from n/a through <= 5.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Webcodingplace Wordpress
Products
Woocommerce Coming Soon Product With Countdown Wordpress
CVE-2026-3523

Apocalypse Meow <= 22.1.0 - Authenticated (Administrator+) SQL Injection via 'type' Parameter

The Apocalypse Meow plugin for WordPress is vulnerable to SQL Injection via the 'type' parameter in all versions up to, and including, 22.1.0. This is due to a flawed logical operator in the type validation check on line 261 of ajax.php — the condition uses `&&` (AND) instead of `||` (OR), causing the `in_array()` validation to be short-circuited and never evaluated for any non-empty type value. Combined with `stripslashes_deep()` being called on line 101 which removes `wp_magic_quotes()` protection, attacker-controlled single quotes pass through unescaped into the SQL query on line 298. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Blobfolio Wordpress
Products
Apocalypse Meow Wordpress
CVE-2026-27342

WordPress TopFit - Fitness and Gym WordPress Theme theme <= 1.9 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes TopFit - Fitness and Gym WordPress Theme topfit allows PHP Local File Inclusion.This issue affects TopFit - Fitness and Gym WordPress Theme: from n/a through <= 1.9.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Mikado-themes Wordpress
Products
Topfit - Fitness And Gym Wordpress Theme Wordpress
CVE-2026-27340

WordPress Apollo | Night Club, DJ Event WordPress Theme theme <= 1.3.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Apollo | Night Club, DJ Event WordPress Theme apollo allows PHP Local File Inclusion.This issue affects Apollo | Night Club, DJ Event WordPress Theme: from n/a through <= 1.3.1.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Ancorathemes Wordpress
Products
Apollo | Night Club, Dj Event Wordpress Theme Wordpress
CVE-2026-27338

WordPress Car Zone theme <= 3.7 - Deserialization of untrusted data vulnerability

Deserialization of Untrusted Data vulnerability in AivahThemes Car Zone carzone allows Object Injection.This issue affects Car Zone: from n/a through <= 3.7.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Aivahthemes Wordpress
Products
Car Zone Wordpress
CVE-2026-27336

WordPress Consultor | Consulting, Accounting & Legal Counsel WordPress Theme theme <= 1.2.4 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Consultor | Consulting, Accounting & Legal Counsel WordPress Theme consultor allows PHP Local File Inclusion.This issue affects Consultor | Consulting, Accounting & Legal Counsel WordPress Theme: from n/a through <= 1.2.4.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Ancorathemes Wordpress
Products
Consultor | Consulting, Accounting & Legal Counsel Wordpress Theme Wordpress
CVE-2026-27335

WordPress Ekoterra - NonProfit, Green Energy & Ecology Theme theme <= 1.0.0 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Ekoterra - NonProfit, Green Energy & Ecology Theme ekoterra allows PHP Local File Inclusion.This issue affects Ekoterra - NonProfit, Green Energy & Ecology Theme: from n/a through <= 1.0.0.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Ancorathemes Wordpress
Products
Ekoterra - Nonprofit, Green Energy & Ecology Theme Wordpress
CVE-2026-27334

WordPress Alchemists theme <= 4.6.0 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in dan_fisher Alchemists alchemists allows PHP Local File Inclusion.This issue affects Alchemists: from n/a through <= 4.6.0.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Dan Fisher Wordpress
Products
Alchemists Wordpress
CVE-2026-27326

WordPress AC Services | HVAC, Air Conditioning & Heating Company WordPress Theme theme <= 1.2.5 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes AC Services | HVAC, Air Conditioning & Heating Company WordPress Theme window-ac-services allows PHP Local File Inclusion.This issue affects AC Services | HVAC, Air Conditioning & Heating Company WordPress Theme: from n/a through <= 1.2.5.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Axiomthemes Wordpress
Products
Ac Services | Hvac, Air Conditioning & Heating Company Wordpress Theme Wordpress
CVE-2026-27098

WordPress Au Pair Agency - Babysitting & Nanny Theme theme <= 1.2.2 - Deserialization of untrusted data vulnerability

Deserialization of Untrusted Data vulnerability in axiomthemes Au Pair Agency - Babysitting & Nanny Theme au-pair-agency allows Object Injection.This issue affects Au Pair Agency - Babysitting & Nanny Theme: from n/a through <= 1.2.2.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Axiomthemes Wordpress
Products
Au Pair Agency - Babysitting & Nanny Theme Wordpress
CVE-2026-22385

WordPress Wolmart theme <= 1.9.6 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in don-themes Wolmart wolmart allows PHP Local File Inclusion.This issue affects Wolmart: from n/a through <= 1.9.6.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Don-themes Wordpress
Products
Wolmart Wordpress