Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
Assessment
Vulnerability Intelligence
Exploits
Alerts
Datasets
MCP
White Label
Security Automation SDK
MCP for AI Agents
Plans & Pricing
API Reference
Settings
Sign in
🔥 Daily Hot!
💪🏽 CPE Enhanced Advisories
🕶 Shadow Exploits
🕵🏼 Vulners CPE
🔐 Security news
💻 Exploit updates
📑 Blogs review
🐧 Linux vulnerabilities
🐞 Bugbounty
🤖 AI High Score
📰 CVE Feed
show all

11500 matches found

Cvelist
Cvelist•added 2026/08/01 7:49 a.m.•49 views

CVE-2026-15649 Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wit...

6.4CVSS0.00349EPSS
SaveExploits0References6
CVE
CVE•added 2026/08/01 7:49 a.m.•47 views

CVE-2026-16685

The CVE-2026-16685 entry concerns the WordPress Download Manager plugin (

6.4CVSS5.7AI score0.00419EPSS
SaveExploits0References10
Cvelist
Cvelist•added 2026/08/01 7:49 a.m.•54 views

CVE-2026-16685 Download Manager <= 3.3.66 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Shortcode Attribute

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'icon' Shortcode Attribute in all versions up to, and including, 3.3.66 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

6.4CVSS0.00419EPSS
SaveExploits0References10
CVE
CVE•added 2026/08/01 7:49 a.m.•44 views

CVE-2026-16090

The CVE affects the WordPress plugin GamiPress (Gamification) up to version 7.9.9.1. It describes a Stored Cross-Site Scripting vulnerability via the heading_size attribute of the gamipress_achievement shortcode. The root cause is insufficient input sanitization and output escaping, with the payl...

6.4CVSS5.7AI score0.00331EPSS
SaveExploits0References4
attackerkb
attackerkb•added 2026/08/01 7:49 a.m.•19 views

CVE-2026-16685

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'icon' Shortcode Attribute in all versions up to, and including, 3.3.66 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

6.4CVSS5.7AI score0.00419EPSS
SaveExploits0References11
Vulnrichment
Vulnrichment•added 2026/08/01 7:49 a.m.•11 views

CVE-2026-16685 Download Manager <= 3.3.66 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Shortcode Attribute

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'icon' Shortcode Attribute in all versions up to, and including, 3.3.66 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

6.4CVSS5.7AI score0.00419EPSS
SaveExploits0References10
Vulnrichment
Vulnrichment•added 2026/08/01 7:49 a.m.•9 views

CVE-2026-16090 GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via gamipress_achievement Shortcode

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headingsize' Shortcode Attribute in 'gamipressachievement' in all versions up to, and including, 7.9.9.1 due to insufficient input...

6.4CVSS5.7AI score0.00331EPSS
SaveExploits0References4
EUVD
EUVD•added 2026/08/01 7:49 a.m.•23 views

EUVD-2026-51750

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headingsize' Shortcode Attribute in 'gamipressachievement' in all versions up to, and including, 7.9.9.1 due to insufficient input...

6.4CVSS5.7AI score0.00331EPSS
SaveExploits0References4
Cvelist
Cvelist•added 2026/08/01 7:49 a.m.•51 views

CVE-2026-16090 GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via gamipress_achievement Shortcode

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headingsize' Shortcode Attribute in 'gamipressachievement' in all versions up to, and including, 7.9.9.1 due to insufficient input...

6.4CVSS0.00331EPSS
SaveExploits0References4
EUVD
EUVD•added 2026/08/01 7:49 a.m.•26 views

EUVD-2026-51747

The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'nav' Shortcode Attribute in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers...

6.4CVSS5.7AI score0.00357EPSS
SaveExploits0References8
Vulnrichment
Vulnrichment•added 2026/08/01 7:49 a.m.•12 views

CVE-2026-15645 Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'nav' Shortcode Attribute

The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'nav' Shortcode Attribute in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers...

6.4CVSS5.7AI score0.00357EPSS
SaveExploits0References8
attackerkb
attackerkb•added 2026/08/01 7:49 a.m.•14 views

CVE-2026-15645

The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'nav' Shortcode Attribute in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers...

6.4CVSS5.7AI score0.00357EPSS
SaveExploits0References9
CVE
CVE•added 2026/08/01 7:49 a.m.•45 views

CVE-2026-15645

Powerkit

6.4CVSS5.7AI score0.00357EPSS
SaveExploits0References8
Cvelist
Cvelist•added 2026/08/01 7:49 a.m.•47 views

CVE-2026-15645 Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'nav' Shortcode Attribute

The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'nav' Shortcode Attribute in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers...

6.4CVSS0.00357EPSS
SaveExploits0References8
NVD
NVD•added 2026/08/01 7:16 a.m.•17 views

CVE-2026-15234

The Codeless Page Builder WordPress plugin through 1.1.4 does not sanitize or validate a shortcode attribute before using it as an HTML tag name when rendering content, allowing users with contributor-level access and above to inject arbitrary HTML and JavaScript that executes in the session of a...

5.4CVSS0.00226EPSS
SaveExploits0References1
CVE
CVE•added 2026/08/01 6:00 a.m.•46 views

CVE-2026-15234

The Codeless Page Builder WordPress plugin (versions through 1.1.4 ) contains a Stored XSS vulnerability due to a failure to sanitize or validate a shortcode attribute before using it as an HTML tag name during content rendering. This flaw allows users with contributor-level access and above to i...

5.4CVSS5.6AI score0.00226EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment•added 2026/08/01 6:00 a.m.•15 views

CVE-2026-15234 Codeless Page Builder <= 1.1.4 - Contributor+ Stored XSS via Shortcode Attribute

The Codeless Page Builder WordPress plugin through 1.1.4 does not sanitize or validate a shortcode attribute before using it as an HTML tag name when rendering content, allowing users with contributor-level access and above to inject arbitrary HTML and JavaScript that executes in the session of a...

5.6AI score0.00226EPSS
SaveExploits0References1
Cvelist
Cvelist•added 2026/08/01 6:00 a.m.•46 views

CVE-2026-15234 Codeless Page Builder <= 1.1.4 - Contributor+ Stored XSS via Shortcode Attribute

The Codeless Page Builder WordPress plugin through 1.1.4 does not sanitize or validate a shortcode attribute before using it as an HTML tag name when rendering content, allowing users with contributor-level access and above to inject arbitrary HTML and JavaScript that executes in the session of a...

0.00226EPSS
SaveExploits0References1
attackerkb
attackerkb•added 2026/08/01 6:00 a.m.•13 views

CVE-2026-15234

The Codeless Page Builder WordPress plugin through 1.1.4 does not sanitize or validate a shortcode attribute before using it as an HTML tag name when rendering content, allowing users with contributor-level access and above to inject arbitrary HTML and JavaScript that executes in the session of a...

5.6AI score0.00226EPSS
SaveExploits0References1
EUVD
EUVD•added 2026/08/01 6:00 a.m.•17 views

EUVD-2026-51715

The Codeless Page Builder WordPress plugin through 1.1.4 does not sanitize or validate a shortcode attribute before using it as an HTML tag name when rendering content, allowing users with contributor-level access and above to inject arbitrary HTML and JavaScript that executes in the session of a...

5.6AI score0.00226EPSS
SaveExploits0References1
Rows per page
Query Builder