Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (652 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-97260 2 Maxfoundry, Wordpress-extensions 2 Maxgalleria, Maxgalleria 2026-10-01 7.1 High
Unauthenticated Cross Site Scripting (XSS) in MaxGalleria <= 6.5.3 versions.
CVE-2026-97280 2 Mamunur Rashid, Wordpress-extensions 2 Review Schema, Review Schema 2026-10-01 6.5 Medium
Missing Authorization vulnerability in Mamunur Rashid Review Schema review-schema allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Review Schema: 3.1.0.
CVE-2026-94390 2 Dotstore, Wordpress-extensions 2 Hide Shipping Method For Woocommerce, Hide Shipping Method For Woocommerce 2026-10-01 7.2 High
Editor PHP Object Injection in Hide Shipping Method For WooCommerce <= 1.5.4 versions.
CVE-2026-103082 2 La-studioweb, Wordpress-extensions 2 Element Kit For Elementor, La-studio Element Kit For Elementor 2026-10-01 7.2 High
Server-Side Request Forgery (SSRF) vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Server Side Request Forgery.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.6.2.
CVE-2026-102397 2 Supsystic, Wordpress-extensions 2 Ultimate Maps By Supsystic, Ultimate Maps By Supsystic 2026-10-01 6.5 Medium
Unauthenticated Broken Access Control in Ultimate Maps by Supsystic <= 1.5.5 versions.
CVE-2026-97256 2 Greg–siteorigin, Wordpress-extensions 2 Page Builder By Siteorigin, Page Builder By Siteorigin 2026-10-01 7.2 High
Editor PHP Object Injection in Page Builder by SiteOrigin <= 2.36.0 versions.
CVE-2026-97265 2 Crocoblock. Jetimpex Inc., Wordpress-extensions 2 Jetengine, Jetengine 2026-10-01 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock. Jetimpex Inc. JetEngine allows Stored XSS. This issue affects JetEngine: from n/a through 3.8.15.3.
CVE-2026-97290 2 Sayontan Sinha, Wordpress-extensions 2 Photonic Gallery & Lightbox For Flickr, Smugmug & Others, Photonic Gallery & Lightbox For Flickr, Smugmug & Others 2026-10-01 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.36 versions.
CVE-2026-97291 2 Magazine3, Wordpress-extensions 2 Schema & Structured Data For Wp & Amp, Schema & Structured Data For Wp & Amp 2026-10-01 8.8 High
Contributor PHP Object Injection in Schema & Structured Data for WP & AMP <= 1.66 versions.
CVE-2026-100510 2 Boldgrid, Wordpress-extensions 2 Post And Page Builder, Post And Page Builder By Boldgrid 2026-10-01 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Post and Page Builder by BoldGrid <= 1.27.14 versions.
CVE-2026-100512 2 Hook & Filter, Wordpress-extensions 2 Nested Pages, Nested Pages 2026-10-01 9.8 Critical
Contributor PHP Object Injection in Nested Pages <= 3.3.2 versions.
CVE-2026-102376 2 Wordpress-extensions, Wpmudev 2 Branda, Branda 2026-10-01 7.1 High
Subscriber Cross Site Scripting (XSS) in Branda <= 3.4.32 versions.
CVE-2026-102377 2 10web, Wordpress-extensions 2 Photo Gallery, Photo Gallery By 10web 2026-10-01 8.8 High
Contributor PHP Object Injection in Photo Gallery by 10Web <= 1.8.46 versions.
CVE-2026-102391 2 Jetmonsters, Wordpress-extensions 2 Jetformbuilder, Jetformbuilder 2026-10-01 7.1 High
Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.4 versions.
CVE-2026-102392 2 Themehigh, Wordpress-extensions 2 Extra Product Options For Woocommerce, Extra Product Options For Woocommerce 2026-10-01 7.2 High
Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields <= 3.3.8 versions.
CVE-2026-89424 2 Inisev, Wordpress-extensions 2 Duplicate Post, Duplicate Post 2026-10-01 6.4 Medium
The Duplicate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'noti_token' parameter in all versions up to, and including, 1.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires that the site owner has enabled the plugin's User Level Permissions for the Subscriber role, as this grants access to the i_saw_this_noti AJAX branch needed to deliver the payload.
CVE-2026-97661 2 Scottpaterson, Wordpress-extensions 2 Business Essentials For Contact Form 7, Business Essentials For Contact Form 7 2026-10-01 7.2 High
The Business Essentials for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'gateway' Form Field in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Payments module to be enabled and a form to be configured to accept both PayPal and Stripe as payment gateways.
CVE-2026-103353 2 Wordpress-extensions, Wpmanageninja 2 Fluentform, Fluent Forms 2026-10-01 5.3 Medium
Incorrect Behavior Order vulnerability in WP ManageNinja LLC FluentForm fluentform allows Removing Important Client Functionality.This issue affects FluentForm: from n/a through 6.2.14.
CVE-2026-103067 2 Memberful, Wordpress-extensions 2 Memberful - Membership Plugin, Memberful 2026-10-01 8 High
Cross-Site Request Forgery (CSRF) vulnerability in Memberful Memberful - Membership Plugin memberful-wp allows Cross Site Request Forgery.This issue affects Memberful - Membership Plugin: from n/a through 1.81.0.
CVE-2026-103340 2 Geminilabs, Wordpress-extensions 2 Site Reviews, Site Reviews 2026-10-01 5.3 Medium
Missing Authorization vulnerability in Gemini Labs Site Reviews site-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Site Reviews: from n/a through 8.3.2.