Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (20782 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2023-28660 1 E-dynamics 1 Events Made Easy 2025-02-25 8.8 High
The Events Made Easy WordPress Plugin, version <= 2.3.14 is affected by an authenticated SQL injection vulnerability in the 'search_name' parameter in the eme_recurrences_list action.
CVE-2023-28661 1 Accesspressthemes 1 Wp Popup Banners 2025-02-25 8.8 High
The WP Popup Banners WordPress Plugin, version <= 1.2.5, is affected by an authenticated SQL injection vulnerability in the 'value' parameter in the get_popup_data action.
CVE-2022-36284 1 Storeapps 1 Affiliate For Woocommerce 2025-02-20 6.4 Medium
Authenticated IDOR vulnerability in StoreApps Affiliate For WooCommerce premium plugin <= 4.7.0 at WordPress allows an attacker to change the PayPal email. WooCommerce PayPal Payments plugin (free) should be at least installed to get the extra input field on the user profile page.
CVE-2022-35235 1 Xplodedthemes 1 Wpide - File Manager \& Code Editor 2025-02-20 4.9 Medium
Authenticated (admin+) Arbitrary File Read vulnerability in XplodedThemes WPide plugin <= 2.6 at WordPress.
CVE-2022-34154 1 Ideastocode 1 Enable Svg\, Webp \& Ico Upload 2025-02-20 7.2 High
Authenticated (author or higher user role) Arbitrary File Upload vulnerability in ideasToCode Enable SVG, WebP & ICO Upload plugin <= 1.0.1 at WordPress.
CVE-2022-33901 1 Multisafepay 1 Multisafepay Plugin For Woocommerce 2025-02-20 5.3 Medium
Unauthenticated Arbitrary File Read vulnerability in MultiSafepay plugin for WooCommerce plugin <= 4.13.1 at WordPress.
CVE-2022-33142 1 Wordplus 1 Better Messages 2025-02-20 7.7 High
Authenticated (subscriber+) Denial Of Service (DoS) vulnerability in WordPlus WordPress Better Messages plugin <= 1.9.10.57 at WordPress.
CVE-2022-31475 1 Givewp 1 Givewp 2025-02-20 5.5 Medium
Authenticated (custom plugin role) Arbitrary File Read via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress.
CVE-2022-29447 1 Wow-company 1 Hover Effects 2025-02-20 6.8 Medium
Authenticated (administrator or higher user role) Local File Inclusion (LFI) vulnerability in Wow-Company's Hover Effects plugin <= 2.1 at WordPress.
CVE-2022-29446 1 Wow-company 1 Counter Box 2025-02-20 6.8 Medium
Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company's Counter Box plugin <= 1.1.1 at WordPress.
CVE-2022-29445 1 Wow-estore 1 Popup Box 2025-02-20 6.8 Medium
Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company's Popup Box plugin <= 2.1.2 at WordPress.
CVE-2022-29434 1 Spiffyplugins 1 Spiffy Calendar 2025-02-20 6.3 Medium
Insecure Direct Object References (IDOR) vulnerability in Spiffy Plugins Spiffy Calendar <= 4.9.0 at WordPress allows an attacker to edit or delete events.
CVE-2022-28700 1 Givewp 1 Givewp 2025-02-20 9.1 Critical
Authenticated Arbitrary File Creation via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress.
CVE-2022-23979 1 Etoilewebdesign 1 Ultimate Reviews 2025-02-20 4.8 Medium
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability discovered in Ultimate Reviews WordPress plugin (versions <= 3.0.15).
CVE-2021-31567 1 Wpchill 1 Download Monitor 2025-02-20 6.8 Medium
Authenticated (admin+) Arbitrary File Download vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6). The plugin allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded via the &downloadable_file_urls[0] parameter data. It's also possible to escape from the web server home directory and download any file within the OS.
CVE-2021-36920 1 Wpchill 1 Download Monitor 2025-02-20 4.8 Medium
Authenticated Reflected Cross-Site Scripting (XSS) vulnerability discovered in WordPress plugin Download Monitor (versions <= 4.4.6).
CVE-2021-44777 1 Email Tracker Project 1 Email Tracker 2025-02-20 5.4 Medium
Cross-Site Request Forgery (CSRF) vulnerabilities leading to single or bulk e-mail entries deletion discovered in Email Tracker WordPress plugin (versions <= 5.2.6).
CVE-2021-45729 1 Srmilon 1 Wp Google Map 2025-02-20 5.4 Medium
The Privilege Escalation vulnerability discovered in the WP Google Map WordPress plugin (versions <= 1.8.0) allows authenticated low-role users to create, edit, and delete maps.
CVE-2021-23174 1 Wpchill 1 Download Monitor 2025-02-20 3.4 Low
Authenticated (admin+) Persistent Cross-Site Scripting (XSS) vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6) Vulnerable parameters: &post_title, &downloadable_file_version[0].
CVE-2021-44779 1 \[gwa\] Autoresponder Project 1 \[gwa\] Autoresponder 2025-02-20 7.3 High
Unauthenticated SQL Injection (SQLi) vulnerability discovered in [GWA] AutoResponder WordPress plugin (versions <= 2.3), vulnerable at (&listid). No patched version available, plugin closed.