Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (16079 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-15439 2 Rubengc, Wordpress 2 Gamipress – Gamification Plugin To Reward Points, Achievements, Badges & Ranks In Wordpress, Wordpress 2026-09-13 6.5 Medium
The GamiPress plugin for WordPress is vulnerable to authenticated (Subscriber+) SQL Injection via the 'q' parameter of the wpForo integration AJAX selector (action gamipress_wpforo_get_posts) in versions up to, and including, 7.9.7. The value is passed only through $wpdb->esc_like() and interpolated directly into a single-quoted LIKE clause with no %s placeholder. Because esc_like() runs after WordPress core magic quotes, it doubles the injected backslash (\' -> \\'), which MySQL reads as one literal backslash followed by a live closing quote, allowing the attacker to break out of the string and inject boolean-based SQL. The wpForo plugin only needs to be active to register the callback; no wpForo vulnerability is used. Requires a Subscriber account, which can read the gamipress_admin nonce (exposed on every admin page, e.g. /wp-admin/profile.php). Note: the researcher's Simple:Press vectors (PoC 2 & 3) do not reproduce in current code, which uses $wpdb->prepare() with %s placeholders; only the wpForo selector is confirmed.
CVE-2026-62140 2 Expresstech, Wordpress 2 Quiz And Survey Master, Wordpress 2026-09-13 5.3 Medium
Unauthenticated Insecure Direct Object References (IDOR) in Quiz And Survey Master <= 11.2.5 versions.
CVE-2026-62107 2 Masteriyo, Wordpress 2 Masteriyo, Wordpress 2026-09-13 8.8 High
Unauthenticated PHP Object Injection in Masteriyo - LMS <= 3.4.0 versions.
CVE-2026-62114 2 Wordpress, Wpchill 2 Wordpress, Passster 2026-09-13 5.3 Medium
Unauthenticated Broken Access Control in Passster <= 4.3.13 versions.
CVE-2026-62132 2 Masteriyo, Wordpress 2 Masteriyo, Wordpress 2026-09-13 5.3 Medium
Subscriber Broken Access Control in Masteriyo - LMS <= 3.4.0 versions.
CVE-2026-87918 2 Wordpress, Wpbot 2 Wordpress, Wpot 2026-09-13 5.3 Medium
The WPBot WordPress plugin before 8.5.7 does not perform any authorization or nonce check on several AJAX actions that relay prompts to its configured AI providers, allowing unauthenticated attackers to make those third-party API calls, and consume the associated cost, using the site's own configured API keys.
CVE-2026-89080 2 Really-simple-plugins, Wordpress 2 Really Simple Security, Wordpress 2026-09-13 7.5 High
The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolment, allowing an attacker who already knows the account's password to bypass the second factor and obtain that user's session, up to administrator.
CVE-2026-62105 2 Themerex, Wordpress 2 Themerex Addons, Wordpress 2026-09-13 9.8 Critical
Unauthenticated PHP Object Injection in ThemeREX Addons < 2.45.0 versions.
CVE-2026-62112 2 Melograno Venture Studio, Wordpress 2 Amelia, Wordpress 2026-09-13 7.6 High
Editor SQL Injection in Amelia <= 2.4.9 versions.
CVE-2026-62103 2 Wordpress, Wpeverest 2 Wordpress, Everest Forms 2026-09-13 9.8 Critical
Unauthenticated PHP Object Injection in Everest Forms <= 3.6.0 versions.
CVE-2026-62109 2 Wordpress, Wowdevs 2 Wordpress, Sky Addons For Elementor 2026-09-13 7.6 High
Editor SQL Injection in Sky Addons for Elementor <= 3.8.4 versions.
CVE-2026-62135 2 Arraytics, Wordpress 2 Booktics, Wordpress 2026-09-13 5.3 Medium
Unauthenticated Broken Access Control in Booktics <= 1.0.24 versions.
CVE-2026-62133 2 Rometheme, Wordpress 2 Rtmkit, Wordpress 2026-09-12 5.4 Medium
Subscriber Cross Site Request Forgery (CSRF) in RTMKit <= 2.1.5 versions.
CVE-2026-62134 2 Brainstormforce, Wordpress 2 Starter Templates, Wordpress 2026-09-12 4.3 Medium
Contributor Insecure Direct Object References (IDOR) in Starter Templates <= 4.7.5 versions.
CVE-2026-62137 2 John James Jacoby, Wordpress 2 Bbpress, Wordpress 2026-09-12 5.3 Medium
Unauthenticated Sensitive Data Exposure in bbPress <= 2.6.14 versions.
CVE-2026-62138 2 Visualcomposer, Wordpress 2 Visual Composer Website Builder, Wordpress 2026-09-12 6.5 Medium
Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.1 versions.
CVE-2026-62139 2 Google, Wordpress 2 Site Kit By Google, Wordpress 2026-09-12 4.3 Medium
Unauthenticated Cross Site Request Forgery (CSRF) in Site Kit by Google <= 1.186.0 versions.
CVE-2026-62110 2 Bold-themes, Wordpress 2 Bold Page Builder, Wordpress 2026-09-12 6.5 Medium
Contributor Cross Site Scripting (XSS) in Bold Page Builder <= 5.9.9 versions.
CVE-2026-62111 2 Ido Kobelkowsky, Wordpress 2 Simple Payment, Wordpress 2026-09-12 6.5 Medium
Contributor Cross Site Scripting (XSS) in Simple Payment <= 2.5.4 versions.
CVE-2026-62088 2 10up, Wordpress 2 Elasticpress, Wordpress 2026-09-12 5.3 Medium
Insertion of Sensitive Information Into Sent Data vulnerability in 10up ElasticPress allows Retrieve Embedded Sensitive Data. This issue affects ElasticPress: from n/a through 5.3.4.