Search vulnerabilities

Expected end of text, found '@' (at char 12), (line:1, col:13)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,468

CVE-2026-62016

WordPress Gamic theme <= 1.19 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-62015

WordPress Gamezone theme <= 1.1.11 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-62014

WordPress EmojiNation theme <= 1.0.12 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-62011

WordPress Bonbon theme <= 1.11 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-62010

WordPress Avventure theme <= 1.1.12 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-62009

WordPress Filmax theme <= 1.1.11 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-62005

WordPress Muzicon theme <= 1.15 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-62004

WordPress Motorix theme <= 1.11 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Motorix <= 1.11 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-62003

WordPress Mission theme <= 1.22 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Mission <= 1.22 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-61998

WordPress Le Truffe theme <= 1.1.7 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-61997

WordPress Legal Stone theme <= 1.2.11 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-61996

WordPress MLS On The Fly plugin <= 1.8.1.5 - SQL Injection vulnerability

Subscriber SQL Injection in MLS On The Fly <= 1.8.1.5 versions.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-61992

WordPress GEO my WordPress plugin <= 4.5.5.4 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-61991

WordPress AjaxLoadMore Cache plugin <= 3.1.1 - Remote Code Execution (RCE) vulnerability

Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-5461

Forminator Forms <= 1.55.0.2 - Unauthenticated Limited File Deletion via Draft Upload Metadata

The Forminator Forms plugin for WordPress is vulnerable to Limited File Deletion in all versions up to, and including, 1.55.0.2. This is due to the plugin accepting arbitrary upload field metadata from POST requests in draft submissions without proper validation, which is then used to delete files when a subsequent draft references the poisoned draft via the previous_draft_id parameter. This makes it possible for unauthenticated attackers to delete arbitrary non-PHP files within the wp-content/uploads/ directory.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Wpmudev
Products
Forminator Forms Forminator Forms
CVE-2026-57207

NetBox MCP Server: HTTP transport exposes all NetBox data without authentication

NetBox MCP Server is a simple read-only Model Context Protocol server for NetBox. Prior to version 1.2.1, when running with TRANSPORT=http, the MCP server has no authentication on the HTTP endpoint. Any client that can reach the port gets a valid MCP session and full access to all four NetBox tools - no token or credential needed. This issue has been patched in version 1.2.1.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Netboxlabs
Products
Netbox-mcp-server
CVE-2026-54865

WordPress Podamibe Custom User Gravatar plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in Podamibe Custom User Gravatar <= 1.0.8 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-54864

WordPress Post Video Players plugin <= 1.165 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Post Video Players <= 1.165 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-54860

WordPress Ozisti theme <= 1.1.10 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—