Export limit exceeded: 425898 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 16394 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16,394

Export CSV
CVE-2026-22332

WordPress Tutor LMS Pro plugin <= 3.9.6 - SQL Injection vulnerability

Unauthenticated SQL Injection in Tutor LMS Pro <= 3.9.6 versions.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Themeum Wordpress
Products
Tutor Lms Wordpress
CVE-2026-42385

WordPress Profile Builder Pro plugin <= 3.15.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Profile Builder Pro <= 3.15.0 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Cozmoslabs Wordpress
Products
Profile Builder Wordpress
CVE-2025-69140

WordPress SweetDate Core plugin < 1.1.5 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in SweetDate Core < 1.1.5 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Seventhqueen Wordpress
Products
Sweet Date Wordpress
CVE-2026-54828

WordPress Motors plugin <= 1.4.109 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Motors <= 1.4.109 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Stylemix Wordpress
Products
Motors Wordpress
CVE-2026-54848

WordPress APIExperts Square for WooCommerce plugin <= 4.7.3 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal APIExperts Square for WooCommerce allows Retrieve Embedded Sensitive Data. This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.3.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Saad Iqbal Wordpress
Products
Apiexperts Square For Woocommerce Wordpress
CVE-2026-56006

WordPress H5P plugin <= 1.17.6 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in H5P <= 1.17.6 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
H5p Wordpress
Products
H5p Wordpress
CVE-2026-56050

WordPress PPOM for WooCommerce plugin <= 33.0.18 - Broken Access Control vulnerability

Improper Access Control vulnerability in Themeisle PPOM for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PPOM for WooCommerce: from n/a through 33.0.18.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Themeisle Wordpress
Products
Ppom For Woocommerce Wordpress
CVE-2026-12079

Dokan Pro <= 5.0.4 - Authenticated (Subscriber+) SQL Injection via 'orderby' Parameter

The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the ’orderby’ parameter in all versions up to, and including, 5.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wedevs Wordpress
Products
Dokan Pro Wordpress