Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16,394

Export CSV
CVE-2026-28139

WordPress Ajax Search Lite plugin <= 4.14.4 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Ajax Search Lite <= 4.14.4 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Wordpress Wp-dreams
Products
Wordpress Ajax Search
CVE-2026-5158

PostX <= 5.0.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Comments Block

The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'inputPlaceHolder' parameter in all versions up to, and including, 5.0.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpxpo
Products
Wordpress Postx - Gutenberg Blocks For Post Grid
CVE-2026-65548

WordPress Betheme theme <= 28.4.2 - Remote Code Execution (RCE) vulnerability

Contributor Remote Code Execution (RCE) in Betheme <= 28.4.2 versions.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Muffingroup Wordpress
Products
Betheme Wordpress
CVE-2026-65507

WordPress AIWU plugin <= 1.5.6 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in AIWU <= 1.5.6 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Sergey Wordpress
Products
Aiwu Wordpress
CVE-2026-66690

WordPress GiveWP plugin <= 4.16.5 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.5 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Nexcess Wordpress
Products
Givewp Wordpress
CVE-2026-66699

WordPress Dokan plugin <= 5.0.10 - Broken Access Control vulnerability

Custom role Broken Access Control in Dokan <= 5.0.10 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Dokan Wordpress
Products
Dokan Wordpress
CVE-2026-18501

UsersWP <= 1.2.69 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Badge Widget Variable Substitution

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Badge Widget Variable Substitution in all versions up to, and including, 1.2.69 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Stiofansisland Wordpress
Products
Userswp – Front-end Login Form, User Registration, User Profile & Members Directory Plugin For Wp Wordpress
CVE-2026-18325

Forminator Forms <= 1.56.1 - Unauthenticated Stored Cross-Site Scripting via Forged Upload Record via Select Field

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Forged Upload Record via Select Field in all versions up to, and including, 1.56.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is possible because Forminator_Core::sanitize_array() skips all filtering for keys prefixed with 'select-', and set_field_data() treats a submitted 'return' member as a trusted internal flag — allowing an unauthenticated attacker to forge and persist a complete upload field record with an arbitrary file_url value without any sanitization or validation.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpmudev
Products
Wordpress Forminator Forms – Contact Form, Payment Form & Custom Form Builder
CVE-2026-16746

MultiVendorX < 5.0.11 - Store Owner+ Cross-Store Commission Data Disclosure via commissions REST Endpoint

The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in one of its REST API endpoints, allowing any vendor-level user to read other vendors' commission and financial data.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Multivendorx Wordpress
Products
Multivendorx Wordpress