Export limit exceeded: 425979 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 425979 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 425979 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Expected end of text, found ':' (at char 28), (line:1, col:29)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,979

Export CSV
CVE-2026-110987

RegistrationMagic < 6.1.0.4 - Reflected XSS via 'rm_tr' and 'rm_ur' Parameters

The RegistrationMagic WordPress plugin before 6.1.0.4 does not properly escape a user-supplied value before printing it inside an inline script block on several of its admin screens, allowing unauthenticated attackers to inject arbitrary JavaScript that executes in the session of an administrator who is tricked into opening a crafted link.

CVSS n/a EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Registrationmagic
CVE-2026-110989

RegistrationMagic 5.2.3.1 - 6.1.0.3 - Unauthenticated Non-Admin User Profile Modification via Form Submission

The RegistrationMagic WordPress plugin before 6.1.0.4 does not verify ownership of the submitted email address before updating the associated WordPress user account, allowing unauthenticated attackers to overwrite the profile fields of arbitrary non-administrator users by submitting a public form that contains name and primary-email fields.

CVSS n/a EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Registrationmagic
CVE-2026-114451

Kadence Memberships < 4.0.6 - Unauthenticated Table Collation Downgrade via 'rcp-action' Parameter

The Membership Plugin WordPress plugin before 4.0.6 does not perform any authorization or CSRF check before running a schema-altering database maintenance routine, allowing unauthenticated users to convert the Membership Plugin WordPress plugin before 4.0.6's own tables to a narrower character set, which irreversibly replaces every 4-byte character (such as emoji and some CJK characters) in the membership level, discount code and payment records with a question mark.

CVSS n/a EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Kadence Memberships
CVE-2026-114452

Kadence Memberships 3.2.17 - 4.0.5 - Subscriber+ Stripe Client Secret Disclosure and Payment Method Manipulation via IDOR

The Membership Plugin WordPress plugin before 4.0.6 does not verify that the membership referenced in a saved-card payment request belongs to the user making it, allowing subscriber-level members to disclose another member's Stripe payment client secret and attach a payment method of their choosing to another member's pending payment.

CVSS n/a EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Kadence Memberships
CVE-2026-127048

Lazy Blocks < 3.0.0 - Unauthenticated RCE

The Custom Block Builder WordPress plugin before 3.0.0 does not properly deny unauthorised requests to its REST routes, as its permission checks return a non-error response that WordPress treats as granted, allowing unauthenticated users to execute arbitrary PHP code on the server.

CVSS n/a EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Lazy Blocks
CVE-2026-82568

Give - Peer-to-Peer <= 2.9.3 - Unauthenticated SQL Injection via 'sort' Parameter

The Give - Peer-to-Peer plugin for WordPress is vulnerable to time-based SQL Injection via the 'sort' parameter in all versions up to, and including, 2.9.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Successful exploitation requires the existence of at least one Peer-to-Peer campaign. This vulnerability can be combined with CVE-2026-82663 to achieve unauthenticated remote code execution.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Givewp Wordpress-extensions
Products
Give - Peer-to-peer Give Peer To Peer
CVE-2026-82663

Give - Peer-to-Peer <= 2.9.5 - Authorization Bypass to Team Modification and Media Upload

The Give - Peer-to-Peer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.9.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers who know or discover an existing campaign and team ID to modify the team's name, story, goal, access and notification settings, set its profile image URL, and upload WordPress-allowed media files as parentless attachments. This vulnerability can be combined with CVE-2026-82568 to achieve unauthenticated remote code execution.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Givewp Wordpress-extensions
Products
Give - Peer-to-peer Give - Peer-to-peer
CVE-2026-129467

GeoPulse 1.5.0 through 2.3.0 IDOR via Geocoding Place-Details Endpoint

GeoPulse 1.5.0 through 2.3.0 contains an insecure direct object reference vulnerability in GET /api/v1/places/geocoding/{id} that allows authenticated users to read other users' private locations. Attackers can enumerate sequential reverse_geocoding_location ids to retrieve other users' custom place names, city, country, coordinates and bounding boxes from their history.

