Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (20782 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-45359 1 Yithemes 1 Yith Woocommerce Gift Cards 2025-02-20 9.8 Critical
Unauth. Arbitrary File Upload vulnerability in YITH WooCommerce Gift Cards premium plugin <= 3.19.0 on WordPress.
CVE-2022-45833 1 Wp-ecommerce 1 Easy Wp Smtp 2025-02-20 6.8 Medium
Auth. Path Traversal vulnerability in Easy WP SMTP plugin <= 1.5.1 on WordPress.
CVE-2020-28339 1 Welcart 1 Welcart E-commerce 2025-02-20 7.5 High
The usc-e-shop (aka Collne Welcart e-Commerce) plugin before 1.9.36 for WordPress allows Object Injection because of usces_unserialize. There is not a complete POP chain.
CVE-2023-5952 1 Welcart 1 Welcart E-commerce 2025-02-20 9.8 Critical
The Welcart e-Commerce WordPress plugin before 2.9.5 unserializes user input from cookies, which could allow unautehtniacted users to perform PHP Object Injection when a suitable gadget is present on the blog
CVE-2023-5951 1 Welcart 1 Welcart E-commerce 2025-02-20 6.1 Medium
The Welcart e-Commerce WordPress plugin before 2.9.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVE-2024-13570 1 Unalignedcode 1 Stray Random Quotes 2025-02-20 6.1 Medium
The Stray Random Quotes WordPress plugin through 1.9.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVE-2024-13544 1 Amini7 1 Zarinpal Paid Download 2025-02-20 4.8 Medium
The Zarinpal Paid Download WordPress plugin through 2.3 does not properly validate uploaded files, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)
CVE-2024-13543 1 Amini7 1 Zarinpal Paid Download 2025-02-20 6.1 Medium
The Zarinpal Paid Download WordPress plugin through 2.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVE-2022-44583 1 Watchtowerhq 1 Watchtower 2025-02-20 7.5 High
Unauth. Arbitrary File Download vulnerability in WatchTowerHQ plugin <= 3.6.15 on WordPress.
CVE-2022-29489 1 Sucuri 1 Security 2025-02-19 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Sucuri Security plugin <= 1.8.33 at WordPress leading to Event log entry creation.
CVE-2022-38467 1 Crmperks 1 Crm Perks Forms 2025-02-19 6.1 Medium
Reflected Cross-Site Scripting (XSS) vulnerability in CRM Perks Forms – WordPress Form Builder <= 1.1.0 ver.
CVE-2022-47145 1 Blockonomics 1 Blockonomics 2025-02-19 7.1 High
Reflected Cross-Site Scripting (XSS) vulnerability in Blockonomics WordPress Bitcoin Payments – Blockonomics plugin <= 3.5.7 versions.
CVE-2023-26008 1 Top 10 - Popular Posts Project 1 Top 10 - Popular Posts 2025-02-19 5.9 Medium
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Ajay D'Souza Top 10 – Popular posts plugin for WordPress plugin <= 3.2.4 versions.
CVE-2022-46848 1 Themeisle 1 Visualizer 2025-02-19 6.5 Medium
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Themeisle Visualizer: Tables and Charts Manager for WordPress plugin <= 3.9.1 versions.
CVE-2023-23670 1 Heateor 1 Fancy Comments 2025-02-19 6.5 Medium
Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Team Heateor Fancy Comments WordPress plugin <= 1.2.10 versions.
CVE-2023-23677 1 Gtmetrix 1 Gtmetrix 2025-02-19 3.8 Low
Reflected Cross-Site Scripting (XSS) vulnerability in GTmetrix GTmetrix for WordPress plugin <= 0.4.5 versions.
CVE-2023-25040 1 Getshortcodes 1 Shortcodes Ultimate 2025-02-19 6.5 Medium
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Vova Anokhin WordPress Shortcodes Plugin — Shortcodes Ultimate plugin <= 5.12.6 versions.
CVE-2023-23685 1 Radiustheme 1 Portfolio 2025-02-19 6.5 Medium
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in RadiusTheme Portfolio – WordPress Portfolio plugin <= 2.8.10 versions.
CVE-2023-23977 1 Heateor 1 Social Comments 2025-02-19 6.5 Medium
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Team Heateor WordPress Social Comments Plugin for Vkontakte Comments and Disqus Comments plugin <= 1.6.1 versions.
CVE-2023-26536 1 Followmedarling 1 Spotify-play-button-for-wordpress 2025-02-19 6.5 Medium
Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Jonk @ Follow me Darling Sp*tify Play Button for WordPress plugin <= 2.05 versions.