Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (44834 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2026-5391 2 Latepoint, Wordpress 2 Appointment Booking Plugin – Latepoint | Calendar & Scheduling For Wordpress, Wordpress 2026-08-07 6.4 Medium
The LatePoint plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btn_wrapper_classes' attribute of the 'latepoint_resources' shortcode in all versions up to, and including, 5.3.2. This is due to insufficient input sanitization and output escaping in the 'locations' branch of the 'shortcode_latepoint_resources' function. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2026-28141 2 Syed Balkhi, Wordpress 2 Nextgen Gallery, Wordpress 2026-08-07 7.1 High
Unauthenticated Cross Site Scripting (XSS) in NextGEN Gallery <= 4.2.3 versions.
CVE-2026-28177 2 Daniel Iser, Wordpress 2 Popup Maker, Wordpress 2026-08-07 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Popup Maker <= 1.23.0 versions.
CVE-2026-65517 2 Scott Paterson, Wordpress 2 Easy Paypal Buy Now Button, Wordpress 2026-08-07 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Easy PayPal Buy Now Button <= 2.0.4 versions.
CVE-2026-65544 2 Rajat Varlani, Wordpress 2 Super Socializer, Wordpress 2026-08-07 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Super Socializer <= 7.14.5 versions.
CVE-2026-14817 2 Bdthemes, Wordpress 2 Element Pack Addons For Elementor, Wordpress 2026-08-07 6.8 Medium
The Element Pack Addons for Elementor WordPress plugin before 8.7.13 does not sanitize option values passed through certain data attributes before a bundled front-end library re-parses and renders them in the browser, allowing users with contributor-level access or higher to inject arbitrary JavaScript that executes in the session of any visitor who views the affected content.
CVE-2026-28082 2 Crocoblock. Jetimpex Inc., Wordpress 2 Jetreviews, Wordpress 2026-08-07 7.1 High
Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.13.1 versions.
CVE-2026-5158 2 Wordpress, Wpxpo 2 Wordpress, Postx - Gutenberg Blocks For Post Grid 2026-08-07 6.4 Medium
The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'inputPlaceHolder' parameter in all versions up to, and including, 5.0.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2026-61963 2 Davidlingren, Wordpress 2 Media Library Assistant, Wordpress 2026-08-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.38 versions.
CVE-2026-66706 2 Markjaquith, Wordpress 2 Subscribe To Comments, Wordpress 2026-08-06 5.9 Medium
Author Cross Site Scripting (XSS) in Subscribe to Comments <= 2.3.1 versions.
CVE-2026-66663 2 Passionate Programmer Peter, Wordpress 2 Wp Data Access, Wordpress 2026-08-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions.
CVE-2026-66690 2 Nexcess, Wordpress 2 Givewp, Wordpress 2026-08-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.5 versions.
CVE-2026-66711 2026-08-06 7.1 High
Subscriber Cross Site Scripting (XSS) in WooCommerce Multilingual & Multicurrency <= 5.5.6 versions.
CVE-2026-18501 2 Stiofansisland, Wordpress 2 Userswp – Front-end Login Form, User Registration, User Profile & Members Directory Plugin For Wp, Wordpress 2026-08-06 6.4 Medium
The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Badge Widget Variable Substitution in all versions up to, and including, 1.2.69 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2026-66440 2 Wordpress, Xplodedthemes 2 Wordpress, Wpide - File Manager & Code Editor 2026-08-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in WPIDE – File Manager & Code Editor <= 3.5.7 versions.
CVE-2026-28143 2026-08-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.56.0 versions.
CVE-2026-61961 2 Wordpress, Wpdeveloper 2 Wordpress, Embedpress 2026-08-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in EmbedPress <= 4.5.6 versions.
CVE-2026-28178 2 Codesupplyco, Wordpress 2 Powerkit, Wordpress 2026-08-06 6.5 Medium
Contributor Cross Site Scripting (XSS) in Powerkit <= 3.1.0 versions.
CVE-2026-61982 2 Jp-secure, Wordpress 2 Siteguard Wp Plugin, Wordpress 2026-08-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in SiteGuard WP Plugin <= 1.8.6 versions.
CVE-2026-65509 2 Wordpress, Wpdatatables 2 Wordpress, Wpdatatables 2026-08-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 7.5.1 versions.