Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (11806 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2026-0675 1 Wordpress 1 Wordpress 2026-01-12 N/A
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2024-37102 2 Blossomthemes, Wordpress 2 Vilva, Wordpress 2026-01-12 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Blossom Themes Vilva allows Cross Site Request Forgery.This issue affects Vilva: from n/a through 1.2.2.
CVE-2024-38703 2 Wordpress, Xylusthemes 2 Wordpress, Wp Event Aggregator 2026-01-12 6.5 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Xylus Themes WP Event Aggregator allows Stored XSS.This issue affects WP Event Aggregator: from n/a through 1.7.9.
CVE-2024-32531 2 Everestthemes, Wordpress 2 Gucherry Blog, Wordpress 2026-01-12 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Everest themes GuCherry Blog allows Reflected XSS.This issue affects GuCherry Blog: from n/a through 1.1.8.
CVE-2024-44010 2 Catchthemes, Wordpress 2 Full Frame, Wordpress 2026-01-12 5.1 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Catch Themes Full frame allows Stored XSS.This issue affects Full frame: from n/a through 2.7.2.
CVE-2025-9978 3 Elementor, Jegtheme, Wordpress 3 Elementor, Jeg Elementor Kit, Wordpress 2026-01-09 6.8 Medium
The Jeg Kit for Elementor WordPress plugin before 2.7.0 does not sanitize SVG file contents when uploaded via xmlrpc.php, leading to a cross site scripting vulnerability.
CVE-2025-7965 1 Wordpress 1 Wordpress 2026-01-09 4.3 Medium
The CBX Restaurant Booking WordPress plugin through 1.2.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVE-2025-13070 1 Wordpress 1 Wordpress 2026-01-09 6.6 Medium
The CSV to SortTable WordPress plugin through 4.2 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as contributor to perform LFI attacks.
CVE-2025-11191 1 Wordpress 1 Wordpress 2026-01-09 5.3 Medium
The RealPress WordPress plugin before 1.1.0 registers the REST routes without proper permission checks, allowing the creation of pages and sending of emails from the site.
CVE-2025-10874 1 Wordpress 1 Wordpress 2026-01-09 5.5 Medium
The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.2 does not limit URLs which may be used for the stock photo import feature, allowing the user to specify arbitrary URLs. This leads to a server-side request forgery as the user may force the server to access any URL of their choosing.
CVE-2025-10723 2 Pixelyoursite, Wordpress 2 Pixelyoursite, Wordpress 2026-01-09 2.7 Low
The PixelYourSite WordPress plugin before 11.1.2 does not validate some URL parameters before using them to generate paths passed to function/s, allowing any admins to perform LFI attacks
CVE-2025-10406 1 Wordpress 1 Wordpress 2026-01-09 5.5 Medium
The BlindMatrix e-Commerce WordPress plugin before 3.1 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users, such as contributors, to perform LFI attacks.
CVE-2025-13071 1 Wordpress 1 Wordpress 2026-01-09 7.1 High
The Custom Admin Menu WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVE-2025-10684 1 Wordpress 1 Wordpress 2026-01-09 4.3 Medium
The Construction Light WordPress theme before 1.6.8 does not have authorisation and CSRF when activating via an AJAX action, allowing any authenticated users, such as subscriber to activate arbitrary .
CVE-2024-47356 2 Catchthemes, Wordpress 2 Create, Wordpress 2026-01-09 5.1 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Catch Themes Create allows Stored XSS.This issue affects Create: from n/a through 2.9.1.
CVE-2024-37421 2 Rarathemes, Wordpress 2 Jobscout, Wordpress 2026-01-09 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Rara Theme JobScout allows Cross Site Request Forgery.This issue affects JobScout: from n/a through 1.1.4.
CVE-2023-28688 2 Themehunk, Wordpress 2 Variation Swatches, Wordpress 2026-01-09 5.4 Medium
Cross-Site Request Forgery (CSRF) vulnerability in ThemeHunk TH Variation Swatches allows Cross Site Request Forgery.This issue affects TH Variation Swatches: from n/a through 1.2.7.
CVE-2024-31428 2 Rarathemes, Wordpress 2 The Conference, Wordpress 2026-01-09 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Rara Theme The Conference.This issue affects The Conference: from n/a through 1.2.0.
CVE-2024-31384 2 Rarathemes, Wordpress 2 Spa And Salon, Wordpress 2026-01-09 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Rara Theme Spa and Salon.This issue affects Spa and Salon: from n/a through 1.2.7.
CVE-2025-52816 2 Themehunk, Wordpress 2 Zita, Wordpress 2026-01-09 8.1 High
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themehunk Zita allows PHP Local File Inclusion. This issue affects Zita: from n/a through 1.6.5.