Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (9953 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2026-73993 2 Roxnor, Wordpress 2 Fundengine, Wordpress 2026-08-20 9.8 Critical
Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.
CVE-2026-73992 2 Jonathan Daggerhart, Wordpress 2 Query Wrangler, Wordpress 2026-08-20 9.9 Critical
Subscriber Remote Code Execution (RCE) in Query Wrangler <= 1.5.57 versions.
CVE-2026-68566 2 Repute Infosystems, Wordpress 2 Bookingpress Appointment Booking Pro, Wordpress 2026-08-20 9.3 Critical
Unauthenticated SQL Injection in BookingPress Appointment Booking Pro <= 6.0.2 versions.
CVE-2026-66682 2 Tychesoftwares, Wordpress 2 Abandoned Cart Pro For Woocommerce, Wordpress 2026-08-20 9.8 Critical
Unauthenticated Privilege Escalation in Abandoned Cart Pro for WooCommerce <= 10.4.0 versions.
CVE-2026-66649 2 E-plugins, Wordpress 2 Directory Pro, Wordpress 2026-08-20 9.3 Critical
Unauthenticated SQL Injection in Directory Pro <= 2.5.8 versions.
CVE-2026-66615 2 Eric Teubert, Wordpress 2 Podlove Podcast Publisher, Wordpress 2026-08-20 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Podlove Podcast Publisher <= 4.5.4 versions.
CVE-2026-66600 2 Davidlingren, Wordpress 2 Media Library Assistant, Wordpress 2026-08-20 9.1 Critical
Author Arbitrary File Upload in Media LIbrary Assistant <= 3.39 versions.
CVE-2026-66597 2 Melograno Venture Studio, Wordpress 2 Wpdatatables, Wordpress 2026-08-20 7.1 High
Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 6.5.1.4 versions.
CVE-2026-66582 2 Cozmoslabs, Wordpress 2 Translatepress, Wordpress 2026-08-20 7.1 High
Unauthenticated Cross Site Scripting (XSS) in TranslatePress <= 3.3.2 versions.
CVE-2026-28150 2 Uxper, Wordpress 2 Golo Framework, Wordpress 2026-08-20 8.1 High
Unauthenticated Local File Inclusion in Golo Framework < 1.7.5 versions.
CVE-2025-15688 2 Themegoods, Wordpress 2 Capella, Wordpress 2026-08-20 9.3 Critical
Unauthenticated SQL Injection in Capella <= 2.5.5 versions.
CVE-2026-73347 2 Themetechmount, Wordpress 2 Truebooker, Wordpress 2026-08-20 9.8 Critical
Unauthenticated Privilege Escalation in TrueBooker <= 1.2.6 versions.
CVE-2026-73185 2 Wordpress, Wpo-hr 2 Wordpress, Ngg Smart Image Search 2026-08-20 9.3 Critical
Unauthenticated SQL Injection in NGG Smart Image Search < 4.0.0 versions.
CVE-2026-66680 2 Plainwaire, Wordpress 2 Locatoraid Store Locator, Wordpress 2026-08-20 9.3 Critical
Unauthenticated SQL Injection in Locatoraid Store Locator <= 3.9.72 versions.
CVE-2026-66668 2 Peepso, Wordpress 2 Community By Peepso, Wordpress 2026-08-20 8.5 High
Subscriber SQL Injection in Community by PeepSo <= 9.0.5.2 versions.
CVE-2026-66604 2 Paolo, Wordpress 2 Geodirectory, Wordpress 2026-08-20 7.1 High
Unauthenticated Cross Site Scripting (XSS) in GeoDirectory <= 2.8.173 versions.
CVE-2026-66595 2 Passionate Programmer Peter, Wordpress 2 Wp Data Access, Wordpress 2026-08-20 5.9 Medium
Unauthenticated Broken Access Control in WP Data Access <= 5.5.80 versions.
CVE-2026-17153 2 Siteground, Wordpress 2 Ai Agent By Siteground, Wordpress 2026-08-20 5.3 Medium
The AI Agent by SiteGround plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to upload images to the WordPress media library, bypassing the upload_files capability restriction that Contributors are normally subject to, as authenticated attackers with Contributor-level access or above can satisfy the endpoint's nonce and permission checks. The sg_ai_studio_gutenberg_nonce required by the endpoint is emitted to any user with block editor access — including Contributors — making the absent upload_files check the sole barrier to exploitation.
CVE-2026-66601 2 Davidlingren, Wordpress 2 Media Library Assistant, Wordpress 2026-08-20 6.5 Medium
Subscriber Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.39 versions.
CVE-2026-73402 2 Hakan Ozevin, Wordpress 2 Wp Base Booking, Wordpress 2026-08-20 6.5 Medium
Subscriber Cross Site Scripting (XSS) in WP BASE Booking <= 6.3.2 versions.