Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (12746 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-39551 2 Elated-themes, Wordpress 2 Töbel, Wordpress 2026-06-02 8.1 High
Deserialization of Untrusted Data vulnerability in Elated-Themes Töbel allows Object Injection. This issue affects Töbel: from n/a through 1.8.1.
CVE-2026-39552 2 Code Supply Co., Wordpress 2 Blueprint, Wordpress 2026-06-02 8.1 High
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Code Supply Co. Blueprint allows PHP Local File Inclusion. This issue affects Blueprint: from n/a before 1.1.5.
CVE-2026-39553 2 Select-themes, Wordpress 2 Waveride, Wordpress 2026-06-02 8.1 High
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes WaveRide allows PHP Local File Inclusion. This issue affects WaveRide: from n/a through 1.4.
CVE-2025-58707 2 Axiomthemes, Wordpress 2 Spin, Wordpress 2026-06-02 8.1 High
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Spin allows PHP Local File Inclusion. This issue affects Spin: from n/a through 1.8.
CVE-2025-58897 2 Axiomthemes, Wordpress 2 Fermentio, Wordpress 2026-06-02 8.1 High
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Fermentio allows PHP Local File Inclusion. This issue affects Fermentio: from n/a through 1.5.0.
CVE-2025-69369 2 Axiomthemes, Wordpress 2 Racquet, Wordpress 2026-06-02 8.1 High
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Racquet allows PHP Local File Inclusion. This issue affects Racquet: from n/a through 1.12.0.
CVE-2025-68886 2 Androthemes, Wordpress 2 Cookiteer, Wordpress 2026-06-02 8.1 High
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in androThemes Cookiteer allows PHP Local File Inclusion. This issue affects Cookiteer: from n/a through 1.4.8.
CVE-2026-27351 2 Sekander Badsha, Wordpress 2 Crew Hrm, Wordpress 2026-06-02 5.4 Medium
Missing Authorization vulnerability in Sekander Badsha Crew HRM allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Crew HRM: from n/a through 1.2.2.
CVE-2026-40780 2 Liquid Web / Stellarwp, Wordpress 2 Bookit, Wordpress 2026-06-02 7.5 High
Authentication Bypass Using an Alternate Path or Channel vulnerability in Liquid Web / StellarWP BookIt allows Password Recovery Exploitation. This issue affects BookIt: from n/a before 2.5.4.1.
CVE-2026-8382 2 Wordpress, Wpengine 2 Wordpress, Advanced Custom Fields 2026-06-02 5.3 Medium
The Advanced Custom Fields (ACF®) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the post_title and post_content of any post bound to a publicly accessible acf_form() instance by injecting values into the _post_title and _post_content parameters of a form submission request.
CVE-2026-42683 2 Vikwp, Wordpress 2 Vikbooking Hotel Booking Engine & Pms, Wordpress 2026-06-02 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS allows DOM-Based XSS. This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through 1.8.8.
CVE-2026-42681 2 E2pdf, Wordpress 2 E2pdf, Wordpress 2026-06-02 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E2Pdf.Com e2pdf allows Reflected XSS. This issue affects e2pdf: from n/a through 1.32.14.
CVE-2026-42680 2 Wasiliy Strecker / Contestgallery Developer, Wordpress 2 Contest Gallery, Wordpress 2026-06-02 9.8 Critical
Incorrect Privilege Assignment vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery Pro allows Privilege Escalation. This issue affects Contest Gallery Pro: from n/a through 29.0.1.
CVE-2026-42673 2 Logtivity, Wordpress 2 Activity Logs, User Activity Tracking, Multisite Activity Log From Logtivity, Wordpress 2026-06-02 7.5 High
Insertion of Sensitive Information Into Sent Data vulnerability in Logtivity Activity Logs Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity allows Retrieve Embedded Sensitive Data. This issue affects Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity: from n/a through 3.3.6.
CVE-2026-42672 2 Wordpress, Wpdirectorykit 2 Wordpress, Wp Directory Kit 2026-06-02 9.3 Critical
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wp Directory Kit WP Directory Kit allows Blind SQL Injection. This issue affects WP Directory Kit: from n/a through 1.5.1.
CVE-2026-42654 2 Wordpress, Wpswings 2 Wordpress, Wallet System For Woocommerce 2026-06-02 7.1 High
Authentication Bypass Using an Alternate Path or Channel vulnerability in WP Swings Wallet System for WooCommerce allows Password Recovery Exploitation. This issue affects Wallet System for WooCommerce: from n/a through 2.7.5.
CVE-2026-39555 2 Elated-themes, Wordpress 2 Askka, Wordpress 2026-06-02 8.1 High
Deserialization of Untrusted Data vulnerability in Elated-Themes Askka allows Object Injection. This issue affects Askka: from n/a through 1.3.1.
CVE-2026-28116 2 Emiliaprojects, Wordpress 2 Progress Planner, Wordpress 2026-06-02 5.9 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Emilia Projects Progress Planner allows Stored XSS. This issue affects Progress Planner: from n/a through 1.9.0.
CVE-2026-49782 2 Elementor, Wordpress 2 Elementor Website Builder, Wordpress 2026-06-02 5.4 Medium
Missing Authorization vulnerability in Elementor Elementor Website Builder allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Elementor Website Builder: from n/a through 4.1.0.
CVE-2026-8293 2 Really-simple-plugins, Wordpress 2 Really Simple Security, Wordpress 2026-06-02 7.5 High
The Really Simple Security WordPress plugin before 9.5.10.1 does not enforce the second-factor challenge in two of its two-factor authentication REST endpoints, allowing an attacker who knows a user's password to obtain a WordPress authentication session for that user without completing the email OTP challenge.