Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 20

Export CSV
CVE-2026-15306

Product Feed Manager For WooCommerce <= 7.6.1 - Reflected Cross-Site Scripting via 's' Search Parameter

The Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 's' Search Parameter in all versions up to, and including, 7.6.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Rextheme Wordpress
Products
Product Feed Manager For Woocommerce – Sell On 200+ Online Marketplaces Wordpress
CVE-2026-57417

WordPress Cart Lift plugin <= 3.1.57 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RexTheme Cart Lift cart-lift allows Stored XSS.This issue affects Cart Lift: from n/a through <= 3.1.57.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Rextheme Wordpress
Products
Cart Lift Wordpress
CVE-2023-52144

WordPress Product Feed Manager plugin <= 7.3.15 - Directory Traversal vulnerability

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in RexTheme Product Feed Manager.This issue affects Product Feed Manager: from n/a through 7.3.15.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Rextheme Wordpress
Products
Product Feed Manager Wordpress
CVE-2025-47452

WordPress WP VR plugin <= 8.5.26 - Arbitrary File Upload Vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in RexTheme WP VR wpvr allows Upload a Web Shell to a Web Server.This issue affects WP VR: from n/a through <= 8.5.26.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Rextheme
Products
Wp Vr
CVE-2025-24730

WordPress WP VR plugin <= 8.5.14 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RexTheme WP VR wpvr allows DOM-Based XSS.This issue affects WP VR: from n/a through <= 8.5.14.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Rextheme Wordpress
Products
Wp Vr Wordpress
CVE-2024-49680

WordPress WP VR plugin <= 8.5.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in RexTheme WP VR wpvr allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP VR: from n/a through <= 8.5.5.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Rextheme Wordpress
Products
Wp Vr Wordpress
CVE-2024-49293

WordPress WP VR plugin <= 8.5.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in RexTheme WP VR wpvr allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP VR: from n/a through <= 8.5.4.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Rextheme
Products
Wp Vr
CVE-2025-12005

WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress <= 8.5.41 - Improper Authorization to Authenticated (Contributor+) Plugin Settings Update

The WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress plugin for WordPress is vulnerable to unauthorized access of data in all versions up to, and including, 8.5.41. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor level access and above, to modify sensitive plugin options.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Rextheme Wordpress
Products
Wp Vr Wordpress
CVE-2025-6350

WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress <= 8.5.32 - Authenticated (Contributor+) Stored Cross-Site Scripting

The WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘hotspot-hover’ parameter in all versions up to, and including, 8.5.32 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Rextheme
Products
Wp Vr
CVE-2025-62885

WordPress WP VR plugin <= 8.5.48 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RexTheme WP VR wpvr allows DOM-Based XSS.This issue affects WP VR: from n/a through <= 8.5.48.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Rextheme Wordpress
Products
Wp Vr Wordpress
CVE-2023-6529

WP VR < 8.3.15 - Unauthenticated Plugin Downgrade leading to XSS

The WP VR WordPress plugin before 8.3.15 does not authorisation and CSRF in a function hooked to admin_init, allowing unauthenticated users to downgrade the plugin, thus leading to Reflected or Stored XSS, as previous versions have such vulnerabilities.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Rextheme
Products
Wp Vr
CVE-2023-1413

WP VR < 8.2.9 - Reflected XSS

The WP VR WordPress plugin before 8.2.9 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Rextheme
Products
Wp Vr
CVE-2023-0174

WP VR < 8.2.7 - Contributor+ Stored XSS

The WP VR WordPress plugin before 8.2.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Rextheme
Products
Wp Vr
CVE-2023-40663

WordPress WP VR Plugin <= 8.3.4 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Rextheme WP VR plugin <= 8.3.4 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Rextheme
Products
Wp Vr
CVE-2023-1414

WP VR < 8.3.0 - Subscriber+ Arbitrary Tour Update

The WP VR WordPress plugin before 8.3.0 does not have authorisation and CSRF checks in various AJAX actions, one in particular could allow any authenticated users, such as subscriber to update arbitrary tours

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Rextheme
Products
Wp Vr
CVE-2023-25708

WordPress WP VR – 360 Panorama and Virtual Tour Builder For WordPress Plugin <= 8.2.7 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in Rextheme WP VR – 360 Panorama and Virtual Tour Builder For WordPress plugin <= 8.2.7 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Rextheme
Products
Wp Vr
CVE-2022-47449

WordPress Cart Lift – Abandoned Cart Recovery for WooCommerce and EDD Plugin <= 3.1.5 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in RexTheme Cart Lift – Abandoned Cart Recovery for WooCommerce and EDD plugin <= 3.1.5 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Rextheme
Products
Cart Lift - Abandoned Cart Recovery For Woocommerce And Edd