Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
398,187 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-118074 | 7.2 High | WordPress Finale Lite plugin <= 2.21.0 - PHP Object Injection vulnerability | Oct 29, 2026 |
| CVE-2026-118073 | 8.8 High | WordPress News Kit Elementor Addons plugin <= 1.5.0 - PHP Object Injection vulnerability | Oct 29, 2026 |
| CVE-2026-116869 | 7.2 High | WordPress myPOS Checkout plugin <= 1.4.5 - PHP Object Injection vulnerability | Oct 29, 2026 |
| CVE-2026-116868 | 8.8 High | WordPress BuddyPress Xprofile Custom Field Types plugin <= 1.3.1 - PHP Object Injection vulnerability | Oct 29, 2026 |
| CVE-2026-116867 | 8.8 High | WordPress Dynamic QR Code – generator plugin <= 1.0.1 - PHP Object Injection vulnerability | Oct 29, 2026 |
| CVE-2026-116866 | 8.8 High | WordPress Extra Fees Plugin for WooCommerce plugin <= 4.4.0 - PHP Object Injection vulnerability | Oct 29, 2026 |
| CVE-2026-116865 | 7.2 High | WordPress Zippy plugin <= 1.7.0 - PHP Object Injection vulnerability | Oct 29, 2026 |
| CVE-2026-116864 | 7.2 High | WordPress WPCargo Track & Trace plugin <= 8.0.5 - PHP Object Injection vulnerability | Oct 29, 2026 |
| CVE-2026-108494 | 7.1 High | WordPress Chained Quiz plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability | Oct 29, 2026 |
| CVE-2026-62131 | 9.8 Critical | WordPress Zoho Flow plugin <= 2.14.5 - PHP Object Injection vulnerability | Oct 29, 2026 |
| CVE-2026-62018 | 9.8 Critical | WordPress Gunslinger theme <= 1.11 - PHP Object Injection vulnerability | Oct 29, 2026 |
| CVE-2026-62017 | 9.8 Critical | WordPress Good Homes theme <= 1.3.13 - PHP Object Injection vulnerability | Oct 29, 2026 |
| CVE-2026-62016 | 9.8 Critical | WordPress Gamic theme <= 1.19 - PHP Object Injection vulnerability | Oct 29, 2026 |
| CVE-2026-62015 | 9.8 Critical | WordPress Gamezone theme <= 1.1.11 - PHP Object Injection vulnerability | Oct 29, 2026 |
| CVE-2026-62014 | 9.8 Critical | WordPress EmojiNation theme <= 1.0.12 - PHP Object Injection vulnerability | Oct 29, 2026 |
| CVE-2026-62013 | 9.8 Critical | WordPress Edge Decor theme <= 2.9 - PHP Object Injection vulnerability | Oct 29, 2026 |
| CVE-2026-62012 | 9.8 Critical | WordPress Coinpress theme <= 1.0.15 - PHP Object Injection vulnerability | Oct 29, 2026 |
| CVE-2026-62011 | 9.8 Critical | WordPress Bonbon theme <= 1.11 - PHP Object Injection vulnerability | Oct 29, 2026 |
| CVE-2026-62010 | 9.8 Critical | WordPress Avventure theme <= 1.1.12 - PHP Object Injection vulnerability | Oct 29, 2026 |
| CVE-2026-62009 | 9.8 Critical | WordPress Filmax theme <= 1.1.11 - PHP Object Injection vulnerability | Oct 29, 2026 |
| CVE-2026-62008 | 9.8 Critical | WordPress Orpheus theme <= 1.8 - PHP Object Injection vulnerability | Oct 29, 2026 |
| CVE-2026-62006 | 9.8 Critical | WordPress Nuts theme <= 1.12 - PHP Object Injection vulnerability | Oct 29, 2026 |
| CVE-2026-62005 | 9.8 Critical | WordPress Muzicon theme <= 1.15 - PHP Object Injection vulnerability | Oct 29, 2026 |
| CVE-2026-62004 | 9.8 Critical | WordPress Motorix theme <= 1.11 - PHP Object Injection vulnerability | Oct 29, 2026 |
| CVE-2026-62003 | 9.8 Critical | WordPress Mission theme <= 1.22 - PHP Object Injection vulnerability | Oct 29, 2026 |
