Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16,307

Export CSV
CVE-2016-20081

WordPress Plugin HB Audio Gallery Lite 1.0.0 Path Traversal File Download

WordPress Plugin HB Audio Gallery Lite 1.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by manipulating the file_path parameter. Attackers can send requests to the audio-download.php endpoint with directory traversal sequences to access sensitive files like wp-config.php outside the intended gallery directory.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Bestwebsoft Husain Wordpress
Products
Gallery Hb Audio Gallery Lite Wordpress
CVE-2016-20078

WordPress IMDb Profile Widget 1.0.8 Local File Inclusion via pic.php

WordPress IMDb Profile Widget 1.0.8 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the url parameter. Attackers can supply directory traversal sequences in GET requests to pic.php to access sensitive files like wp-config.php containing database credentials and configuration data.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Henrique Dias Imdb-widget Project Wordpress
Products
Imdb Profile Widget Imdb-widget Wordpress
CVE-2016-20074

WordPress Lazy Content Slider Plugin 3.4 CSRF

WordPress Lazy Content Slider Plugin 3.4 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions by crafting malicious HTML forms. Attackers can trick authenticated administrators into submitting POST requests to the plugin settings page via lzcs_admin.php to modify plugin configuration parameters like lzcs_color and lzcs_count.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
10web Leethompson Wordpress
Products
Slider Lazy Content Slider Plugin Wordpress
CVE-2016-20071

WordPress 404 Redirection Manager Plugin 1.0 SQL Injection

The 404 Redirection Manager plugin version 1.0 for WordPress contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by injecting malicious code through unsanitized user input. Attackers can craft GET requests with SQL injection payloads to manipulate database queries and extract sensitive information from the WordPress database.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
404-redirection-manager Redirection Wordpress
Products
404 Redirection Manager Redirection Wordpress
CVE-2026-65558

WordPress AffiliateX plugin <= 2.3.5 - Server Side Request Forgery (SSRF) vulnerability

Unauthenticated Server Side Request Forgery (SSRF) in AffiliateX <= 2.3.5 versions.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpcenter
Products
Wordpress Affiliatex
CVE-2026-65567

WordPress Event Tickets plugin <= 5.29.0.1 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Event Tickets <= 5.29.0.1 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Nexcess Wordpress
Products
Event Tickets Wordpress