Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (11094 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2025-58635 1 Wordpress 1 Wordpress 2025-09-04 5.3 Medium
Missing Authorization vulnerability in PalsCode Support Genix allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Support Genix: from n/a through 1.4.23.
CVE-2025-58637 1 Wordpress 1 Wordpress 2025-09-04 7.5 High
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in immonex immonex Kickstart allows PHP Local File Inclusion. This issue affects immonex Kickstart: from n/a through 1.11.6.
CVE-2025-58639 2 Contact Form By Mega Forms Project, Wordpress 2 Contact Form By Mega Forms, Wordpress 2025-09-04 5.4 Medium
Missing Authorization vulnerability in Ali Khallad Contact Form By Mega Forms allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Contact Form By Mega Forms: from n/a through 1.6.1.
CVE-2025-58644 2 Enituretechnology, Wordpress 2 Ltl Freight Quotes, Wordpress 2025-09-04 7.2 High
Deserialization of Untrusted Data vulnerability in enituretechnology LTL Freight Quotes - TQL Edition allows Object Injection. This issue affects LTL Freight Quotes - TQL Edition: from n/a through 1.2.6.
CVE-2025-58641 1 Wordpress 1 Wordpress 2025-09-04 5.4 Medium
Server-Side Request Forgery (SSRF) vulnerability in kamleshyadav Exit Intent Popup allows Server Side Request Forgery. This issue affects Exit Intent Popup: from n/a through 1.0.1.
CVE-2025-58597 1 Wordpress 1 Wordpress 2025-09-04 4.3 Medium
Authorization Bypass Through User-Controlled Key vulnerability in Tomdever wpForo Forum allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects wpForo Forum: from n/a through 2.4.6.
CVE-2025-58615 1 Wordpress 1 Wordpress 2025-09-04 4.4 Medium
Server-Side Request Forgery (SSRF) vulnerability in gfazioli WP Bannerize Pro allows Server Side Request Forgery. This issue affects WP Bannerize Pro: from n/a through 1.10.0.
CVE-2025-58608 1 Wordpress 1 Wordpress 2025-09-04 7.5 High
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BuddyDev MediaPress allows PHP Local File Inclusion. This issue affects MediaPress: from n/a through 1.5.9.1.
CVE-2025-58604 2 Wordpress, Wpfunnels 2 Wordpress, Mail Mint Plugin 2025-09-04 7.6 High
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFunnels Mail Mint allows SQL Injection. This issue affects Mail Mint: from n/a through 1.18.5.
CVE-2025-58607 2 Gdprinfo, Wordpress 2 Cookie Notice & Consent Banner For Gdpr & Ccpa Compliance, Wordpress 2025-09-04 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GDPR Info Cookie Notice & Consent Banner for GDPR & CCPA Compliance allows Stored XSS. This issue affects Cookie Notice & Consent Banner for GDPR & CCPA Compliance: from n/a through 1.7.11.
CVE-2025-52709 2 Wordpress, Wpeverest 2 Wordpress, Everest Forms 2025-09-04 N/A
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2025-31100 2 Mojoomla, Wordpress 2 School Management, Wordpress 2025-09-02 9.9 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in Mojoomla School Management allows Upload a Web Shell to a Web Server.This issue affects School Management: from n/a through 1.93.1 (02-07-2025).
CVE-2025-5083 2 Amministrazione Trasparente Project, Wordpress 2 Amministrazione Trasparente, Wordpress 2025-09-02 5.5 Medium
The Amministrazione Trasparente plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVE-2024-32589 2 Ukrsolution, Wordpress 2 Barcode Scanner And Inventory Manager, Wordpress 2025-09-02 7.1 High
Missing Authorization vulnerability in UkrSolution Barcode Scanner with Inventory & Order Manager.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through 1.5.3.
CVE-2024-32832 2 Hamid-alinia-idehweb, Wordpress 2 Login With Phone Number, Wordpress 2025-09-02 9.8 Critical
Missing Authorization vulnerability in Hamid Alinia Login with phone number.This issue affects Login with phone number: from n/a through 1.6.93.
CVE-2025-47696 2 Solwin, Wordpress 2 Blog Designer Pro, Wordpress 2025-09-02 8.1 High
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Solwin Blog Designer PRO.This issue affects Blog Designer PRO: from n/a through 3.4.7.
CVE-2025-9618 2 Wordpress, Wpdreams 2 Wordpress, Related Posts Lite 2025-09-02 4.3 Medium
The Related Posts Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.12. This is due to missing or incorrect nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVE-2025-4956 2 Aa-team, Wordpress 2 Pro Bulk Watermark Plugin, Wordpress 2025-09-02 4.3 Medium
Path Traversal: '.../...//' vulnerability in AA-Team Pro Bulk Watermark Plugin for WordPress allows Path Traversal.This issue affects Pro Bulk Watermark Plugin for WordPress: from n/a through 2.0.
CVE-2025-9500 2 Tablepress, Wordpress 2 Tablepress, Wordpress 2025-09-02 6.4 Medium
The TablePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘shortcode_debug’ parameter in all versions up to, and including, 3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2025-9499 2 Oceanwp, Wordpress 2 Ocean Extra, Wordpress 2025-09-02 6.4 Medium
The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's oceanwp_library shortcode in all versions up to, and including, 2.4.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.