CVSS 4.0 · 5.3 Medium EPSS n/a KEV · Not listed
Vendors
Tess1o
Products
Geopulse
CVE-2026-124995

WordPress Track, Analyze & Optimize by WP Tao plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michal Jaworski Track, Analyze & Optimize by WP Tao wp-tao allows Stored XSS.This issue affects Track, Analyze & Optimize by WP Tao: from n/a through 1.3.1.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed
Vendors
Michal Jaworski Wordpress-extensions
Products
Track, Analyze & Optimize By Wp Tao Track, Analyze & Optimize By Wp Tao
CVE-2026-125813

WordPress Survey Maker plugin <= 5.2.4.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Survey Maker survey-maker allows Reflected XSS.This issue affects Survey Maker: from n/a through 5.2.4.3.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed
Vendors
Ays-pro Wordpress-extensions
Products
Survey Maker Survey Maker
CVE-2026-124254

WordPress EWWW Image Optimizer plugin <= 8.9.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Exactly WWW LLC EWWW Image Optimizer ewww-image-optimizer allows Stored XSS.This issue affects EWWW Image Optimizer: from n/a through 8.9.1.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed
Vendors
Exactly Www Llc Wordpress-extensions
Products
Ewww Image Optimizer Ewww Image Optimizer
CVE-2026-125791

WordPress Orphans plugin <= 3.4.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iWorks Orphans sierotki allows Stored XSS.This issue affects Orphans: from n/a through 3.4.6.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed
Vendors
Iworks Wordpress-extensions
Products
Orphans Orphans
CVE-2026-125780

WordPress Woocommerce Custom Product Addons Pro plugin <= 5.9.0 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Acowebs Woocommerce Custom Product Addons Pro woo-custom-product-addons-pro allows Path Traversal.This issue affects Woocommerce Custom Product Addons Pro: from n/a through 5.9.0.

CVSS 3.1 · 7.5 High EPSS n/a KEV · Not listed
Vendors
Acowebs Wordpress-extensions
Products
Woocommerce Custom Product Addons Pro Woocommerce Custom Product Addons Pro
CVE-2026-125733

WordPress ShopLentor plugin <= 3.5.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DevItems ShopLentor woolentor-addons allows Reflected XSS.This issue affects ShopLentor: from n/a through 3.5.7.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed
Vendors
Devitems Wordpress-extensions
Products
Shoplentor Shoplentor
CVE-2026-125447

WordPress Kali Forms plugin <= 2.4.31 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kaliforms Kali Forms kali-forms allows Reflected XSS.This issue affects Kali Forms: from n/a through 2.4.31.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed
Vendors
Kaliforms Wordpress-extensions
Products
Kali Forms Kali Forms
CVE-2026-128893

WordPress Wise Chat plugin <= 3.4.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcin Wise Chat wise-chat allows Reflected XSS.This issue affects Wise Chat: from n/a through 3.4.5.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed
Vendors
Marcin Wordpress-extensions
Products
Wise Chat Wise Chat
CVE-2026-125765

WordPress ShortPixel Adaptive Images plugin <= 3.11.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShortPixel ShortPixel Adaptive Images shortpixel-adaptive-images allows Stored XSS.This issue affects ShortPixel Adaptive Images: from n/a through 3.11.6.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed
Vendors
Shortpixel Wordpress-extensions
Products
Shortpixel Adaptive Images Shortpixel Adaptive Images
CVE-2026-125798

WordPress Smart Online Order for Clover plugin <= 1.6.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zaytech Smart Online Order for Clover clover-online-orders allows DOM-Based XSS.This issue affects Smart Online Order for Clover: from n/a through 1.6.6.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed
Vendors
Wordpress-extensions Zaytech
Products
Smart Online Order For Clover Smart Online Order For Clover