Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16,394

Export CSV
CVE-2026-24545

WordPress QR Redirector plugin <= 2.0.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Nikki Blight QR Redirector allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects QR Redirector: from n/a through 2.0.3.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Nikki Blight Wordpress
Products
Qr Redirector Wordpress
CVE-2026-24582

WordPress FlexTable plugin <= 3.24.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in WPPOOL FlexTable allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects FlexTable: from n/a through 3.24.0.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress Wppool
Products
Wordpress Flextable
CVE-2026-24592

WordPress Auto Affiliate Links plugin <= 6.8.8.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Lucian Apostol Auto Affiliate Links allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Auto Affiliate Links: from n/a through 6.8.8.3.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Lucian Apostol Wordpress
Products
Auto Affiliate Links Wordpress
CVE-2026-24527

WordPress Autoship Cloud for WooCommerce Subscription Products plugin <= 2.14.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Patterns in the cloud Autoship Cloud for WooCommerce Subscription Products allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Autoship Cloud for WooCommerce Subscription Products: from n/a through 2.14.0.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Patterns In The Cloud Wordpress
Products
Autoship Cloud For Woocommerce Subscription Products Wordpress
CVE-2026-39436

WordPress CformsII plugin <= 15.1.3 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in bgermann CformsII allows Cross Site Request Forgery. This issue affects CformsII: from n/a through 15.1.3.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Bgermann Wordpress
Products
Cformsii Wordpress
CVE-2026-45209

WordPress MyCryptoCheckout plugin <= 2.161 - Broken Access Control vulnerability

Missing Authorization vulnerability in edward_plainview MyCryptoCheckout allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MyCryptoCheckout: from n/a through 2.161.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Edward Plainview Wordpress
Products
Mycryptocheckout Wordpress
CVE-2026-42763

WordPress SePay Gateway plugin <= 1.1.20 - Sensitive Data Exposure vulnerability

Missing Authorization vulnerability in SePay team SePay Gateway allows Retrieve Embedded Sensitive Data. This issue affects SePay Gateway: from n/a through 1.1.20.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Sepay Team Wordpress
Products
Sepay Gateway Wordpress
CVE-2026-32389

WordPress NanoCare theme < 1.2.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Linethemes NanoCare allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects NanoCare: from n/a before 1.2.2.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Linethemes Wordpress
Products
Nanocare Wordpress
CVE-2026-39661

WordPress SW Core plugin <= 1.7.18 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Magentech SW Core allows PHP Local File Inclusion. This issue affects SW Core: from n/a through 1.7.18.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Magentech Wordpress
Products
Sw Core Wordpress
CVE-2026-39642

WordPress Nyla theme <= 1.7 - Arbitrary Shortcode Execution vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in SpabRice Nyla allows Code Injection. This issue affects Nyla: from n/a through 1.7.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Spabrice Wordpress
Products
Nyla Wordpress
CVE-2026-27427

WordPress Geo Mashup plugin <= 1.13.18 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn Geo Mashup allows Stored XSS. This issue affects Geo Mashup: from n/a through 1.13.18.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Dylan Kuhn Wordpress
Products
Geo Mashup Wordpress
CVE-2026-24638

WordPress RepairBuddy plugin <= 4.1121 - Broken Access Control vulnerability

Missing Authorization vulnerability in Webful Creations RepairBuddy allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects RepairBuddy: from n/a through 4.1121.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Webful Creations Wordpress
Products
Repairbuddy Wordpress
CVE-2026-24590

WordPress Paid Videochat Turnkey Site plugin <= 7.3.23 - Broken Access Control vulnerability

Missing Authorization vulnerability in VideoWhisper.Com Paid Videochat Turnkey Site allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Paid Videochat Turnkey Site: from n/a through 7.3.23.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Videowhisper.com Wordpress
Products
Paid Videochat Turnkey Site Wordpress
CVE-2026-41471

Easy PayPal Events & Tickets < 1.4 Information Disclosure via QR Code Endpoint

The Easy PayPal Events & Tickets plugin for WordPress before version 1.4 contains an information disclosure vulnerability in the QR code scanning endpoint that allows unauthenticated attackers to enumerate and retrieve all customer order records. Attackers can iterate over sequential WordPress post IDs through the scan_qr.php endpoint to harvest the complete set of orders stored in the database without requiring authentication or prior knowledge of specific order identifiers.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Scott Paterson Wordpress
Products
Easy-paypal-events-tickets Wordpress
CVE-2022-50945

WordPress 3dady Real-Time Web Stats 1.0 Stored XSS

WordPress 3dady Real-Time Web Stats plugin 1.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by exploiting unsanitized input fields. Attackers can insert JavaScript payloads in the dady_input_text or dady2_input_text fields via the plugin options panel to execute arbitrary code when the page is viewed.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
3dady Wordpress
Products
Real-time Web Stats Wordpress
CVE-2021-47975

WordPress Plugin WP Learn Manager 1.1.2 Stored XSS

WP Learn Manager 1.1.2 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts through the `fieldtitle` parameter. Attackers can submit POST requests to the jslm_fieldordering page with XSS payloads in the fieldtitle field to execute arbitrary JavaScript when administrators view the field ordering interface.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress Wplearnmanager
Products
Wordpress Wp Learn Manager
CVE-2012-10027

WordPress Plugin WP-Property <= 1.35.0 PHP File Upload

WP-Property plugin for WordPress up to and including version 1.35.0 contains an unauthenticated file upload vulnerability in the third-party `uploadify.php` script. A remote attacker can upload arbitrary PHP files to a temporary directory without authentication, leading to remote code execution.

CVSS 4.0 · 9.3 Critical EPSS 2.1% KEV · Not listed
Vendors
Wordpress Wp-property Wp-property-hive
Products
Wordpress Wp-property Wordpress Plugin Wordpress Plugin
CVE-2026-24597

WordPress Organization chart plugin <= 1.7.5 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in WpDevArt Organization chart allows Cross Site Request Forgery. This issue affects Organization chart: from n/a through 1.7.5.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpdevart
Products
Wordpress Organization Chart
CVE-2026-24574

WordPress Export WP Page to Static HTML/CSS plugin <= 6.0.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Recorp Export WP Page to Static HTML/CSS allows Cross Site Request Forgery. This issue affects Export WP Page to Static HTML/CSS: from n/a through 6.0.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Myrecorp Wordpress
Products
Export Wp Page To Static Html/css Wordpress
CVE-2025-62745

WordPress Team Showcase plugin <= 1.22.28 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Team Showcase allows Stored XSS. This issue affects Team Showcase: from n/a through 1.22.28.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Pickplugins Wordpress
Products
Team Showcase Wordpress