Export limit exceeded: 425880 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16,307

Export CSV
CVE-2026-65446

WordPress Kali Forms plugin <= 2.4.18 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Kali Forms <= 2.4.18 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Wordpress Wp Chill
Products
Wordpress Kali Forms
CVE-2026-49779

WordPress Tax Exempt for WooCommerce plugin < 1.9.5 - Path Traversal vulnerability

Path Traversal: '.../...//' vulnerability in Addify Tax Exempt for WooCommerce allows Path Traversal. This issue affects Tax Exempt for WooCommerce: from n/a before 1.9.5.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Addify Wordpress
Products
Tax Exempt For Woocommerce Wordpress
CVE-2026-65440

WordPress GetGenie plugin <= 4.4.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in GetGenie <= 4.4.3 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Roxnor Wordpress
Products
Getgenie Wordpress
CVE-2026-47100

Funnel Builder for WooCommerce Checkout < 3.15.0.3 Missing Authorization via AJAX

Funnel Builder for WooCommerce Checkout prior to 3.15.0.3 contains a missing authorization vulnerability in the public checkout endpoint that allows unauthenticated attackers to invoke internal methods and write arbitrary data to the plugin's External Scripts global setting. Attackers can inject malicious JavaScript through the External Scripts setting that executes in the browsers of all checkout page visitors.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Funnelkit Wordpress
Products
Funnel Builder Funnel Builder For Woocommerce Checkout Wordpress
CVE-2022-50960

WordPress International Sms Contact Form 7 Integration 1.2 XSS

WordPress International SMS for Contact Form 7 Integration version 1.2 contains a reflected cross-site scripting vulnerability in the page parameter of the admin settings interface. Attackers can inject malicious scripts through the page parameter in class-sms-log-display.php to execute arbitrary JavaScript in administrator browsers.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Icu-project Varun Sridharan Wordpress
Products
International Components For Unicode International Sms For Contact Form Wordpress
CVE-2022-50949

WordPress Plugin Videos sync PDF 1.7.4 Stored XSS

WordPress Plugin Videos sync PDF 1.7.4 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by exploiting unsanitized mov, pdf, mp4, webm, and ogg parameters. Attackers can inject payloads like autofocus onfocus event handlers through the plugin options panel to execute arbitrary JavaScript when administrators view or edit video settings.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
A-j-evolution Cs-technologies Wordpress
Products
Videos Sync Pdf Evolution Wordpress
CVE-2022-50797

Stripe Green Downloads Wordpress Plugin 2.03 Persistent XSS via Settings

Stripe Green Downloads Wordpress Plugin 2.03 contains a persistent cross-site scripting vulnerability allowing remote attackers to inject malicious scripts in button label fields. Attackers can exploit input parameters to execute arbitrary scripts, potentially leading to session hijacking and application module manipulation.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Halfdata Ithemes Wordpress
Products
Stripe Green Downloads Stripe Wordpress
CVE-2021-47977

WordPress Anti-Malware Security Bruteforce Firewall <= 4.20.72 Directory Traversal

WordPress Plugin Anti-Malware Security and Bruteforce Firewall 4.20.59 contains a directory traversal vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the file parameter. Attackers can send requests to the duplicator_download action via admin-ajax.php with path traversal sequences to access sensitive system files outside the intended directory.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Gotmls Ithemes Wordpress
Products
Malware Security And Bruteforce Firewall Security Wordpress
CVE-2021-47948

WordPress GetPaid Plugin 2.4.6 HTML Injection via Help Text

WordPress GetPaid Plugin 2.4.6 contains an HTML injection vulnerability that allows authenticated attackers to inject arbitrary HTML code by exploiting the Help Text field in payment forms. Attackers can inject malicious HTML including image tags and scripts into the Help Text field during payment form creation, which gets stored in the database and executed in the browser when the form is viewed.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Ayecode Invoicing Wordpress
Products
Getpaid Payments Plugin Getpaid Wordpress
CVE-2021-47929

WordPress Plugin Filterable Portfolio Gallery 1.0 Stored XSS

Filterable Portfolio Gallery 1.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by entering payloads in the title field. Attackers can store JavaScript code like image tags with onerror handlers that execute when the gallery is previewed, affecting all users viewing the page.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Bestwebsoft Filterable-portfolio Wordpress
Products
Portfolio Filterable Portfolio Gallery Wordpress
CVE-2021-47922

WordPress Plugin Slider by Soliloquy 2.6.2 Stored XSS

Slider by Soliloquy 2.6.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the title parameter. Attackers can add JavaScript payloads in the title field when creating or editing sliders, which executes in the browsers of users viewing the slider on both administrative and frontend pages.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Soliloquywp Wordpress
Products
Slider Slider By Soliloquy Wordpress
CVE-2020-37244

WordPress Plugin Supsystic Membership 1.4.7 SQL Injection via sidx

Supsystic Membership 1.4.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'search' and 'sidx' parameters. Attackers can send GET requests to the badges module with crafted payloads to extract sensitive database information using time-based blind or UNION-based SQL injection techniques.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Ithemes Supsystic Wordpress
Products
Membership Membership Wordpress
CVE-2020-37227

WordPress Plugin HS Brand Logo Slider 2.1 Unrestricted File Upload

HS Brand Logo Slider 2.1 contains an unrestricted file upload vulnerability that allows authenticated users to bypass client-side file extension validation by uploading arbitrary files. Attackers can intercept upload requests to the logoupload parameter in the admin interface and rename files to executable extensions .php to achieve remote code execution.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
10web Heliossolutions Wordpress
Products
Slider Hs Brand Logo Slider Wordpress
CVE-2019-25745

WordPress Plugin Google Review Slider 6.1 SQL Injection via tid

WordPress Plugin Google Review Slider 6.1 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'tid' parameter. Attackers can send GET requests to the admin interface with malicious 'tid' values to extract sensitive database information using time-based blind SQL injection techniques.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
10web Jgwhite33 Wordpress
Products
Slider Wp Google Review Slider Wordpress
CVE-2019-25738

WordPress Hybrid Composer 1.4.6 Unauthenticated Settings Change

WordPress Hybrid Composer 1.4.6 contains an unauthenticated settings change vulnerability that allows unauthenticated attackers to modify WordPress options by exploiting the hc_ajax_save_option action. Attackers can send POST requests to the admin-ajax.php endpoint with the action parameter set to hc_ajax_save_option to enable user registration and set the default role to administrator, enabling account takeover.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Basticom Framework-y Wordpress
Products
Framework Hybrid Composer Wordpress
CVE-2018-25437

WordPress CherryFramework Themes 3.1.4 Backup File Download

WordPress CherryFramework Themes 3.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers to download sensitive backup files by accessing the download_backup.php endpoint. Attackers can directly access the download_backup.php script in the admin/data_management directory to obtain ZIP archives containing the entire wp-content/themes directory contents.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Basticom Cherryframework Wordpress
Products
Framework Cherry Framework Themes Wordpress
CVE-2017-20247

WordPress Plugin PICA Photo Gallery 1.0 SQL Injection

WordPress Plugin PICA Photo Gallery 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the aid parameter. Attackers can send GET requests with crafted SQL payloads in the aid parameter to extract sensitive database information including user credentials and table contents.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Apptha Bestwebsoft Wordpress
Products
Pica Photo Gallery Gallery Wordpress