Export limit exceeded: 15768 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (15768 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-19251 2 Ultimatemember, Wordpress 2 Ultimate Member, Wordpress 2026-09-02 5.3 Medium
The Ultimate Member WordPress plugin before 2.13.0 does not check whether a comment has been approved, or whether the profile it belongs to is private, before returning profile activity to unauthenticated visitors, allowing them to read the content of comments still awaiting moderation.
CVE-2026-19453 2 Jetbackup, Wordpress 2 Jetbackup, Wordpress 2026-09-02 7.1 High
The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capabilities of the account it preserves across a restore or migration before granting it administrator privileges, allowing a subscriber-level user to gain administrator access after the site owner restores or migrates the site.
CVE-2026-77783 2 Rank Math Seo, Wordpress 2 Rank Math Seo, Wordpress 2026-09-02 3.7 Low
The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the post whose schema it renders on the front end is publicly viewable, allowing unauthenticated visitors to disclose the schema and associated content of draft, pending, private, scheduled and password-protected posts.
CVE-2026-77784 2 Rank Math Seo, Wordpress 2 Rank Math Seo, Wordpress 2026-09-02 2.7 Low
The Rank Math SEO WordPress plugin before 1.0.277 does not verify that a user is allowed to edit the object being modified before updating its SEO indexing metadata, allowing users with the Author role and above to alter that metadata on content, taxonomy terms and user profiles they do not own, and to remove other users' content from the site's sitemap and search engine index.
CVE-2026-77788 2 Rank Math Seo, Wordpress 2 Rank Math Seo, Wordpress 2026-09-02 4.9 Medium
The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the metadata row being updated belongs to the object the user was authorised against, allowing users with the Author role and above to overwrite arbitrary post and user metadata, including that belonging to higher-privileged users.
CVE-2026-66652 2 Themegoods, Wordpress 2 Grand Tour, Wordpress 2026-09-02 5.4 Medium
Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Tour allows Cross Site Request Forgery. This issue affects Grand Tour: from n/a through 5.5.1.
CVE-2026-84217 2 Mamunur Rashid, Wordpress 2 Classified Listing, Wordpress 2026-09-02 5.4 Medium
Missing Authorization vulnerability in Mamunur Rashid Classified Listing allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Classified Listing: from n/a through 6.1.1.
CVE-2026-84775 2 Really-simple-plugins, Wordpress 2 Really Simple Ssl, Wordpress 2026-09-02 5.3 Medium
Unauthenticated Denial of Service Attack in Really Simple SSL <= 9.8.0 versions.
CVE-2026-84760 2 Wordpress, Wpswings 2 Wordpress, Ultimate Gift Cards For Woocommerce 2026-09-02 5.3 Medium
Unauthenticated Broken Access Control in Ultimate Gift Cards For WooCommerce <= 3.2.9 versions.
CVE-2026-81283 2 Wedevs, Wordpress 2 Wp User Frontend, Wordpress 2026-09-02 8.8 High
Subscriber PHP Object Injection in WP User Frontend <= 4.3.10 versions.
CVE-2026-75528 2 Wordpress, Wpmudev 2 Wordpress, Broken Link Checker 2026-09-02 7.2 High
The Broken Link Checker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author URL / Link Log in all versions up to, and including, 2.4.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to perform the plugin's standard dismiss-and-recheck workflow on a link submitted by the attacker via the WordPress comment author URL field, after which the attacker's HTTP server issues a redirect to a URL containing an HTML/JavaScript payload that is stored verbatim in the link log.
CVE-2026-16983 2 Gutentor, Wordpress 2 Gutentor, Wordpress 2026-09-02 4.3 Medium
The Gutentor WordPress plugin before 4.0.6 does not apply the correct context restriction to one of its REST endpoints, exposing the plaintext passwords of password-protected posts to any authenticated user with at least the Subscriber role.
CVE-2026-83562 2 Wclovers, Wordpress 2 Wcfm Marketplace, Wordpress 2026-09-02 6.5 Medium
Contributor Cross Site Scripting (XSS) in WCFM Marketplace <= 3.8.2 versions.
CVE-2026-84770 2 Kitae-park, Wordpress 2 Mang Board Wp, Wordpress 2026-09-02 8.8 High
Unauthenticated Cross Site Request Forgery (CSRF) in Mang Board WP <= 2.3.8 versions.
CVE-2026-84781 2 Wordpress, Wpchill 2 Wordpress, Gallery Photoblocks 2026-09-02 6.5 Medium
Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.4 versions.
CVE-2026-84764 2 Nsquared, Wordpress 2 Simply Schedule Appointments, Wordpress 2026-09-02 8.8 High
Unauthenticated Cross Site Request Forgery (CSRF) in Simply Schedule Appointments <= 1.6.12.23 versions.
CVE-2026-84772 2 Wordpress, Wpmudev 2 Wordpress, Broken Link Checker 2026-09-02 5.5 Medium
Editor Server Side Request Forgery (SSRF) in Broken Link Checker <= 2.4.14 versions.
CVE-2026-84780 2 Wordpress, Wpgmaps 2 Wordpress, Wp Go Maps 2026-09-02 5.3 Medium
Unauthenticated Denial of Service Attack in WP Go Maps <= 10.1.08 versions.
CVE-2026-81288 2 Wordpress, Wp Swings 2 Wordpress, Upsell Order Bump Offer For Woocommerce 2026-09-02 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Upsell Order Bump Offer for WooCommerce <= 3.1.5 versions.
CVE-2026-81775 2 Estatik, Wordpress 2 Estatik, Wordpress 2026-09-02 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Estatik <= 4.3.4 versions.