Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (1144 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-86791 1 Wordpress-extensions 1 Ipos Pays Payment Gateway For Woocommerce 2026-10-21 5.3 Medium
The iPOSpays Payment Gateway for WooCommerce WordPress plugin before 1.4.7 does not verify that a payment was actually completed before recording an order as paid, allowing unauthenticated users to mark any unpaid order as paid and to rewrite its total.
CVE-2026-91831 1 Wordpress-extensions 1 Subscribe To Comments 2026-10-21 3.8 Low
The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers, allowing users with Author-level access and above to inject arbitrary e-mail headers, such as a hidden Bcc, and to spoof the sender.
CVE-2026-94272 1 Wordpress-extensions 1 Snap Finance 2026-10-21 5.3 Medium
The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to fail.
CVE-2026-94294 1 Wordpress-extensions 1 App Builder 2026-10-21 5.3 Medium
The App Builder WordPress plugin before 5.7.1 does not require authentication or authorisation before writing attacker-supplied data to one of its options and, on a separate unauthenticated request, redirecting the visitor's browser to a URI built from that stored data.
CVE-2026-111406 2 Pt Norther Lights Production, Wordpress-extensions 2 Mapsvg, Mapsvg 2026-10-21 9.9 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through 8.16.1.
CVE-2026-110379 2 Ays-pro, Wordpress-extensions 2 Quiz Maker, Quiz Maker 2026-10-21 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Quiz Maker quiz-maker allows Reflected XSS.This issue affects Quiz Maker: from n/a through 6.7.1.91.
CVE-2026-111408 2 Expresstech, Wordpress-extensions 2 Quiz And Survey Master, Quiz And Survey Master 2026-10-21 8.8 High
Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7.
CVE-2026-111398 2 Pt Norther Lights Production, Wordpress-extensions 2 Mapsvg, Mapsvg 2026-10-21 7.7 High
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Path Traversal.This issue affects MapSVG: from n/a through 8.16.1.
CVE-2026-110887 2 Hivepress, Wordpress-extensions 2 Hivepress, Hivepress 2026-10-21 9.9 Critical
Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Remote Code Inclusion.This issue affects HivePress: from n/a through 1.7.32.
CVE-2026-112199 2 Wordpress-extensions, Yithemes 2 Yith Woocommerce Wishlist, Yith Woocommerce Wishlist 2026-10-21 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Wishlist yith-woocommerce-wishlist allows Stored XSS.This issue affects YITH WooCommerce Wishlist: from n/a through 4.18.1.
CVE-2026-111839 2 Videowhisper, Wordpress-extensions 2 Broadcast Live Video, Broadcast Live Video 2026-10-21 5.3 Medium
Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadcast Live Video: from n/a through 7.3.7.
CVE-2026-111410 2 E2pdf, Wordpress-extensions 2 E2pdf, E2pdf 2026-10-21 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E2Pdf.com e2pdf e2pdf allows Stored XSS.This issue affects e2pdf: from n/a through 1.32.57.
CVE-2026-111414 2 Crocoblock, Wordpress-extensions 2 Jetelements For Elementor, Jetelements For Elementor 2026-10-21 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.4.
CVE-2026-111836 2 Wordpress-extensions, Wpmanageninja 2 Fluentcommunity, Fluentcommunity 2026-10-21 4.3 Medium
Missing Authorization vulnerability in WP ManageNinja LLC FluentCommunity fluent-community allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentCommunity: from n/a through 2.11.0.
CVE-2026-111831 2 Wordpress-extensions, Wpmanageninja 2 Fluentform, Fluent Forms 2026-10-21 5.3 Medium
Missing Authorization vulnerability in WP ManageNinja LLC FluentForm fluentform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentForm: from n/a through 6.2.15.
CVE-2026-111845 2 Wordpress-extensions, Yithemes 2 Yith Woocommerce Product Bundles, Yith Woocommerce Product Bundles 2026-10-21 5.3 Medium
Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Product Bundles: from n/a through 2.29.0.
CVE-2026-110902 2 Liquid Web / Stellarwp, Wordpress-extensions 2 Event Tickets, Event Tickets 2026-10-21 4.3 Medium
Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.1.
CVE-2026-112222 2 Surfer, Wordpress-extensions 2 Surfer, Surfer 2026-10-21 5.4 Medium
Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Surfer: from n/a through 1.8.0.744.
CVE-2026-111828 2 Mamunur Rashid, Wordpress-extensions 2 Classified Listing, Classified Listing 2026-10-21 4.3 Medium
Improper Validation of Specified Quantity in Input vulnerability in Mamunur Rashid Classified Listing classified-listing allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Classified Listing: from n/a through 6.1.5.
CVE-2026-93300 2 Eventon, Wordpress-extensions 2 Eventon - Subscriber, Eventon 2026-10-21 7.5 High
The EventON - Subscriber plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all versions up to, and including, 1.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.