Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (20787 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2020-27356 1 Debug Meta Data Project 1 Debug Meta Data 2024-11-21 5.4 Medium
The debug-meta-data plugin 1.1.2 for WordPress allows XSS.
CVE-2020-27344 1 Cminds 1 Cm Download Manager 2024-11-21 6.1 Medium
The cm-download-manager plugin before 2.8.0 for WordPress allows XSS.
CVE-2020-26876 1 Wpcoursesplugin 1 Wp-courses 2024-11-21 7.5 High
The wp-courses plugin through 2.0.27 for WordPress allows remote attackers to bypass the intended payment step (for course videos and materials) by using the /wp-json REST API, as exploited in the wild in September 2020. This occurs because show_in_rest is enabled for custom post types (e.g., /wp-json/wp/v2/course and /wp-json/wp/v2/lesson exist).
CVE-2020-26672 1 Testimonial Rotator Project 1 Testimonial Rotator 2024-11-21 5.4 Medium
Testimonial Rotator Wordpress Plugin 3.0.2 is affected by Cross Site Scripting (XSS) in /wp-admin/post.php. If a user intercepts a request and inserts a payload in "cite" parameter, the payload will be stored in the database.
CVE-2020-26596 2 Elementor, Wordpress 2 Elementor Pro, Wordpress 2024-11-21 8.8 High
The Dynamic OOO widget for the Elementor Pro plugin through 3.0.5 for WordPress allows remote authenticated users to execute arbitrary code because only the Editor role is needed to upload executable PHP code via the PHP Raw snippet. NOTE: this issue can be mitigated by removing the Dynamic OOO widget or by restricting availability of the Editor role.
CVE-2020-26511 1 Wpo365 1 Wordpress \+ Azure Ad \/ Microsoft Office 365 2024-11-21 7.5 High
The wpo365-login plugin before v11.7 for WordPress allows use of a symmetric algorithm to decrypt a JWT token. This leads to authentication bypass.
CVE-2020-26153 1 Eventespresso 1 Event Espresso 2024-11-21 6.1 Medium
A cross-site scripting (XSS) vulnerability in wp-content/plugins/event-espresso-core-reg/admin_pages/messages/templates/ee_msg_admin_overview.template.php in the Event Espresso Core plugin before 4.10.7.p for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.
CVE-2020-25380 1 Recall-products Project 1 Recall-products 2024-11-21 5.4 Medium
Wordpress Plugin Store / Mike Rooijackers Recall Products V0.8 is affected by: Cross Site Scripting (XSS) via the 'Recall Settings' field in admin.php. An attacker can inject JavaScript code that will be stored and executed.
CVE-2020-25379 1 Recall-products Project 1 Recall-products 2024-11-21 8.8 High
Wordpress Plugin Store / Mike Rooijackers Recall Products V0.8 fails to sanitize input from the 'Manufacturer[]' parameter which allows an authenticated attacker to inject a malicious SQL query.
CVE-2020-25378 1 Accesspressthemes 1 Wp Floating Menu 2024-11-21 6.1 Medium
Wordpress Plugin Store / AccessPress Themes WP Floating Menu V1.3.0 is affected by: Cross Site Scripting (XSS) via the id GET parameter.
CVE-2020-25375 1 Softrade 1 Wp Smart Crm \& Invoices 2024-11-21 5.4 Medium
Wordpress Plugin Store / SoftradeWeb SNC WP SMART CRM V1.8.7 is affected by: Cross Site Scripting via the Business Name field, Tax Code field, First Name field, Address field, Town field, Phone field, Mobile field, Place of Birth field, Web Site field, VAT Number field, Last Name field, Fax field, Email field, and Skype field.
CVE-2020-25286 1 Wordpress 1 Wordpress 2024-11-21 5.3 Medium
In wp-includes/comment-template.php in WordPress before 5.4.2, comments from a post or page could sometimes be seen in the latest comments even if the post or page was not public.
CVE-2020-25033 1 Blubrry 1 Subscribe Sidebar 2024-11-21 6.1 Medium
The Blubrry subscribe-sidebar (aka Subscribe Sidebar) plugin 1.3.1 for WordPress allows subscribe_sidebar.php&status= reflected XSS.
CVE-2020-24948 1 Autoptimize 1 Autoptimize 2024-11-21 7.2 High
The ao_ccss_import AJAX call in Autoptimize Wordpress Plugin 2.7.6 does not ensure that the file provided is a legitimate Zip file, allowing high privilege users to upload arbitrary files, such as PHP, leading to remote command execution.
CVE-2020-24699 1 Chamber Dashboard Business Directory Project 1 Chamber Dashboard Business Directory 2024-11-21 6.1 Medium
The Chamber Dashboard Business Directory plugin 3.2.8 for WordPress allows XSS.
CVE-2020-24315 1 Wordpress Poll Project 1 Wordpress Poll 2024-11-21 7.5 High
Vinoj Cardoza WordPress Poll Plugin v36 and lower executes SQL statement passed in via the pollid POST parameter due to a lack of user input escaping. This allows users who craft specific SQL statements to dump the entire targets database.
CVE-2020-24313 1 Etoilewebdesign 1 Ultimate Appointment Booking \& Scheduling 2024-11-21 6.1 Medium
Etoile Web Design Ultimate Appointment Booking & Scheduling WordPress Plugin v1.1.9 and lower does not sanitize the value of the "Appointment_ID" GET parameter before echoing it back out inside an input tag. This results in a reflected XSS vulnerability that attackers can exploit with a specially crafted URL.
CVE-2020-24186 1 Gvectors 1 Wpdiscuz 2024-11-21 10 Critical
A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allows unauthenticated users to upload any type of file, including PHP files via the wmuUploadFiles AJAX action.
CVE-2020-24149 1 Secondline 1 Podcast Importer Secondline 2024-11-21 7.5 High
Server-side request forgery (SSRF) in the Podcast Importer SecondLine (podcast-importer-secondline) plugin 1.1.4 for WordPress via the podcast_feed parameter in a secondline_import_initialize action to the secondlinepodcastimport page.
CVE-2020-24148 1 Mooveagency 1 Import Xml And Rss Feeds 2024-11-21 9.1 Critical
Server-side request forgery (SSRF) in the Import XML and RSS Feeds (import-xml-feed) plugin 2.0.1 for WordPress via the data parameter in a moove_read_xml action.