Search vulnerabilities

Expected end of text, found ':' (at char 28), (line:1, col:29)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,959

Export CSV
CVE-2026-125857

WordPress Dynamic User Directory plugin <= 2.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sarah Giles Dynamic User Directory dynamic-user-directory allows Stored XSS.This issue affects Dynamic User Directory: from n/a through 2.4.

CVSS 3.1 · 6.5 Medium EPSS n/a KEV · Not listed
Vendors
Sarah Giles Wordpress-extensions
Products
Dynamic User Directory Dynamic User Directory
CVE-2026-125443

WordPress WPJAM Basic plugin <= 7.1.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Denishua WPJAM Basic wpjam-basic allows DOM-Based XSS.This issue affects WPJAM Basic: from n/a through 7.1.2.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed
Vendors
Denishua Wordpress-extensions
Products
Wpjam Basic Wpjam Basic
CVE-2026-125832

WordPress WP Data Access plugin <= 5.5.92 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Passionate Programmer Peter WP Data Access wp-data-access allows SQL Injection.This issue affects WP Data Access: from n/a through 5.5.92.

CVSS 3.1 · 8.5 High EPSS n/a KEV · Not listed
Vendors
Passionate Programmer Peter Wordpress-extensions
Products
Wp Data Access Wp Data Access
CVE-2026-125828

WordPress BookIt plugin <= 2.6.0.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP BookIt bookit allows Stored XSS.This issue affects BookIt: from n/a through 2.6.0.7.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed
Vendors
Liquid Web / Stellarwp Wordpress-extensions
Products
Bookit Bookit
CVE-2025-71466

GPAC before 26.02.0 NULL Pointer Dereference via m2tsdmx_update_sdt

GPAC before 26.02.0 contains a NULL pointer dereference vulnerability in m2tsdmx_update_sdt() in src/filters/dmx_m2ts.c that allows attackers to crash the MPEG-2 TS demuxer. Attackers can supply a crafted .ts file with an invalid service descriptor leaving service or provider names NULL to crash MP4Box and cause denial of service.

CVSS 4.0 · 6.8 Medium EPSS n/a KEV · Not listed
Vendors
Gpac
Products
Gpac
CVE-2025-71467

GPAC before 26.02.0 NULL Pointer Dereference via gf_node_get_field_by_name

GPAC before 26.02.0 contains a NULL pointer dereference vulnerability in gf_node_get_field_by_name() in src/scenegraph/base_scenegraph.c that lets attackers crash applications. Attackers can supply a crafted XMT scene referencing a never-created node to crash MP4Box or GPAC scene loader applications, causing denial of service.

CVSS 4.0 · 6.8 Medium EPSS n/a KEV · Not listed
Vendors
Gpac
Products
Gpac
CVE-2025-71468

GPAC before 26.02.0 NULL Pointer Dereference via gf_dash_group_get_audio_channels

GPAC before 26.02.0 contains a NULL pointer dereference vulnerability in gf_dash_group_get_audio_channels() in src/media_tools/dash_client.c that allows attackers to crash applications via crafted DASH manifests. Attackers can supply an MPD whose AudioChannelConfiguration element omits schemeIdUri or value, crashing MP4Box or GPAC DASH clients and causing denial of service.

CVSS 4.0 · 6.8 Medium EPSS n/a KEV · Not listed
Vendors
Gpac
Products
Gpac
CVE-2025-71469

GPAC before 26.02.0 Type Confusion DoS via XMT/BT Scene Loader

GPAC before 26.02.0 contains a type confusion vulnerability in ctxload_process() that passes non-object descriptors to ODS_SetupOD() without checking the descriptor tag. Attackers can supply a crafted XMT file with a URL-bearing descriptor that crashes MP4Box or other GPAC-based applications in gf_scene_ns_connect_object(), causing denial of service.

