Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 10,820

Export CSV
CVE-2025-31047

WordPress Themify Edmin theme <= 2.0.0 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in Themify Themify Edmin allows Object Injection.This issue affects Themify Edmin: from n/a through 2.0.0.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2025-24777

WordPress Hillter theme <= 3.0.7 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in awethemes Hillter allows Object Injection. This issue affects Hillter: from n/a through 3.0.7.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2024-52412

WordPress Xin theme <= 1.0.8.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Stephen Cui Xin allows Object Injection.This issue affects Xin: from n/a through 1.0.8.1.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Stephen Cui
Products
Xin
CVE-2024-37270

WordPress TrustedLogin Vendor plugin < 1.1.1 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information into Log File vulnerability in TrustedLogin TrustedLogin Vendor.This issue affects TrustedLogin Vendor: from n/a before 1.1.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Trustedlogin
Products
Trustedlogin
CVE-2024-33568

WordPress Element Pack Pro plugin < 7.19.3 - Arbitrary File Read and Phar Deserialization vulnerability

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Deserialization of Untrusted Data vulnerability in BdThemes Element Pack Pro allows Path Traversal, Object Injection.This issue affects Element Pack Pro: from n/a before 7.19.3.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Bdthemes
Products
Element Pack
CVE-2024-32953

WordPress Newsletters plugin <= 4.9.5 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information into Log File vulnerability in Newsletters.This issue affects Newsletters: from n/a through 4.9.5.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Tribulant
Products
Newsletters
CVE-2024-32686

WordPress Backup Migration plugin <= 1.4.3 - Sensitive Data Exposure via Log vulnerability

Insertion of Sensitive Information into Log File vulnerability in Inisev Backup Migration.This issue affects Backup Migration: from n/a through 1.4.3.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2024-32600

WordPress Master Slider plugin <= 3.9.5 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Averta Master Slider.This issue affects Master Slider: from n/a through 3.9.5.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Averta
Products
Master Slider
CVE-2024-32513

WordPress Product Feed PRO for WooCommerce plugin <= 13.3.1 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information into Log File vulnerability in AdTribes.Io Product Feed PRO for WooCommerce.This issue affects Product Feed PRO for WooCommerce: from n/a through 13.3.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Adtribes
Products
Product Feed Pro For Woocommerce
CVE-2024-31353

WordPress Slideshow Gallery LITE plugin <= 1.7.8 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information into Log File vulnerability in Tribulant Slideshow Gallery.This issue affects Slideshow Gallery: from n/a through 1.7.8.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Tribulant
Products
Slideshow Gallery
CVE-2024-31308

WordPress WP Import Export Lite & WP Import Export plugin <= 3.9.26 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in VJInfotech WP Import Export Lite.This issue affects WP Import Export Lite: from n/a through 3.9.26.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Vjinfotech Wordpress
Products
Wp Import Export Lite Wordpress
CVE-2024-31298

WordPress User Spam Remover plugin <= 1.0 - Sensitive Data Exposure via Log File vulnerability

Insertion of Sensitive Information into Log File vulnerability in Joel Hardi User Spam Remover.This issue affects User Spam Remover: from n/a through 1.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Joelhardi
Products
User Spam Remover
CVE-2024-25100

WordPress Coupon Referral Program plugin < 1.8.4 - Unauthenticated PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in WP Swings Coupon Referral Program allows Object Injection.This issue affects Coupon Referral Program: from n/a before 1.8.4.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Wpswings
Products
Coupon Referral Program
CVE-2023-52206

WordPress Page Builder: Live Composer Plugin <= 1.5.25 is vulnerable to PHP Object Injection

Deserialization of Untrusted Data vulnerability in Live Composer Team Page Builder: Live Composer live-composer-page-builder.This issue affects Page Builder: Live Composer: from n/a through 1.5.25.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Blueastral
Products
Page Builder\
CVE-2023-27459

WordPress User Registration plugin <= 2.3.2.1 - Authenticated PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in WPEverest User Registration.This issue affects User Registration: from n/a through 2.3.2.1.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Wpeverest
Products
User Registration User Registration \& Membership
CVE-2023-23649

WordPress MainWP Links Manager Extension Plugin <= 2.1 - Unauthenticated PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in MainWP MainWP Links Manager Extension.This issue affects MainWP Links Manager Extension: from n/a through 2.1.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Mainwp
Products
Mainwp Links Manager Extension
CVE-2025-24103

Symlink Validation Vulnerability Enabling Access to Protected User Data

This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. An app may be able to access protected user data.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Apple
Products
Macos
CVE-2026-39462

SenseLive X3050 Insufficiently Protected Credentials

A vulnerability exists in SenseLive X3050’s web management interface in which password updates are not reliably applied due to improper handling of credential changes on the backend. After the device undergoes a factory restore using the SenseLive Config 2.0 tool, the interface may indicate that the password update was successful; however, the system may continue to accept the previous or default credentials, demonstrating that the password-change process is not consistently enforced. Even after a factory reset, attempted password changes may fail to propagate correctly.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Senselive
Products
X3050 X3500 X3500 Firmware
CVE-2025-43220

Symlink Validation Flaw Enables Unauthorized Access to Protected User Data

This issue was addressed with improved validation of symlinks. This issue is fixed in iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to access protected user data.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Apple
Products
Ipados Macos Macos Sequoia and 2 more