Export limit exceeded: 425863 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16,307

Export CSV
CVE-2026-66456

WordPress Profile Extra Fields by BestWebSoft plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in Profile Extra Fields by BestWebSoft <= 1.3.4 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Bestwebsoft Wordpress
Products
Profile Extra Fields Wordpress
CVE-2026-66704

WordPress Gutenverse Companion plugin <= 2.5.1 - Server Side Request Forgery (SSRF) vulnerability

Unauthenticated Server Side Request Forgery (SSRF) in Gutenverse Companion <= 2.5.1 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Jegstudio Wordpress
Products
Gutenverse Wordpress
CVE-2026-73188

WordPress KiviCare plugin <= 4.5.1 - Sensitive Data Exposure vulnerability

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Duplicate to CVE-2026-13610.

CVSS n/a EPSS n/a KEV · Not listed
Vendors
Iqonic Wordpress
Products
Kivicare Wordpress
CVE-2026-57804

WordPress TheGem Theme Elements (for Elementor) plugin < 5.12.1.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CodexThemes TheGem Theme Elements (for Elementor) allows PHP Local File Inclusion. This issue affects TheGem Theme Elements (for Elementor): from n/a before 5.12.1.1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Codexthemes Wordpress
Products
Thegem Theme Elements (for Elementor) Wordpress
CVE-2026-19794

WP-Stats <= 2.56 - Unauthenticated Stored Cross-Site Scripting

The WP-Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.56 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Gamerz Wordpress
Products
Wp-stats Wordpress
CVE-2026-18109

W3 Total Cache <= 2.10.3 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 2.10.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the Lazy Load Images feature of W3 Total Cache is enabled, as the unsafe re-emission occurs exclusively within the LazyLoad mutator's img tag rewriting step.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Boldgrid Wordpress
Products
W3 Total Cache Wordpress
CVE-2026-65480

WordPress TheGem theme < 5.12.1.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem allows DOM-Based XSS. This issue affects TheGem: from n/a before 5.12.1.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Codexthemes Wordpress
Products
Thegem Wordpress