Export limit exceeded: 10227 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 396931 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (16343 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-28168 2 Imran Tauqeer, Wordpress 2 Cubewp, Wordpress 2026-08-14 8.5 High
Subscriber SQL Injection in CubeWP <= 1.1.30 versions.
CVE-2026-28185 2 Rtcamp, Wordpress 2 Log In With Google, Wordpress 2026-08-14 9.8 Critical
Unauthenticated Broken Authentication in Log in with Google <= 1.4.2 versions.
CVE-2026-28186 2 Themefic, Wordpress 2 Travelfic Toolkit, Wordpress 2026-08-14 8.1 High
Subscriber Broken Access Control in Travelfic Toolkit <= 1.5.1 versions.
CVE-2026-61978 2 Webhosting4ugr, Wordpress 2 Secure Card Gateway For Epay Paycenter (piraeus Bank), Wordpress 2026-08-14 6.5 Medium
Unauthenticated Broken Access Control in Secure Card Gateway for ePay Paycenter (Piraeus Bank) <= 1.0.32 versions.
CVE-2026-65580 2 Bracketweb, Wordpress 2 Agrion, Wordpress 2026-08-14 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Agrion <= 1.0.0 versions.
CVE-2026-66431 2 Woompaloompa, Wordpress 2 Bitcoin Lightning Payment Gateway For Woocommerce (via Clink), Wordpress 2026-08-14 7.5 High
Unauthenticated Broken Access Control in Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) <= 1.0.7 versions.
CVE-2026-66446 2 If-so Dynamic Content, Wordpress 2 If-so Dynamic Content Personalization, Wordpress 2026-08-14 9.3 Critical
Subscriber SQL Injection in If-So Dynamic Content Personalization <= 1.10 versions.
CVE-2026-66455 2 Rockiger, Wordpress 2 Reactpress, Wordpress 2026-08-14 6 Medium
Subscriber Broken Access Control in ReactPress <= 3.4.0 versions.
CVE-2026-66459 2 Space Codes, Wordpress 2 Ai For Seo, Wordpress 2026-08-14 6.5 Medium
Unauthenticated Broken Access Control in AI for SEO <= 2.4.2 versions.
CVE-2026-66462 2 Bookingwp, Wordpress 2 Woocommerce Appointments, Wordpress 2026-08-14 7.5 High
Unauthenticated Sensitive Data Exposure in WooCommerce Appointments <= 5.3.8 versions.
CVE-2026-66463 2 Hassan Fakih, Wordpress 2 Icarry, Wordpress 2026-08-14 7.5 High
Unauthenticated Sensitive Data Exposure in iCARRY <= 2.9 versions.
CVE-2026-66464 2 Toast Plugins, Wordpress 2 Internal Link Optimiser, Wordpress 2026-08-14 6.5 Medium
Unauthenticated Broken Access Control in Internal Link Optimiser <= 5.2.7 versions.
CVE-2026-66465 2 Agnihd, Wordpress 2 Cartify, Wordpress 2026-08-14 9.8 Critical
Unauthenticated Broken Authentication in Cartify <= 1.3.0.1 versions.
CVE-2026-66466 2 Wedevs, Wordpress 2 Storegrowth: Smart Sales Booster For Woocommerce | Bogo, Upsells, Direct Checkout, Quick View, Side Cart, Wordpress 2026-08-14 7.5 High
Unauthenticated Broken Access Control in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.1 versions.
CVE-2026-66468 2 Powerfulwp, Wordpress 2 Local Delivery Drivers For Woocommerce, Wordpress 2026-08-14 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Local Delivery Drivers for WooCommerce <= 3.0.0 versions.
CVE-2026-66469 2 Afonso Matos, Wordpress 2 Arvow Ai Seo Writer, Wordpress 2026-08-14 7.5 High
Unauthenticated Broken Access Control in Arvow AI SEO Writer <= 1.5.3 versions.
CVE-2026-66654 2 Tangiblewp, Wordpress 2 Vehica Core, Wordpress 2026-08-14 6 Medium
Subscriber Server Side Request Forgery (SSRF) in Vehica Core <= 1.0.104 versions.
CVE-2026-66661 2 Onokazu, Wordpress 2 Directories Pro, Wordpress 2026-08-14 7.7 High
Subscriber Privilege Escalation in Directories Pro <= 2.0.5 versions.
CVE-2026-66691 2 Scriptsbundle, Wordpress 2 Nokri, Wordpress 2026-08-14 9.8 Critical
Unauthenticated Broken Access Control in Nokri <= 1.6.6 versions.
CVE-2025-10308 2 Alian, Wordpress 2 Astro Booking Engine, Wordpress 2026-08-14 4.3 Medium
The Astro Booking Engine plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.0. This is due to missing nonce validation on the options deletion functionality. This makes it possible for unauthenticated attackers to delete all plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.