Export limit exceeded: 425892 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 16394 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16,394

Export CSV
CVE-2026-57402

WordPress Flexible Refund and Return Order for WooCommerce plugin <= 1.0.51 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdesk Flexible Refund and Return Order for WooCommerce flexible-refund-and-return-order-for-woocommerce allows Stored XSS.This issue affects Flexible Refund and Return Order for WooCommerce: from n/a through <= 1.0.51.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpdesk
Products
Wordpress Flexible Refund And Return Order For Woocommerce
CVE-2026-57403

WordPress GD Security Headers plugin <= 1.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Milan Petrovic GD Security Headers gd-security-headers allows Reflected XSS.This issue affects GD Security Headers: from n/a through <= 1.8.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Milan Petrovic Wordpress
Products
Gd Security Headers Wordpress
CVE-2026-57408

WordPress Peach Payments Gateway plugin <= 4.0.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in peachpayments Peach Payments Gateway wc-peach-payments-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Peach Payments Gateway: from n/a through <= 4.0.2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Peachpayments Wordpress
Products
Peach Payments Gateway Wordpress
CVE-2026-57409

WordPress Active Products Tables for WooCommerce plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows DOM-Based XSS.This issue affects Active Products Tables for WooCommerce: from n/a through <= 1.1.0.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Realmag777 Wordpress
Products
Active Products Tables For Woocommerce Wordpress
CVE-2026-57414

WordPress ChatBot for eCommerce – WoowBot plugin <= 4.6.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuantumCloud ChatBot for eCommerce &#8211; WoowBot woowbot-woocommerce-chatbot allows Stored XSS.This issue affects ChatBot for eCommerce &#8211; WoowBot: from n/a through <= 4.6.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Quantumcloud Wordpress
Products
Chatbot For Ecommerce &#8211; Woowbot Wordpress
CVE-2026-57415

WordPress Gift Vouchers plugin <= 4.7.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codemenschen Gift Vouchers gift-voucher allows Stored XSS.This issue affects Gift Vouchers: from n/a through <= 4.7.0.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Codemenschen Wordpress
Products
Gift Vouchers Wordpress
CVE-2026-57420

WordPress Author Box WP Lens plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Netrr Author Box WP Lens author-box-for-divi allows Stored XSS.This issue affects Author Box WP Lens: from n/a through <= 2.1.5.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Netrr Wordpress
Products
Author Box Wp Lens Wordpress
CVE-2026-57421

WordPress CRM Perks Forms plugin <= 1.1.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks CRM Perks Forms crm-perks-forms allows Reflected XSS.This issue affects CRM Perks Forms: from n/a through <= 1.1.7.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Crmperks Wordpress
Products
Crm Perks Forms Wordpress
CVE-2026-57693

WordPress Ad Inserter plugin <= 2.8.11 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spacetime Ad Inserter ad-inserter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ad Inserter: from n/a through <= 2.8.11.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Spacetime Wordpress
Products
Ad Inserter Wordpress
CVE-2026-57702

WordPress Amelia plugin <= 2.4.2 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Melograno Venture Studio Amelia ameliabooking allows Blind SQL Injection.This issue affects Amelia: from n/a through <= 2.4.2.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Melograno Venture Studio Wordpress
Products
Amelia Wordpress
CVE-2026-57710

WordPress WoowBot Pro Max plugin <= 14.1.7 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in quantumcloud WoowBot Pro Max woowbot-pro-max allows Using Malicious Files.This issue affects WoowBot Pro Max: from n/a through <= 14.1.7.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Quantumcloud Wordpress
Products
Woowbot Pro Max Wordpress
CVE-2026-57711

WordPress SupportCandy plugin <= 3.4.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PSM Plugins SupportCandy supportcandy allows Stored XSS.This issue affects SupportCandy: from n/a through <= 3.4.8.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Psm Plugins Wordpress
Products
Supportcandy Wordpress
CVE-2026-57718

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.12 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through <= 2.0.12.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Unlimited-elements Wordpress
Products
Unlimited Elements For Elementor (free Widgets, Addons, Templates) Wordpress
CVE-2026-57719

WordPress Aimogen Pro plugin <= 2.8.3 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in CodeRevolution Aimogen Pro aimogen-pro allows Using Malicious Files.This issue affects Aimogen Pro: from n/a through <= 2.8.3.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Coderevolution Wordpress
Products
Aimogen Pro Wordpress
CVE-2026-57740

WordPress AcyMailing SMTP Newsletter plugin <= 10.11.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in AcyMailing Newsletter Team AcyMailing SMTP Newsletter acymailing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AcyMailing SMTP Newsletter: from n/a through <= 10.11.1.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Acymailing Newsletter Team Wordpress
Products
Acymailing Smtp Newsletter Wordpress
CVE-2026-57770

WordPress Grand Photography theme <= 5.7.8 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Photography grandphotography allows Object Injection.This issue affects Grand Photography: from n/a through <= 5.7.8.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Themegoods Wordpress
Products
Grand Photography Wordpress
CVE-2026-57798

WordPress NewsPlus Shortcodes plugin <= 4.2.0 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in SaurabhSharma NewsPlus Shortcodes newsplus-shortcodes allows PHP Local File Inclusion.This issue affects NewsPlus Shortcodes: from n/a through <= 4.2.0.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Saurabhsharma Wordpress
Products
Newsplus Shortcodes Wordpress
CVE-2026-57725

WordPress Kirki plugin <= 6.0.11 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Kirki kirki allows Stored XSS.This issue affects Kirki: from n/a through <= 6.0.11.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Themeum Wordpress
Products
Kirki Wordpress
CVE-2026-57734

WordPress tagDiv Composer plugin <= 5.4.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Composer td-composer allows Reflected XSS.This issue affects tagDiv Composer: from n/a through <= 5.4.3.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Tagdiv Wordpress
Products
Tagdiv Composer Wordpress
CVE-2026-57791

WordPress Brook theme <= 2.9.0 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Brook brook allows PHP Local File Inclusion.This issue affects Brook: from n/a through <= 2.9.0.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Thememove Wordpress
Products
Brook Wordpress