Export limit exceeded: 425864 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 16307 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16,307

Export CSV
CVE-2026-61980

WordPress OMGF Pro plugin <= 5.2.7 - Arbitrary File Download vulnerability

Unauthenticated Arbitrary File Download in OMGF Pro <= 5.2.7 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Daan.dev Wordpress
Products
Omgf Pro Wordpress
CVE-2026-61984

WordPress WPMobile.App plugin <= 11.77 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WPMobile.App <= 11.77 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Amauri Wordpress
Products
Wpmobile.app Wordpress
CVE-2026-28170

WordPress Blog Floating Button plugin <= 1.4.20 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Blog Floating Button <= 1.4.20 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Meril Wordpress
Products
Blog Floating Button Wordpress
CVE-2026-27544

WordPress QA Analytics plugin <= 5.2.0.0 - Remote Code Execution (RCE) vulnerability

Unauthenticated Remote Code Execution (RCE) in QA Analytics <= 5.2.0.0 versions.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Quarka Wordpress
Products
Qa Analytics Wordpress
CVE-2026-13177

Eventin < 4.1.20 - Contributor+ Order Information Disclosure via IDOR

The Eventin WordPress plugin before 4.1.20 does not properly restrict access to individual order records, allowing users with contributor-level access and above to read other customers' order data including personal information by iterating order identifiers.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Eventin Wordpress
Products
Eventin Wordpress
CVE-2026-17022

Salon Booking System – Free Version < 10.30.34 - Unauthenticated Booking Information Disclosure via Booking Wizard

The Salon Booking System WordPress plugin before 10.30.34 does not properly validate a booking's ownership token before loading it in its booking-wizard confirmation steps, allowing unauthenticated attackers to disclose other customers' booking records, including personal information, by supplying a sequential booking identifier.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Salonbookingsystem Wordpress
Products
Salon Booking System Wordpress
CVE-2026-49466

Draft List - Contributor Stored Cross-Site Scripting via Draft Title in Custom Drafts Template Attributes

Draft List is a WordPress plugin to manage and promote unpublished content. Versions 2.6.3 and below are vulnerable to stored Cross-Site Scripting (XSS) in the `[drafts]` shortcode and Draft List widget when the documented custom `template` option places the `{{draft}}` placeholder inside an HTML attribute. The vulnerable code inserts the raw draft `post_title` into `{{draft}}` when the current viewer cannot edit posts. Because the template is sanitized before `{{draft}}` replacement, a Contributor can store a quote-only title payload that breaks out of an attribute in a site-configured Draft List template and executes JavaScript for visitors who load the public page. Version 2.6.4 fixes the issue.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Dartiss Wordpress
Products
Draft List Wordpress
CVE-2026-19091

GeoDirectory <= 2.8.169 - Authenticated (Subscriber+) Arbitrary File Deletion via 'post_type' Parameter via Query-String Bypass in geodir_save_post + geodir_delete_revision

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_revision function in all versions up to, and including, 2.8.169. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). By placing post_type=attachment exclusively in the query string to bypass the consistency check, an attacker can convert an auto-draft GeoDirectory listing into a WordPress attachment with attacker-controlled file paths injected into attachment metadata, which the delete_revision handler then dereferences and unlinks without any post-type or path validation.

CVSS 3.1 · 8.1 High EPSS 1.1% KEV · Not listed
Vendors
Paoltaia Wordpress
Products
Geodirectory – Wp Business Directory Plugin And Classified Listings Directory Wordpress
CVE-2026-19088

ShopEngine < 4.9.3 - Customer PII Disclosure via Forced Authentication

The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin before 4.9.3 does not protect one of its authentication endpoints against CSRF, allowing an attacker to log a victim into an attacker-controlled account, so that the billing and shipping details the victim then enters at checkout are stored under and readable by the attacker.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Roxnor Wordpress
Products
Shopengine Elementor Woocommerce Builder Addon Wordpress