CVSS 4.0 · 6.8 Medium EPSS n/a KEV · Not listed
Vendors
Gpac
Products
Gpac
CVE-2026-129490

littlefs through 2.11.3 Type Confusion in lfs_dir_traverse via lfs_migrate

littlefs through 2.11.3, when built with LFS_MIGRATE, contains a type confusion vulnerability in lfs_dir_traverse() that treats a stack lfs_diskoff struct as an lfs_attr array. Attackers can supply a crafted littlefs v1 image whose metadata is read as LFS_FROM_USERATTRS during migration, causing out-of-bounds stack reads and process crashes.

CVSS 4.0 · 6.8 Medium EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-124259

WordPress Events Made Easy plugin <= 3.3.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Franky Events Made Easy events-made-easy allows Reflected XSS.This issue affects Events Made Easy: from n/a through 3.3.5.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed
Vendors
Franky Wordpress-extensions
Products
Events Made Easy Events Made Easy
CVE-2026-125769

WordPress Advanced Form Integration plugin <= 2.11.3 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in Nasir Ahmed Advanced Form Integration advanced-form-integration allows Privilege Escalation.This issue affects Advanced Form Integration: from n/a through 2.11.3.

CVSS 3.1 · 9.8 Critical EPSS n/a KEV · Not listed
Vendors
Nasirahmed Wordpress-extensions
Products
Advanced Form Integration Advanced Form Integration
CVE-2026-129468

Netcccyun dnsmgr 2.18 before 2.22 Missing Authorization via get_domain_default_line

Netcccyun dnsmgr 2.18 before 2.22 contains a missing authorization vulnerability in POST /cloudflare/get_domain_default_line that allows restricted users to access domains outside their permissions. Restricted sub-users or single-domain logins can iterate the domain_id parameter to enumerate panel domain ids and read each domain's DNS line list and default line.

CVSS 4.0 · 5.3 Medium EPSS n/a KEV · Not listed
Vendors
Netcccyun
Products
Dnsmgr
CVE-2026-129453

DrayTek Vigor2960 File Existence Check mainfunction.cgi check_file_exist heap-based overflow

A vulnerability was found in DrayTek Vigor2960 1.5.1.6. This issue affects the function check_file_exist of the file /cgi-bin/mainfunction.cgi of the component File Existence Check. Performing a manipulation of the argument upload_name results in heap-based buffer overflow. The attack may be initiated remotely. The exploit has been made public and could be used. Upgrading to version 1.5.1.7 is capable of addressing this issue. Upgrading the affected component is recommended. The vendor recommends: "1.5.1.6 isn't the latest version of 2960, the latest version fixes many security issues. And we have another one in our release plan which should solve the issues reported."

CVSS 4.0 · 9.4 Critical EPSS n/a KEV · Not listed
Vendors
Draytek
Products
Vigor2960 Vigor2960 Firmware
CVE-2026-125765

WordPress ShortPixel Adaptive Images plugin <= 3.11.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShortPixel ShortPixel Adaptive Images shortpixel-adaptive-images allows Stored XSS.This issue affects ShortPixel Adaptive Images: from n/a through 3.11.6.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-125793

WordPress Flexmls® IDX plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in flexmls Flexmls® IDX flexmls-idx allows Reflected XSS.This issue affects Flexmls® IDX: from n/a through 4.1.2.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-128893

WordPress Wise Chat plugin <= 3.4.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcin Wise Chat wise-chat allows Reflected XSS.This issue affects Wise Chat: from n/a through 3.4.5.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-125799

WordPress Flow-Flow Social Stream plugin <= 5.0.5 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Looks Awesome Flow-Flow Social Stream flow-flow-social-streams allows Retrieve Embedded Sensitive Data.This issue affects Flow-Flow Social Stream: from n/a through 5.0.5.

CVSS 3.1 · 7.5 High EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-125447

WordPress Kali Forms plugin <= 2.4.31 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kaliforms Kali Forms kali-forms allows Reflected XSS.This issue affects Kali Forms: from n/a through 2.4.31.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-125733

WordPress ShopLentor plugin <= 3.5.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DevItems ShopLentor woolentor-addons allows Reflected XSS.This issue affects ShopLentor: from n/a through 3.5.7.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed
Vendors
—
Products
—