Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16,307

CVE-2026-25322

WordPress PublishPress Revisions plugin <= 3.7.22 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in PublishPress PublishPress Revisions revisionary allows Cross Site Request Forgery.This issue affects PublishPress Revisions: from n/a through <= 3.7.22.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Publishpress Wordpress
Products
Publishpress Revisions Wordpress
CVE-2026-25323

WordPress OSM plugin <= 6.1.12 - Broken Access Control vulnerability

Missing Authorization vulnerability in MiKa OSM osm allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects OSM: from n/a through <= 6.1.12.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mika Wordpress
Products
Osm Wordpress
CVE-2026-25329

WordPress Quiz And Survey Master plugin <= 10.3.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through <= 10.3.4.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Expresstech Wordpress
Products
Quiz And Survey Master Wordpress
CVE-2026-25330

WordPress PublishPress Authors plugin <= 4.10.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in PublishPress PublishPress Authors publishpress-authors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PublishPress Authors: from n/a through <= 4.10.1.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Publishpress Wordpress
Products
Publishpress Authors Wordpress
CVE-2026-25331

WordPress WP Activity Log plugin <= 5.5.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log wp-security-audit-log allows DOM-Based XSS.This issue affects WP Activity Log: from n/a through <= 5.5.4.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Melapress Wordpress
Products
Wp Activity Log Wordpress
CVE-2026-25332

WordPress Endless Posts Navigation plugin <= 2.2.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in Fahad Mahmood Endless Posts Navigation endless-posts-navigation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Endless Posts Navigation: from n/a through <= 2.2.9.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Fahad Mahmood Wordpress
Products
Endless Posts Navigation Wordpress
CVE-2026-25335

WordPress Secure Copy Content Protection and Content Locking plugin <= 5.0.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Ays Pro Secure Copy Content Protection and Content Locking secure-copy-content-protection allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Secure Copy Content Protection and Content Locking: from n/a through <= 5.0.0.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ays-pro Wordpress
Products
Secure Copy Content Protection And Content Locking Wordpress
CVE-2026-25338

WordPress AI ChatBot with ChatGPT and Content Generator by AYS plugin <= 2.7.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in Ays Pro AI ChatBot with ChatGPT and Content Generator by AYS ays-chatgpt-assistant allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI ChatBot with ChatGPT and Content Generator by AYS: from n/a through <= 2.7.4.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ays Pro Wordpress
Products
Ai Chatbot With Chatgpt And Content Generator By Ays Wordpress
CVE-2026-25343

WordPress WP SMS plugin <= 7.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP SMS wp-sms allows DOM-Based XSS.This issue affects WP SMS: from n/a through <= 7.1.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Veronalabs Wordpress
Products
Wp Sms Wordpress
CVE-2026-25348

WordPress Download Alt Text AI plugin <= 1.10.15 - Broken Access Control vulnerability

Missing Authorization vulnerability in alttextai Download Alt Text AI alttext-ai allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Alt Text AI: from n/a through <= 1.10.15.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Alttextai Wordpress
Products
Download Alt Text Ai Wordpress
CVE-2026-25362

WordPress FooGallery plugin <= 3.1.11 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FooPlugins FooGallery foogallery allows Stored XSS.This issue affects FooGallery: from n/a through <= 3.1.11.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Fooplugins Wordpress
Products
Foogallery Wordpress
CVE-2026-25363

WordPress FooGallery plugin <= 3.1.11 - Broken Access Control vulnerability

Missing Authorization vulnerability in FooPlugins FooGallery foogallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FooGallery: from n/a through <= 3.1.11.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Fooplugins Wordpress
Products
Foogallery Wordpress
CVE-2026-25364

WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.8.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Boldgrid Wordpress
Products
Client Invoicing By Sprout Invoices Wordpress
CVE-2026-25367

WordPress CitiLights theme < 3.7.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in NooTheme CitiLights noo-citilights allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CitiLights: from n/a through < 3.7.2.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Nootheme Wordpress
Products
Citilights Wordpress
CVE-2026-25368

WordPress Calculated Fields Form plugin <= 5.4.4.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in codepeople Calculated Fields Form calculated-fields-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Calculated Fields Form: from n/a through <= 5.4.4.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Codepeople Wordpress
Products
Calculated Fields Form Wordpress
CVE-2026-25372

WordPress Academy LMS plugin <= 3.5.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Kodezen LLC Academy LMS academy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Academy LMS: from n/a through <= 3.5.3.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Kodezen Wordpress
Products
Academy Lms Wordpress
CVE-2026-25374

WordPress Spa and Salon theme <= 1.3.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in raratheme Spa and Salon spa-and-salon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spa and Salon: from n/a through <= 1.3.2.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Rarathemes Wordpress
Products
Spa And Salon Wordpress
CVE-2026-25375

WordPress Image Photo Gallery Final Tiles Grid plugin <= 3.6.10 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP Chill Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Photo Gallery Final Tiles Grid: from n/a through <= 3.6.10.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpchill
Products
Wordpress Image Photo Gallery Final Tiles Grid
CVE-2026-25384

WordPress WP-Lister Lite for eBay plugin <= 3.8.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP Lab WP-Lister Lite for eBay wp-lister-for-ebay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-Lister Lite for eBay: from n/a through <= 3.8.5.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress Wplab
Products
Wordpress Wp-lister Lite For Ebay
CVE-2026-25389

WordPress EventPrime plugin <= 4.2.8.3 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Retrieve Embedded Sensitive Data.This issue affects EventPrime: from n/a through <= 4.2.8.3.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Metagauss Wordpress
Products
Eventprime Wordpress