Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (9048 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2025-52739 1 Wordpress 1 Wordpress 2026-01-05 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uxper Sala allows Reflected XSS.This issue affects Sala: from n/a through 1.1.3.
CVE-2025-23705 2 Terry Zielke, Wordpress 2 Zielke Design Project Gallery, Wordpress 2026-01-05 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Terry Zielke Zielke Design Project Gallery allows Reflected XSS.This issue affects Zielke Design Project Gallery: from n/a through 2.5.0.
CVE-2025-66148 2 Merkulove, Wordpress 2 Conformer For Elementor, Wordpress 2026-01-05 5.4 Medium
Missing Authorization vulnerability in merkulove Conformer for Elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Conformer for Elementor: from n/a through 1.0.7.
CVE-2025-28973 2 Aa-team, Wordpress 2 Pro Bulk Watermark Plugin, Wordpress 2026-01-05 6.5 Medium
Path Traversal: '.../...//' vulnerability in AA-Team Pro Bulk Watermark Plugin for WordPress allows Path Traversal.This issue affects Pro Bulk Watermark Plugin for WordPress: from n/a through 2.0.
CVE-2025-23719 1 Wordpress 1 Wordpress 2026-01-05 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zckevin ZhinaTwitterWidget allows Reflected XSS.This issue affects ZhinaTwitterWidget: from n/a through 1.0.
CVE-2025-30628 2 Aa-team, Wordpress 2 Amazon Affiliates Addon For Wpbakery Page Builder, Wordpress 2026-01-05 8.5 High
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer) allows SQL Injection.This issue affects Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer): from n/a through 1.2.
CVE-2025-47566 2 Digitalzoomstudio, Wordpress 3 Dzs-zoomsounds, Zoomsounds, Wordpress 2026-01-05 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ZoomSounds allows Reflected XSS.This issue affects ZoomSounds: from n/a through 6.91.
CVE-2025-23707 1 Wordpress 1 Wordpress 2026-01-05 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matamko En Masse allows Reflected XSS.This issue affects En Masse: from n/a through 1.0.
CVE-2025-12685 3 Iqonic, Iqonicdesign, Wordpress 3 Wpbookit, Wpbookit, Wordpress 2026-01-05 6.5 Medium
The WPBookit WordPress plugin through 1.0.7 lacks a CSRF check when deleting customers. This could allow an unauthenticated attacker to delete any customer through a CSRF attack.
CVE-2025-13456 2 Shopbuilder, Wordpress 2 Shopbuilder, Wordpress 2026-01-05 6.1 Medium
The ShopBuilder WordPress plugin before 3.2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVE-2025-13153 2 Logo Slider Wordpress, Wordpress 2 Logo Slider Wordpress, Wordpress 2026-01-05 6.1 Medium
The Logo Slider WordPress plugin before 4.9.0 does not validate and escape some of its slider options before outputting them back in the dashboard, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVE-2024-6797 2 Dyadyalesha, Wordpress 2 Dl Robots.txt, Wordpress 2026-01-02 4.8 Medium
The DL Robots.txt WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVE-2024-6230 2 Wordpress, Wp-master 2 Wordpress, Pardakht-delkhah 2026-01-02 6.5 Medium
The پلاگین پرداخت دلخواه WordPress plugin through 2.9.8 does not have CSRF check in place when resetting its form fields, which could allow attackers to make a logged in admin perform such action via a CSRF attack
CVE-2024-31211 1 Wordpress 1 Wordpress 2026-01-02 5.5 Medium
WordPress is an open publishing platform for the Web. Unserialization of instances of the `WP_HTML_Token` class allows for code execution via its `__destruct()` magic method. This issue was fixed in WordPress 6.4.2 on December 6th, 2023. Versions prior to 6.4.0 are not affected.
CVE-2023-23985 2 Ays-pro, Wordpress 2 Quiz Maker, Wordpress 2025-12-31 3.7 Low
Missing Authorization vulnerability in Quiz Maker team Quiz Maker.This issue affects Quiz Maker: from n/a through 6.3.9.4.
CVE-2025-60089 3 Crm Perks, Crmperks, Wordpress 3 Wp Gravity Forms Freshdesk Plugin, Wp Gravity Forms Freshdesk Plugin, Wordpress 2025-12-31 9.8 Critical
Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms FreshDesk Plugin gf-freshdesk allows Object Injection.This issue affects WP Gravity Forms FreshDesk Plugin: from n/a through <= 1.3.5.
CVE-2025-60090 3 Crm Perks, Crmperks, Wordpress 3 Wp Gravity Forms Insightly, Wp Gravity Forms Insightly, Wordpress 2025-12-31 9.8 Critical
Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Insightly gf-insightly allows Object Injection.This issue affects WP Gravity Forms Insightly: from n/a through <= 1.1.6.
CVE-2025-60091 3 Crm Perks, Crmperks, Wordpress 3 Wp Gravity Forms Zoho Crm And Bigin, Wp Gravity Forms Zoho Crm And Bigin, Wordpress 2025-12-31 9.8 Critical
Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Zoho CRM and Bigin gf-zoho allows Object Injection.This issue affects WP Gravity Forms Zoho CRM and Bigin: from n/a through <= 1.2.9.
CVE-2025-60174 3 Crm Perks, Crmperks, Wordpress 3 Wp Gravity Forms Constant Contact Plugin, Wp Gravity Forms Constant Contact Plugin, Wordpress 2025-12-31 9.8 Critical
Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Constant Contact Plugin gf-constant-contact allows Object Injection.This issue affects WP Gravity Forms Constant Contact Plugin: from n/a through <= 1.1.2.
CVE-2025-60178 3 Crm Perks, Crmperks, Wordpress 3 Wp Gravity Forms Hubspot, Wp Gravity Forms Hubspot, Wordpress 2025-12-31 9.8 Critical
Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms HubSpot gf-hubspot allows Object Injection.This issue affects WP Gravity Forms HubSpot: from n/a through <= 1.2.6.