Export limit exceeded: 405148 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 50449 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (50449 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-62034 2026-10-11 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Before After Image Comparison – Image comparison for WP <= 1.1.21 versions.
CVE-2026-62027 2026-10-11 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Team Section Block <= 2.0.4 versions.
CVE-2026-57806 2026-10-11 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in drfuri Martfury - WooCommerce Marketplace WordPress Theme martfury allows Reflected XSS.This issue affects Martfury - WooCommerce Marketplace WordPress Theme: from n/a through 3.3.9.
CVE-2026-57742 1 Themerex Group 1 Kids Planet 2026-10-11 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group Kids Planet allows Reflected XSS. This issue affects Kids Planet: from n/a through 2.2.14.2.
CVE-2026-42715 2026-10-11 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Photo Gallery by 10Web <= 1.8.47 versions.
CVE-2026-42711 2026-10-11 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Slider by 10Web <= 1.2.63 versions.
CVE-2026-42709 2026-10-11 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Food Menu – Restaurant Menu & Online Ordering for WooCommerce <= 6.0.5 versions.
CVE-2026-42702 2026-10-11 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Tutor LMS <= 4.1.0 versions.
CVE-2026-42699 2026-10-11 7.1 High
Unauthenticated Cross Site Scripting (XSS) in FV Player 8 <= 8.1.8 versions.
CVE-2026-42697 2026-10-11 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Social Share Icons & Social Share Buttons <= 3.7.5 versions.
CVE-2026-42695 2026-10-11 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Flowplayer Video Player fv-wordpress-flowplayer allows Stored XSS.This issue affects FV Flowplayer Video Player: from n/a through 7.5.54.7212.
CVE-2026-42693 2026-10-11 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Jannah <= 7.6.5 versions.
CVE-2026-42632 2026-10-11 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Qode Real Estate <= 1.1.7.3 versions.
CVE-2026-42631 2026-10-11 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Qode Music <= 2.1.8.2 versions.
CVE-2026-40803 2026-10-11 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Jotform &#8211; AI Chatbot <= 3.8.2 versions.
CVE-2026-39800 2026-10-11 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Additional Order Filters for WooCommerce <= 1.24 versions.
CVE-2026-39799 2026-10-11 7.1 High
Unauthenticated Cross Site Scripting (XSS) in WP File Download <= 6.3.6 versions.
CVE-2026-12980 2026-10-11 6.8 Medium
The Post Snippets WordPress plugin through 4.2.4 does not properly escape variable values substituted into snippets before outputting them, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when the content is viewed.
CVE-2026-105870 2026-10-11 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Delight Star Inc. WP Associate Post R2 wp-associate-post-r2 allows Reflected XSS.This issue affects WP Associate Post R2: from n/a through 5.0.1.
CVE-2026-103305 2026-10-11 8.8 High
The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and CSRF checks when saving its settings, and does not escape some of them when outputting them, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators and site visitors.