Export limit exceeded: 390078 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (16006 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-81774 2 Dotstore, Wordpress 2 Woocommerce Product Attachment, Wordpress 2026-09-02 7.5 High
Unauthenticated Sensitive Data Exposure in WooCommerce Product Attachment <= 2.3.3 versions.
CVE-2026-84835 2 Dimafreund, Wordpress 2 Rentsyst, Wordpress 2026-09-02 5.3 Medium
Missing Authorization vulnerability in DimaFreund Rentsyst allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Rentsyst: from n/a through 2.1.2.
CVE-2026-84770 2 Kitae-park, Wordpress 2 Mang Board Wp, Wordpress 2026-09-02 8.8 High
Unauthenticated Cross Site Request Forgery (CSRF) in Mang Board WP <= 2.3.8 versions.
CVE-2026-82223 2 Arraytics, Wordpress 2 Wp Event Solution, Wordpress 2026-09-02 6.5 Medium
Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.22 versions.
CVE-2026-81288 2 Wordpress, Wp Swings 2 Wordpress, Upsell Order Bump Offer For Woocommerce 2026-09-02 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Upsell Order Bump Offer for WooCommerce <= 3.1.5 versions.
CVE-2026-66652 2 Themegoods, Wordpress 2 Grand Tour, Wordpress 2026-09-02 5.4 Medium
Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Tour allows Cross Site Request Forgery. This issue affects Grand Tour: from n/a through 5.5.1.
CVE-2026-82852 2 Mapsvg, Wordpress 2 Mapsvg, Wordpress 2026-09-02 5.4 Medium
Unauthenticated Server Side Request Forgery (SSRF) in MapSVG <= 8.15.0 versions.
CVE-2026-81756 2 E-goi, Wordpress 2 Smart Marketing Sms And Newsletters Forms, Wordpress 2026-09-02 9.3 Critical
Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms <= 5.1.24 versions.
CVE-2026-81291 2 Uncode, Wordpress 2 Uncode, Wordpress 2026-09-02 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Uncode <= 2.12.7 versions.
CVE-2026-74010 2 John James Jacoby, Wordpress 2 Bbpress, Wordpress 2026-09-02 5.3 Medium
Missing Authorization vulnerability in John James Jacoby bbPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects bbPress: from n/a through 2.6.14.
CVE-2026-66047 2 Properfraction, Wordpress 2 Profilepress, Wordpress 2026-09-02 8.1 High
ProfilePress (wp-user-avatar) WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to install and activate arbitrary plugins by brute-forcing a weak 32-bit connect token via the ppress_connect_process AJAX handler. Attackers can supply a caller-controlled URL through the file request parameter to trigger silent plugin installation and activation, achieving PHP code execution as the web-server user.
CVE-2026-74927 2 Multivendorx, Wordpress 2 Multivendorx, Wordpress 2026-09-02 5.3 Medium
The MultiVendorX WordPress plugin before 5.0.15 does not have proper authorisation controls on one of its REST API listing routes, allowing unauthenticated users to retrieve vendor contact and payout details, pending payout amounts, and administrative notes attached to store applications.
CVE-2026-83562 2 Wclovers, Wordpress 2 Wcfm Marketplace, Wordpress 2026-09-02 6.5 Medium
Contributor Cross Site Scripting (XSS) in WCFM Marketplace <= 3.8.2 versions.
CVE-2026-19251 2 Ultimatemember, Wordpress 2 Ultimate Member, Wordpress 2026-09-02 5.3 Medium
The Ultimate Member WordPress plugin before 2.13.0 does not check whether a comment has been approved, or whether the profile it belongs to is private, before returning profile activity to unauthenticated visitors, allowing them to read the content of comments still awaiting moderation.
CVE-2026-19453 2 Jetbackup, Wordpress 2 Jetbackup, Wordpress 2026-09-02 7.1 High
The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capabilities of the account it preserves across a restore or migration before granting it administrator privileges, allowing a subscriber-level user to gain administrator access after the site owner restores or migrates the site.
CVE-2026-77783 2 Rank Math Seo, Wordpress 2 Rank Math Seo, Wordpress 2026-09-02 3.7 Low
The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the post whose schema it renders on the front end is publicly viewable, allowing unauthenticated visitors to disclose the schema and associated content of draft, pending, private, scheduled and password-protected posts.
CVE-2026-77784 2 Rank Math Seo, Wordpress 2 Rank Math Seo, Wordpress 2026-09-02 2.7 Low
The Rank Math SEO WordPress plugin before 1.0.277 does not verify that a user is allowed to edit the object being modified before updating its SEO indexing metadata, allowing users with the Author role and above to alter that metadata on content, taxonomy terms and user profiles they do not own, and to remove other users' content from the site's sitemap and search engine index.
CVE-2026-77788 2 Rank Math Seo, Wordpress 2 Rank Math Seo, Wordpress 2026-09-02 4.9 Medium
The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the metadata row being updated belongs to the object the user was authorised against, allowing users with the Author role and above to overwrite arbitrary post and user metadata, including that belonging to higher-privileged users.
CVE-2026-84775 2 Really-simple-plugins, Wordpress 2 Really Simple Ssl, Wordpress 2026-09-02 5.3 Medium
Unauthenticated Denial of Service Attack in Really Simple SSL <= 9.8.0 versions.
CVE-2026-84760 2 Wordpress, Wpswings 2 Wordpress, Ultimate Gift Cards For Woocommerce 2026-09-02 5.3 Medium
Unauthenticated Broken Access Control in Ultimate Gift Cards For WooCommerce <= 3.2.9 versions.