Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2640)
CWE-79 (1896)
CWE-416 (1380)
CWE-862 (1224)
CWE-89 (1114)
CWE-22 (1036)
CWE-125 (934)
CWE-306 (859)
CWE-200 (856)
CWE-122 (832)
CWE-20 (803)
CWE-787 (730)
CWE-78 (723)
CWE-918 (699)
CWE-863 (659)
CWE-94 (649)
CWE-74 (604)
CWE-639 (570)
CWE-400 (535)
CWE-269 (506)
CWE-119 (504)
CWE-502 (478)
CWE-770 (449)
CWE-287 (443)
CWE-121 (411)
CWE-190 (380)
CWE-77 (375)
CWE-362 (374)
CWE-476 (305)
CWE-352 (288)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-111971 |
medium | 6.8 | 0.0031 | 2026-10-22 | The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not sanitise and e | |
CVE-2026-78392 |
medium | 6.8 | 0.0034 | 2026-10-22 | The Link Library WordPress plugin before 7.9.6 does not sanitise and escape a link field before outp | |
CVE-2026-109933 |
medium | 6.8 | 0.0031 | 2026-10-23 | The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied | |
CVE-2026-111966 |
medium | 6.8 | 0.0031 | 2026-10-23 | The User Profile Builder WordPress plugin before 4.0.5 does not sanitise and escape one of its shor | |
CVE-2026-94264 |
medium | 6.8 | 0.0031 | 2026-10-23 | The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extend | |
CVE-2026-105199 |
medium | 6.8 | 0.0031 | 2026-10-24 | The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3 does not perform a capability c | |
CVE-2026-113493 |
medium | 6.8 | 0.0031 | 2026-10-24 | The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its map short | |
CVE-2026-114429 |
medium | 6.8 | 0.0031 | 2026-10-24 | The WPVR WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotsp | |
CVE-2026-115993 |
medium | 6.8 | 0.0032 | 2026-10-24 | Stored XSS vulnerability in the “Notes” field of the Checklists in Cervantes version v1.3-beta could | |
CVE-2026-111979 |
medium | 6.8 | 0.0024 | 2026-10-25 | The GiveWP WordPress plugin before 4.19.0.1 does not properly sanitise and escape one of its donati | |
CVE-2026-110504 |
medium | 6.8 | 0.0029 | 2026-10-29 | The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not sanitize uploaded SVG fi | |
CVE-2026-110505 |
medium | 6.8 | 0.0039 | 2026-10-29 | The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not prevent animation elemen | |
CVE-2026-118071 |
medium | 6.8 | 0.0015 | 2026-10-30 | The Joinchat WordPress plugin before 6.4.2 does not escape the message of its button block before o | |
CVE-2026-118165 |
medium | 6.8 | 0.0015 | 2026-10-30 | The Firelight Lightbox WordPress plugin before 2.3.23 does not escape the URL of links it opens in i | |
CVE-2026-115957 |
medium | 6.5 | 0.0017 | 2026-10-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2025-49936 |
medium | 6.5 | 0.0022 | 2025-10-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2025-62058 |
medium | 6.5 | 0.0018 | 2025-10-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2025-64197 |
medium | 6.5 | 0.0020 | 2025-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2025-64202 |
medium | 6.5 | 0.0016 | 2025-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2025-62032 |
medium | 6.5 | 0.0020 | 2025-11-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2025-67538 |
medium | 6.5 | 0.0020 | 2025-12-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2025-67539 |
medium | 6.5 | 0.0019 | 2025-12-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2025-67544 |
medium | 6.5 | 0.0019 | 2025-12-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2025-68532 |
medium | 6.5 | 0.0017 | 2025-12-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-34889 |
medium | 6.5 | 0.0018 | 2026-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-34890 |
medium | 6.5 | 0.0014 | 2026-04-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-34897 |
medium | 6.5 | 0.0018 | 2026-04-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-23900 |
medium | 6.5 | 0.0025 | 2026-04-11 | Various stored XSS vulnerabilities in the maps- and icon rendering logic in Phoca Maps component 5.0 | |
CVE-2026-28040 |
medium | 6.5 | 0.0016 | 2026-04-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-41043 |
medium | 6.5 | 0.0056 | 2026-04-24 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apach | |
CVE-2026-42410 |
medium | 6.5 | 0.0013 | 2026-04-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-48968 |
medium | 6.5 | 0.0018 | 2026-05-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-42750 |
medium | 6.5 | 0.0013 | 2026-05-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-42751 |
medium | 6.5 | 0.0013 | 2026-05-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-49044 |
medium | 6.5 | 0.0018 | 2026-05-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-39491 |
medium | 6.5 | 0.0023 | 2026-06-15 | Subscriber Cross Site Scripting (XSS) in JupiterX Core <= 4.14.1 versions. | |
CVE-2026-39540 |
medium | 6.5 | 0.0021 | 2026-06-15 | Subscriber Cross Site Scripting (XSS) in Shipment Tracker for Woocommerce <= 1.5.3.2 versions. | |
CVE-2026-41556 |
medium | 6.5 | 0.0021 | 2026-06-15 | Subscriber Cross Site Scripting (XSS) in ProfilePress <= 4.16.13 versions. | |
CVE-2026-42656 |
medium | 6.5 | 0.0021 | 2026-06-15 | Subscriber Cross Site Scripting (XSS) in Contest Gallery <= 28.1.6 versions. | |
CVE-2026-42663 |
medium | 6.5 | 0.0016 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in Simple Membership <= 4.7.2 versions. | |
CVE-2026-42688 |
medium | 6.5 | 0.0024 | 2026-06-15 | Subscriber Cross Site Scripting (XSS) in Modula Image Gallery <= 2.14.23 versions. | |
CVE-2026-48870 |
medium | 6.5 | 0.0021 | 2026-06-15 | Subscriber Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.62 versions. | |
CVE-2026-48880 |
medium | 6.5 | 0.0021 | 2026-06-15 | Subscriber Cross Site Scripting (XSS) in WP Job Portal <= 2.5.2 versions. | |
CVE-2026-49773 |
medium | 6.5 | 0.0017 | 2026-06-15 | Subscriber Cross Site Scripting (XSS) in FV Flowplayer Video Player < 7.5.51.7212 versions. | |
CVE-2026-57620 |
medium | 6.5 | 0.0022 | 2026-06-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-56046 |
medium | 6.5 | 0.0022 | 2026-06-26 | Subscriber Cross Site Scripting (XSS) in ListingPro <= 2.9.11 versions. | |
CVE-2026-57431 |
medium | 6.5 | 0.0022 | 2026-06-26 | Author Cross Site Scripting (XSS) in Featured Image <= 2.1 versions. | |
CVE-2026-57617 |
medium | 6.5 | 0.0022 | 2026-06-26 | Contributor Cross Site Scripting (XSS) in SeedProd Pro < 6.19.5 versions. | |
CVE-2026-57618 |
medium | 6.5 | 0.0022 | 2026-06-26 | Contributor Cross Site Scripting (XSS) in Neve PRO <= 3.1.2 versions. | |
CVE-2026-57638 |
medium | 6.5 | 0.0022 | 2026-06-26 | Contributor Cross Site Scripting (XSS) in Fluent Booking <= 2.1.0 versions. |