Export limit exceeded: 26253 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 425948 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 425948 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 16394 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16,394

Export CSV
CVE-2026-42681

WordPress e2pdf plugin <= 1.32.14 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E2Pdf.Com e2pdf allows Reflected XSS. This issue affects e2pdf: from n/a through 1.32.14.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
E2pdf Wordpress
Products
E2pdf Wordpress
CVE-2026-42673

WordPress Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity plugin <= 3.3.6 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Logtivity Activity Logs Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity allows Retrieve Embedded Sensitive Data. This issue affects Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity: from n/a through 3.3.6.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Logtivity Wordpress
Products
Activity Logs, User Activity Tracking, Multisite Activity Log From Logtivity Wordpress
CVE-2026-42672

WordPress WP Directory Kit plugin <= 1.5.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wp Directory Kit WP Directory Kit allows Blind SQL Injection. This issue affects WP Directory Kit: from n/a through 1.5.1.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpdirectorykit
Products
Wordpress Wp Directory Kit
CVE-2026-42654

WordPress Wallet System for WooCommerce plugin <= 2.7.5 - Broken Authentication vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in WP Swings Wallet System for WooCommerce allows Password Recovery Exploitation. This issue affects Wallet System for WooCommerce: from n/a through 2.7.5.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpswings
Products
Wordpress Wallet System For Woocommerce
CVE-2026-39555

WordPress Askka theme <= 1.3.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Elated-Themes Askka allows Object Injection. This issue affects Askka: from n/a through 1.3.1.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Elated-themes Wordpress
Products
Askka Wordpress
CVE-2026-28116

WordPress Progress Planner plugin <= 1.9.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Emilia Projects Progress Planner allows Stored XSS. This issue affects Progress Planner: from n/a through 1.9.0.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Emiliaprojects Wordpress
Products
Progress Planner Wordpress
CVE-2026-49782

WordPress Elementor Website Builder plugin <= 4.1.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Elementor Elementor Website Builder allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Elementor Website Builder: from n/a through 4.1.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Elementor Wordpress
Products
Elementor Website Builder Wordpress
CVE-2026-8293

Really Simple Security < 9.5.10.1 - Authentication Bypass via Two-Factor OTP Skip

The Really Simple Security WordPress plugin before 9.5.10.1 does not enforce the second-factor challenge in two of its two-factor authentication REST endpoints, allowing an attacker who knows a user's password to obtain a WordPress authentication session for that user without completing the email OTP challenge.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Really-simple-plugins Wordpress
Products
Really Simple Security Wordpress
CVE-2026-2425

hiWeb Migration Simple <= 2.0.0.1 - Reflected Cross-Site Scripting via 'new_domain' Parameter

The hiWeb Migration Simple plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'new_domain' parameter in all versions up to, and including, 2.0.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrator into performing an action such as clicking on a link.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Hiweb Wordpress
Products
Migration Simple Wordpress
CVE-2026-42669

WordPress EventPrime plugin <= 4.3.2.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in EventPrime allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects EventPrime: from n/a through 4.3.2.0.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Theeventprime Wordpress
Products
Eventprime Wordpress
CVE-2026-9050

Slider Revolution 6.0.0-6.7.55 and 7.0.0-7.0.14 - Missing Authorization to Authenticated (Contributor+) Arbitrary Plugin Deactivation

The Slider Revolution plugin for WordPress in versions 6.0.0-6.7.55 and 7.0.0-7.0.14 is vulnerable to unauthorized modification of data. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Contributor-level access and above, to deactivate any active plugin installed on the site.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Revolution Slider Wordpress
Products
Slider Revolution Wordpress
CVE-2026-9048

Slider Revolution 7.0.0 - 7.0.14 - Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure

The Slider Revolution plugin for WordPress is vulnerable to Sensitive Information Exposure in versions 7.0.0 - 7.0.14, via the 'slider.get.full' AJAX Action. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including raw social media API credentials: the Instagram OAuth token, Flickr API key, YouTube Data API key, and Facebook App ID, stored in any configured slider's settings.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Revolution Slider Wordpress
Products
Slider Revolution Wordpress
CVE-2026-8206

Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions 6.0.0 to 6.0.6. This is due to the plugin accepting an arbitrary email address when a username is used in the password reset request. This makes it possible for unauthenticated attackers to send a password reset link for any user registered on the site to their own email address.

CVSS 3.1 · 9.8 Critical EPSS 1.3% KEV · Not listed
Vendors
Themeum Wordpress
Products
Kirki – Freeform Page Builder, Website Builder & Customizer Wordpress
CVE-2026-42675

WordPress Hydra Booking plugin <= 1.1.41 - Broken Access Control vulnerability

Missing Authorization vulnerability in Themefic Hydra Booking allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Hydra Booking: from n/a through 1.1.41.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Themefic Wordpress
Products
Hydra Booking Wordpress
CVE-2026-42676

WordPress myCred plugin <= 3.0.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in myCred allows Stored XSS. This issue affects myCred: from n/a through 3.0.4.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mycred Wordpress
Products
Mycred Wordpress
CVE-2026-42671

WordPress GeoDirectory plugin <= 2.8.157 - Broken Access Control vulnerability

Missing Authorization vulnerability in Paolo GeoDirectory allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects GeoDirectory: from n/a through 2.8.157.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Paolo Wordpress
Products
Geodirectory Wordpress
CVE-2026-48866

WordPress Gravity Forms plugin <= 2.10.0.1 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Rocketgenius Inc. Gravity Forms allows Path Traversal. This issue affects Gravity Forms: from n/a through 2.10.0.1.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Vendors
Rocketgenius Wordpress
Products
Gravityforms Wordpress
CVE-2026-48865

WordPress LearnPress plugin <= 4.3.6 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress LearnPress allows Reflected XSS. This issue affects LearnPress: from n/a through 4.3.6.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Thimpress Wordpress
Products
Learnpress Wordpress
CVE-2026-42682

WordPress wpForo Forum plugin <= 3.0.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in Tomdever wpForo Forum allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects wpForo Forum: from n/a through 3.0.6.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Tomdever Wordpress
Products
Wpforo Forum Wordpress