| CVE-2026-62002 | 9.8 Critical | WordPress Meals & Wheels theme <= 1.1.13 - PHP Object Injection vulnerability | Oct 29, 2026 |
| CVE-2026-62001 | 9.8 Critical | WordPress Marcell theme <= 1.2.14 - PHP Object Injection vulnerability | Oct 29, 2026 |
| CVE-2026-61998 | 9.8 Critical | WordPress Le Truffe theme <= 1.1.7 - PHP Object Injection vulnerability | Oct 29, 2026 |
| CVE-2026-61997 | 9.8 Critical | WordPress Legal Stone theme <= 1.2.11 - PHP Object Injection vulnerability | Oct 29, 2026 |
| CVE-2026-61996 | 8.5 High | WordPress MLS On The Fly plugin <= 1.8.1.5 - SQL Injection vulnerability | Oct 29, 2026 |
| CVE-2026-61995 | 7.1 High | WordPress YouTube Showcase plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability | Oct 29, 2026 |
| CVE-2026-61993 | 7.1 High | WordPress Blockonomics plugin 3.11.0 - Cross Site Scripting (XSS) vulnerability | Oct 29, 2026 |
| CVE-2026-61992 | 9.8 Critical | WordPress GEO my WordPress plugin <= 4.5.5.4 - PHP Object Injection vulnerability | Oct 29, 2026 |
| CVE-2026-61991 | 10.0 Critical | WordPress AjaxLoadMore Cache plugin <= 3.1.1 - Remote Code Execution (RCE) vulnerability | Oct 29, 2026 |
| CVE-2026-61989 | 7.1 High | WordPress Easy Property Listings plugin <= 3.5.25 - Cross Site Scripting (XSS) vulnerability | Oct 29, 2026 |
| CVE-2026-61988 | 7.1 High | WordPress Auction Nudge – Your eBay on Your Site plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability | Oct 29, 2026 |
| CVE-2026-54866 | 7.1 High | WordPress Razorpay Payment Button Elementor Plugin plugin <= 1.2.8 - Cross Site Scripting (XSS) vulnerability | Oct 29, 2026 |
| CVE-2026-54865 | 6.5 Medium | WordPress Podamibe Custom User Gravatar plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerability | Oct 29, 2026 |
| CVE-2026-54864 | 7.1 High | WordPress Post Video Players plugin <= 1.165 - Cross Site Scripting (XSS) vulnerability | Oct 29, 2026 |
| CVE-2026-54860 | 9.8 Critical | WordPress Ozisti theme <= 1.1.10 - PHP Object Injection vulnerability | Oct 29, 2026 |
| CVE-2026-54859 | 9.8 Critical | WordPress Preservation theme <= 1.15 - PHP Object Injection vulnerability | Oct 29, 2026 |
| CVE-2026-54858 | 9.8 Critical | WordPress Printy theme <= 1.13.0 - PHP Object Injection vulnerability | Oct 29, 2026 |
| CVE-2026-54857 | 9.8 Critical | WordPress Quirky theme <= 1.23 - PHP Object Injection vulnerability | Oct 29, 2026 |
| CVE-2026-54856 | 9.8 Critical | WordPress RexCoin theme <= 1.2.6 - PHP Object Injection vulnerability | Oct 29, 2026 |
| CVE-2026-42701 | 7.2 High | WordPress YayMail plugin <= 4.4.6 - PHP Object Injection vulnerability | Oct 29, 2026 |
| CVE-2026-42692 | 7.1 High | WordPress WP Crowdfunding plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability | Oct 29, 2026 |
| CVE-2026-42690 | 5.4 Medium | WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability | Oct 29, 2026 |
| CVE-2026-27394 | 7.1 High | WordPress Eventer plugin <= 0.1.1 - Reflected Cross Site Scripting (XSS) vulnerability | Oct 29, 2026 |
| CVE-2026-118085 | 7.1 High | WordPress GlobalPayments WooCommerce plugin <= 1.23.3 - Cross Site Scripting (XSS) vulnerability | Oct 29, 2026 |
| CVE-2026-66912 | 5.3 Medium | Stored Cross-Site Scripting in Zimbra | Oct 29, 2026 |
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.