Hunt List
12,237 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
64
|
CVE-2026-56014 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-56042 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Customer Cross Site Scripting (XSS) in Advanced Order Export For WooCommerce <= | |
|
64
|
CVE-2026-56071 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.53.1 versions. | |
|
64
|
CVE-2026-56011 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in MapPress Maps for WordPress <= 2.9 | |
|
64
|
CVE-2026-56039 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Quick Interest Slider <= 3.1.6 ver | |
|
64
|
CVE-2026-56040 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Gutenverse Form <= 2.4.7 versions. | |
|
64
|
CVE-2026-56041 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Responsive Lightbox <= 2.7.6 versi | |
|
64
|
CVE-2026-56043 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Customer Reviews for WooCommerce < | |
|
64
|
CVE-2026-56044 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Blog2Social <= 8.9.2 versions. | |
|
64
|
CVE-2026-56045 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Automatic < 3.135.1 versions. | |
|
64
|
CVE-2026-56047 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in perfmatters <= 2.6.3 versions. | |
|
64
|
CVE-2026-56072 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in WoodMart <= 8.5.3 versions. | |
|
64
|
CVE-2026-57312 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Everest Forms <= 3.4.8 versions. | |
|
64
|
CVE-2026-57319 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in FOX <= 1.4.8 versions. | |
|
64
|
CVE-2026-57322 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-57325 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in NanoMag <= 1.8 versions. | |
|
64
|
CVE-2026-57320 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in BEAR <= 1.1.8 versions. | |
|
64
|
CVE-2026-57333 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Link Whisper Free <= 0.9.4 version | |
|
64
|
CVE-2026-57336 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Jobify <= 4.3.2 versions. | |
|
64
|
CVE-2026-57337 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Landing Page Builder <= 1.5.3.5 ve | |
|
64
|
CVE-2026-57338 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in ARForms <= 7.1.2 versions. | |
|
64
|
CVE-2026-27402 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Kids Life | Children School WordPr | |
|
64
|
CVE-2026-27404 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in LMS <= 9.7 versions. | |
|
64
|
CVE-2026-27408 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-27425 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Automotive Listings <= 18.6 versio | |
|
64
|
CVE-2026-27426 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Automotive Car Dealership Business | |
|
64
|
CVE-2026-27430 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in TheFox <= 3.9.76 versions. | |
|
64
|
CVE-2026-57343 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Real Estate 7 <= 3.5.9 versions. | |
|
64
|
CVE-2026-57344 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 5.4.2 versio | |
|
64
|
CVE-2026-57345 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Internal Links Manager <= 3.0.3 ve | |
|
64
|
CVE-2026-57349 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in WPeMatico RSS Feed Fetcher <= 2.8. | |
|
64
|
CVE-2026-57350 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in WP Debugging <= 2.12.2 versions. | |
|
64
|
CVE-2026-57351 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in HandL UTM Grabber <= 2.9.2 version | |
|
64
|
CVE-2026-57356 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in MC Woocommerce Wishlist <= 1.9.19 | |
|
64
|
CVE-2026-57357 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Search Atlas SEO <= 2.6.6 versions | |
|
64
|
CVE-2026-57358 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Customize My Account for WooCommer | |
|
64
|
CVE-2026-57360 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.5.4 | |
|
64
|
CVE-2026-57361 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Survey Maker <= 5.2.2.5 versions. | |
|
64
|
CVE-2026-57362 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in ChatBot <= 8.3.2 versions. | |
|
64
|
CVE-2026-57366 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in WPAdverts <= 2.3.1 versions. | |
|
64
|
CVE-2026-57426 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Modula - PRO <= 2.10.8 versions. | |
|
64
|
CVE-2026-57670 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Google Maps CP <= 1.2.5 versions. | |
|
64
|
CVE-2026-57672 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 6.5.1.1 versions. | |
|
64
|
CVE-2026-57674 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Timetics <= 1.0.58 versions. | |
|
64
|
CVE-2026-57675 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.2.02.004 | |
|
64
|
CVE-2026-57678 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-57682 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Simple Link Directory <= 15.0.5 ve | |
|
64
|
CVE-2026-57686 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in WowAddons <= 1.6.14 versions. | |
|
64
|
CVE-2026-57363 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-57368 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti |