Export limit exceeded: 425864 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 16394 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16,394

Export CSV
CVE-2026-66685

WordPress Featured Video Plus plugin <= 2.3.3 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Featured Video Plus <= 2.3.3 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Alex Wordpress
Products
Featured Video Plus Wordpress
CVE-2026-15209

JS Help Desk – AI-Powered Support & Ticketing System < 3.1.5 - Subscriber+ Cross-User Support Ticket Disclosure via IDOR

The JS Help Desk WordPress plugin before 3.1.5 does not verify that the requesting user owns the ticket being loaded: a low-privileged authenticated user can supply another user's ticket ID and read that ticket's contents, including the reporter's PII and message body.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Jshelpdesk Wordpress
Products
Jshelpdesk Wordpress
CVE-2026-14817

Element Pack Elementor Addons < 8.7.13 - Contributor+ DOM-Based Stored XSS via uikit Data Attributes

The Element Pack Addons for Elementor WordPress plugin before 8.7.13 does not sanitize option values passed through certain data attributes before a bundled front-end library re-parses and renders them in the browser, allowing users with contributor-level access or higher to inject arbitrary JavaScript that executes in the session of any visitor who views the affected content.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Bdthemes Wordpress
Products
Element Pack Addons For Elementor Wordpress
CVE-2026-16540

Simply Schedule Appointments < 1.6.12.6 - Unauthenticated Appointment Data Disclosure and Mass Deletion via purge Endpoint

The Simply Schedule Appointments WordPress plugin before 1.6.12.6 does not correctly restrict a bulk appointment operation to the requester's own records, allowing unauthenticated users to retrieve the personal data of all appointments across the site and, on premium editions, to permanently delete them.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Nsqua Wordpress
Products
Simply Schedule Appointments Wordpress
CVE-2026-16532

Link Library < 7.9.3 - Unauthenticated SQL Injection via the Front-End Link Submission Form

The Link Library WordPress plugin before 7.9.3 does not properly sanitise and escape a user-supplied value before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Link Library Project Wordpress
Products
Link Library Wordpress
CVE-2026-16968

GeoDirectory < 2.8.168 - Contributor+ User Email Disclosure via geodir_json_search_users

The GeoDirectory WordPress plugin before 2.8.168 does not restrict a user-search handler to users allowed to list users, allowing any authenticated user with Contributor-level access or higher to retrieve the email addresses of all registered users, including administrators.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpgeodirectory
Products
Wordpress Geodirectory
CVE-2025-15677

GeoDirectory < 2.8.110 - Editor+ Stored XSS via Place Categories

The GeoDirectory WordPress plugin before 2.8.110 does not sanitise and escape a place-category setting before outputting it back in an admin page, allowing high-privilege users such as editors and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in a multisite setup).

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpgeodirectory
Products
Wordpress Geodirectory
CVE-2026-15210

Login/Signup with Phone Number, OTP Verification < 1.8.71 - Unauthenticated Account Takeover via OTP Brute Force

The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guess, and an unauthenticated user can request a login code for any account. Because the code is a short numeric OTP, an attacker can brute-force it and take over any account, including an administrator's.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Glboy Wordpress
Products
Otp Login With Phone Number, Otp Verification Wordpress
CVE-2026-15372

WP 2FA < 4.1.0 - Two-Factor Authentication Bypass via Passkeys Provider

The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported methods is selected at login, allowing an attacker who already knows a user's password to bypass two-factor authentication and fully access the account, including administrator accounts.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Wordpress Wp2fac
Products
Wordpress Wp2fac
CVE-2026-16065

Welcart e-Commerce < 2.11.32 - Editor+ SQL Injection via CSV Import

The Welcart e-Commerce WordPress plugin before 2.11.32 does not properly sanitise a value taken from an imported CSV file before using it in a SQL statement, allowing users with the Editor role and above (including its custom shop-management roles) to perform SQL injection attacks.

CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed
Vendors
Welcart Wordpress
Products
Welcart E-commerce Wordpress
CVE-2026-12713

WPCargo Track & Trace < 8.0.4 - Unauthenticated SQL Injection via wpcargo_tracking_number

The WPCargo Track & Trace WordPress plugin before 8.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks. This affects a code path distinct from the one addressed by CVE-2024-44004.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Arni Cinco Wordpress
Products
Wpcargo Track & Trace Wordpress
CVE-2026-13153

Essential Blocks < 6.4.0 - Unauthenticated WooCommerce Sales Data Disclosure via REST products Endpoint

The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not restrict access to one of its public REST routes and over-fetches a non-public WooCommerce per-product sales metric into the response, allowing unauthenticated users to read the lifetime number of units sold for any published product.

CVSS 3.1 · 7.5 High EPSS 1.5% KEV · Not listed
Vendors
Wordpress Wpdevteam
Products
Wordpress Gutenberg Essential Blocks
CVE-2026-13154

Essential Blocks < 6.4.0 - Unauthenticated Non-Public Custom Post Type Content Disclosure via queries Endpoint

The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not verify that an attacker-supplied post type is publicly viewable before querying it in one of its public REST routes, allowing unauthenticated users to read published entries of custom post types that the site registered as non-public.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpdevteam
Products
Wordpress Gutenberg Essential Blocks
CVE-2026-13703

SEO Redirection Plugin – 301 Redirect Manager < 9.19 - Subscriber+ Redirect Rule Disclosure

The SEO Redirection Plugin WordPress plugin before 9.19 does not perform a capability check in one of its authenticated AJAX actions, allowing any logged-in user such as a subscriber to read the site's configured 301 redirect rules, including their source and destination URLs.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Clogica Wordpress
Products
Seo Redirection Plugin Wordpress