Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16,394

CVE-2026-27359

WordPress Awa Plugins plugin <= 1.4.4 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fox-themes Awa Plugins awa-plugins allows Reflected XSS.This issue affects Awa Plugins: from n/a through <= 1.4.4.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Fox-themes Wordpress
Products
Awa Plugins Wordpress
CVE-2026-27373

WordPress Tablesome plugin <= 1.2.3 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Essekia Tablesome tablesome allows Blind SQL Injection.This issue affects Tablesome: from n/a through <= 1.2.3.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Essekia Wordpress
Products
Tablesome Wordpress
CVE-2026-22449

WordPress Don Peppe theme <= 1.3 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Don Peppe donpeppe allows PHP Local File Inclusion.This issue affects Don Peppe: from n/a through <= 1.3.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Select-themes Wordpress
Products
Don Peppe Wordpress
CVE-2026-22457

WordPress Wanderland theme <= 1.5 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Wanderland wanderland allows PHP Local File Inclusion.This issue affects Wanderland: from n/a through <= 1.5.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Mikado-themes Wordpress
Products
Wanderland Wordpress
CVE-2026-27379

WordPress NextScripts plugin <= 4.4.7 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in NextScripts NextScripts social-networks-auto-poster-facebook-twitter-g allows Object Injection.This issue affects NextScripts: from n/a through <= 4.4.7.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Nextscripts Wordpress
Products
Nextscripts Wordpress
CVE-2026-27381

WordPress Aora theme <= 1.3.15 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Aora aora allows PHP Local File Inclusion.This issue affects Aora: from n/a through <= 1.3.15.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Thembay Wordpress
Products
Aora Wordpress
CVE-2026-27383

WordPress Metro theme <= 2.13 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme Metro metro allows PHP Local File Inclusion.This issue affects Metro: from n/a through <= 2.13.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Radiustheme Wordpress
Products
Metro Wordpress
CVE-2026-27385

WordPress DesignThemes Portfolio plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Portfolio designthemes-portfolio allows Reflected XSS.This issue affects DesignThemes Portfolio: from n/a through <= 1.3.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Designthemes Wordpress
Products
Designthemes Portfolio Wordpress
CVE-2026-27388

WordPress DesignThemes Booking Manager plugin <= 2.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in designthemes DesignThemes Booking Manager designthemes-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DesignThemes Booking Manager: from n/a through <= 2.0.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Designthemes Wordpress
Products
Designthemes Booking Manager Wordpress
CVE-2026-27428

WordPress Eagle Booking plugin <= 1.3.4.3 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eagle-Themes Eagle Booking eagle-booking allows SQL Injection.This issue affects Eagle Booking: from n/a through <= 1.3.4.3.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Eagle-themes Wordpress
Products
Eagle Booking Wordpress
CVE-2026-27437

WordPress Tennis Club theme <= 1.2.3 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Tennis Club tennis-sportclub allows Object Injection.This issue affects Tennis Club: from n/a through <= 1.2.3.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Themerex Wordpress
Products
Tennis Club Wordpress
CVE-2026-27097

WordPress CasaMia | Property Rental Real Estate WordPress Theme theme <= 1.1.2 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes CasaMia | Property Rental Real Estate WordPress Theme casamia allows PHP Local File Inclusion.This issue affects CasaMia | Property Rental Real Estate WordPress Theme: from n/a through <= 1.1.2.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Ancorathemes Wordpress
Products
Casamia | Property Rental Real Estate Wordpress Theme Wordpress
CVE-2026-1980

WPBookit <= 1.0.8 - Missing Authorization to Unauthenticated Sensitive Customer Data Exposure

The WPBookit plugin for WordPress is vulnerable to unauthorized data disclosure due to a missing authorization check on the 'get_customer_list' route in all versions up to, and including, 1.0.8. This makes it possible for unauthenticated attackers to retrieve sensitive customer information including names, emails, phone numbers, dates of birth, and gender.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Iqonicdesign Wordpress
Products
Wpbookit Wordpress
CVE-2026-1651

Email Subscribers & Newsletters <= 5.9.16 - Authenticated (Administrator+) SQL Injection via 'workflow_ids' Parameter

The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the 'workflow_ids' parameter in all versions up to, and including, 5.9.16 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Icegram Wordpress
Products
Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin For Wordpress Wordpress
CVE-2026-28014

WordPress Translogic theme <= 1.2.11 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Translogic translogic allows PHP Local File Inclusion.This issue affects Translogic: from n/a through <= 1.2.11.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Themerex Wordpress
Products
Translogic Wordpress
CVE-2026-2568

WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.5 - Unauthenticated Stored Cross-Site Scripting

The WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission data in all versions up to, and including, 1.1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Crmperks Wordpress
Products
Wp Zendesk For Contact Form 7, Wpforms, Elementor, Formidable And Ninja Forms Wordpress
CVE-2026-28020

WordPress Chroma theme <= 1.11 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Chroma chroma allows PHP Local File Inclusion.This issue affects Chroma: from n/a through <= 1.11.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Themerex Wordpress
Products
Chroma Wordpress
CVE-2025-11891

Shelf Planner <= 2.8.1 - Unauthenticated Information Exposure via Log Files

The Shelf Planner plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.1 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed log files.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2025-12087

Wishlist and Save for later for Woocommerce <= 1.1.22 - Insecure Direct Object Reference to Authenticated (Subscriber+) Wishlist Item Deletion

The Wishlist and Save for later for Woocommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.22 via the 'awwlm_remove_added_wishlist_page' AJAX action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete wishlist items from other user's wishlists.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Acowebs Wordpress
Products
Wishlist And Save For Later For Woocommerce Wordpress
CVE-2025-12366

Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.5 - Authenticated (Author+) Insecure Direct Object Reference

The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.5 via the pagelayer_replace_page function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to replace media files belonging to other users, including administrators.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Softaculous Wordpress
Products
Page Builder Pagelayer Wordpress