Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16,307

Export CSV
CVE-2026-57739

WordPress AcyMailing SMTP Newsletter plugin <= 10.11.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AcyMailing Newsletter Team AcyMailing SMTP Newsletter acymailing allows Blind SQL Injection.This issue affects AcyMailing SMTP Newsletter: from n/a through <= 10.11.0.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Acymailing Newsletter Team Wordpress
Products
Acymailing Smtp Newsletter Wordpress
CVE-2026-57741

WordPress AcyMailing SMTP Newsletter plugin <= 10.11.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AcyMailing Newsletter Team AcyMailing SMTP Newsletter acymailing allows Stored XSS.This issue affects AcyMailing SMTP Newsletter: from n/a through <= 10.11.0.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Acymailing Newsletter Team Wordpress
Products
Acymailing Smtp Newsletter Wordpress
CVE-2026-57768

WordPress Houzez Login Register plugin <= 3.3.3 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in favethemes Houzez Login Register houzez-login-register allows Privilege Escalation.This issue affects Houzez Login Register: from n/a through <= 3.3.3.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Favethemes Wordpress
Products
Houzez Login Register Wordpress
CVE-2026-57743

WordPress RT-Theme 18 | Extensions plugin <= 2.5 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows PHP Local File Inclusion.This issue affects RT-Theme 18 | Extensions: from n/a through <= 2.5.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Stmcan Wordpress
Products
Rt-theme 18 | Extensions Wordpress
CVE-2026-57771

WordPress GD Rating System plugin <= 3.7 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Milan Petrovic GD Rating System gd-rating-system allows Blind SQL Injection.This issue affects GD Rating System: from n/a through <= 3.7.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Milan Petrovic Wordpress
Products
Gd Rating System Wordpress
CVE-2026-57774

WordPress VW Food Corner theme <= 1.1.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in vowelweb VW Food Corner vw-food-corner allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Food Corner: from n/a through <= 1.1.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Vowelweb Wordpress
Products
Vw Food Corner Wordpress
CVE-2026-57776

WordPress VW Wedding theme <= 1.3.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in vowelweb VW Wedding vw-wedding allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Wedding: from n/a through <= 1.3.7.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Vowelweb Wordpress
Products
Vw Wedding Wordpress
CVE-2026-57772

WordPress WP Inventory Manager plugin <= 2.4.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Inventory WP Inventory Manager wp-inventory-manager allows Blind SQL Injection.This issue affects WP Inventory Manager: from n/a through <= 2.4.0.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpinventory
Products
Wordpress Wp Inventory Manager
CVE-2026-57779

WordPress Fascinate theme <= 1.1.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in themebeez Fascinate fascinate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fascinate: from n/a through <= 1.1.5.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Themebeez Wordpress
Products
Fascinate Wordpress
CVE-2026-57780

WordPress Envision Page Builder plugin <= 0.22 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plugin Envision Envision Page Builder envision-page-builder allows DOM-Based XSS.This issue affects Envision Page Builder: from n/a through <= 0.22.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Plugin Envision Wordpress
Products
Envision Page Builder Wordpress
CVE-2026-57781

WordPress MeetingHub plugin <= 1.25.10 - Broken Access Control vulnerability

Missing Authorization vulnerability in Sovlix MeetingHub meetinghub allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MeetingHub: from n/a through <= 1.25.10.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Sovlix Wordpress
Products
Meetinghub Wordpress
CVE-2026-57782

WordPress Universal Clocks plugin <= 1.2.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in PressTigers Universal Clocks universal-clocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Universal Clocks: from n/a through <= 1.2.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Presstigers Wordpress
Products
Universal Clocks Wordpress
CVE-2026-57795

WordPress Kitchor theme <= 1.4.3 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themelexus Kitchor kitchor allows PHP Local File Inclusion.This issue affects Kitchor: from n/a through <= 1.4.3.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Themelexus Wordpress
Products
Kitchor Wordpress
CVE-2026-57796

WordPress Leedo theme <= 3.0.0 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in VLThemes Leedo leedo allows PHP Local File Inclusion.This issue affects Leedo: from n/a through <= 3.0.0.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Vlthemes Wordpress
Products
Leedo Wordpress
CVE-2026-57799

WordPress Nuss theme <= 1.3.6 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in uxper Nuss nuss allows PHP Local File Inclusion.This issue affects Nuss: from n/a through <= 1.3.6.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Uxper Wordpress
Products
Nuss Wordpress
CVE-2026-57813

WordPress MailOptin plugin <= 1.2.77.3 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in properfraction MailOptin mailoptin allows Privilege Escalation.This issue affects MailOptin: from n/a through <= 1.2.77.3.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Properfraction Wordpress
Products
Mailoptin Wordpress
CVE-2026-61952

WordPress WooCommerce Bulk Edit Products – WP Sheet Editor plugin <= 1.8.21 - Broken Access Control vulnerability

Missing Authorization vulnerability in Jose Vega WooCommerce Bulk Edit Products – WP Sheet Editor woo-bulk-edit-products allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Bulk Edit Products – WP Sheet Editor: from n/a through <= 1.8.21.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Jose Vega Wordpress
Products
Woocommerce Bulk Edit Products – Wp Sheet Editor Wordpress
CVE-2026-61955

WordPress گرویتی فرم فارسی plugin <= 3.0.2 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Hannan گرویتی فرم فارسی persian-gravity-forms allows Blind SQL Injection.This issue affects گرویتی فرم فارسی: from n/a through <= 3.0.2.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Hannan Wordpress
Products
گرویتی فرم فارسی Wordpress
CVE-2026-61956

WordPress ووسلام – همگام سازی ووکامرس و باسلام plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in hamsalam ووسلام &#8211; همگام سازی ووکامرس و باسلام sync-basalam allows Cross Site Request Forgery.This issue affects ووسلام &#8211; همگام سازی ووکامرس و باسلام: from n/a through <= 1.9.1.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Hamsalam Wordpress
Products
ووسلام &#8211; همگام سازی ووکامرس و باسلام Wordpress
CVE-2026-61970

WordPress Auto Featured Image (Auto Post Thumbnail) plugin <= 5.0.4 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery (SSRF) vulnerability in Themeisle Auto Featured Image (Auto Post Thumbnail) auto-post-thumbnail allows Server Side Request Forgery.This issue affects Auto Featured Image (Auto Post Thumbnail): from n/a through <= 5.0.4.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Themeisle Wordpress
Products
Auto Featured Image (auto Post Thumbnail) Wordpress