Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16,394

Export CSV
CVE-2026-57376

WordPress ElementInvader Addons for Elementor plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows DOM-Based XSS.This issue affects ElementInvader Addons for Elementor: from n/a through <= 1.4.3.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Elementinvader Wordpress
Products
Elementinvader Addons For Elementor Wordpress
CVE-2026-57377

WordPress WowAddons plugin <= 1.6.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in WPXPO WowAddons product-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WowAddons: from n/a through <= 1.6.8.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpxpo
Products
Wordpress Wowaddons
CVE-2026-57389

WordPress Groundhogg plugin <= 4.4.1 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Adrian Tobey Groundhogg groundhogg allows Path Traversal.This issue affects Groundhogg: from n/a through <= 4.4.1.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Adrian Tobey Wordpress
Products
Groundhogg Wordpress
CVE-2026-57395

WordPress Tourfic plugin <= 2.22.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in Themefic Tourfic tourfic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tourfic: from n/a through <= 2.22.5.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Themefic Wordpress
Products
Tourfic Wordpress
CVE-2026-65546

WordPress Qode Tours plugin <= 3.1.3.1 - SQL Injection vulnerability

Unauthenticated SQL Injection in Qode Tours <= 3.1.3.1 versions.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Qode Wordpress
Products
Qode Tours Wordpress
CVE-2026-65551

WordPress Breakdance plugin < 2.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in Soflyy Breakdance allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Breakdance: from n/a before 2.7.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Soflyy Wordpress
Products
Breakdance Wordpress
CVE-2026-65565

WordPress Survey Maker plugin <= 5.2.3.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Survey Maker <= 5.2.3.3 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Ays-pro Wordpress
Products
Survey Maker Wordpress
CVE-2026-65573

WordPress Abelle theme <= 1.22 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Abelle <= 1.22 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Themerex Wordpress
Products
Abelle Wordpress
CVE-2026-66709

WordPress CTX Feed plugin <= 6.6.42 - Remote Code Execution (RCE) vulnerability

Shop manager Remote Code Execution (RCE) in CTX Feed <= 6.6.42 versions.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Webappick Wordpress
Products
Ctx Feed Wordpress