Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2655)
CWE-79 (1918)
CWE-416 (1383)
CWE-862 (1246)
CWE-89 (1118)
CWE-22 (1046)
CWE-125 (940)
CWE-200 (866)
CWE-306 (862)
CWE-122 (834)
CWE-20 (815)
CWE-787 (735)
CWE-78 (727)
CWE-918 (707)
CWE-863 (667)
CWE-94 (653)
CWE-74 (604)
CWE-639 (577)
CWE-400 (545)
CWE-269 (509)
CWE-119 (507)
CWE-502 (488)
CWE-287 (453)
CWE-770 (450)
CWE-121 (414)
CWE-190 (383)
CWE-77 (380)
CWE-362 (376)
CWE-476 (311)
CWE-352 (289)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-108366 |
medium | 6.4 | 0.0021 | 2026-10-28 | The easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution plugin | |
CVE-2026-109370 |
medium | 6.4 | 0.0022 | 2026-10-28 | The Document Embedder – let visitors read files without downloading plugin for WordPress is vulnerab | |
CVE-2026-109385 |
medium | 6.4 | 0.0026 | 2026-10-28 | The UiChemy – Convert Figma, Prompts and AI Builds to Elementor, Gutenberg and Bricks plugin for Wor | |
CVE-2026-109590 |
medium | 6.4 | 0.0024 | 2026-10-28 | The Tour Booking Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ' | |
CVE-2026-109972 |
medium | 6.4 | 0.0027 | 2026-10-28 | The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access | |
CVE-2026-109975 |
medium | 6.4 | 0.0020 | 2026-10-28 | The Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Template | |
CVE-2026-109978 |
medium | 6.4 | 0.0024 | 2026-10-28 | The Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Template | |
CVE-2026-110071 |
medium | 6.4 | 0.0020 | 2026-10-28 | The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' par | |
CVE-2026-116749 |
medium | 6.4 | 0.0019 | 2026-10-28 | The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site | |
CVE-2026-118164 |
medium | 6.4 | 0.0021 | 2026-10-28 | The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vu | |
CVE-2026-77188 |
medium | 6.4 | 0.0019 | 2026-10-28 | The Waitlist Woocommerce ( Back in stock notifier ) plugin for WordPress is vulnerable to Stored Cro | |
CVE-2026-77871 |
medium | 6.4 | 0.0024 | 2026-10-28 | The Post Snippets – Custom WordPress Code Snippets Customizer plugin for WordPress is vulnerable to | |
CVE-2026-93293 |
medium | 6.4 | 0.0019 | 2026-10-29 | The Password Protected plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bun | |
CVE-2026-5070 |
medium | 6.4 | 0.0019 | 2026-04-16 | The Vantage theme for WordPress is vulnerable to Stored Cross-Site Scripting via Gallery block text | |
CVE-2026-40282 |
medium | 6.4 | 0.0026 | 2026-04-17 | WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site | |
CVE-2026-23758 |
medium | 6.4 | 0.0015 | 2026-04-20 | GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the ticket subjec | |
CVE-2026-42870 |
medium | 6.4 | 0.0035 | 2026-05-11 | WeGIA is a web manager for charitable institutions. In versions prior to 3.7.0, a Stored Cross-Site | |
CVE-2026-43876 |
medium | 6.4 | 0.0019 | 2026-05-11 | WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/notifySu | |
CVE-2026-6646 |
medium | 6.4 | 0.0028 | 2026-05-15 | The The7 theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'dt_default_button | |
CVE-2026-48167 |
medium | 6.4 | 0.0025 | 2026-06-22 | Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 un | |
CVE-2026-52781 |
medium | 6.4 | 0.0025 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the H | |
CVE-2026-5220 |
medium | 6.4 | 0.0025 | 2026-07-01 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i | |
CVE-2026-4804 |
medium | 6.4 | 0.0028 | 2026-07-03 | The Zakra theme for WordPress is vulnerable to Stored Cross-Site Scripting via post meta values in a | |
CVE-2026-3251 |
medium | 6.4 | 0.0025 | 2026-07-10 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i | |
CVE-2026-15161 |
medium | 6.4 | 0.0026 | 2026-07-17 | The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Stored Cross-Site Scripting in | |
CVE-2026-18197 |
medium | 6.4 | 0.0028 | 2026-07-29 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i | |
CVE-2026-15421 |
medium | 6.4 | 0.0041 | 2026-08-19 | The Speed Optimizer – The All-In-One Performance-Boosting Plugin plugin for WordPress is vulnerable | |
CVE-2026-104727 |
medium | 6.4 | 0.0025 | 2026-10-29 | The Sequential Order Numbers for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site | |
CVE-2026-109215 |
medium | 6.4 | 0.0033 | 2026-10-29 | The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bbp_r | |
CVE-2026-96563 |
medium | 6.4 | 0.0020 | 2026-10-10 | The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Store | |
CVE-2026-118500 |
medium | 6.4 | 0.0022 | 2026-10-30 | The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress is vulnerable to St | |
CVE-2026-118634 |
medium | 6.4 | 0.0020 | 2026-10-30 | The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'widt | |
CVE-2026-110533 |
medium | 6.4 | — | 2026-10-30 | The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via | |
CVE-2026-102918 |
medium | 6.4 | — | 2026-10-30 | The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all version | |
CVE-2026-115869 |
medium | 6.4 | — | 2026-10-30 | The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'varia | |
CVE-2026-119113 |
medium | 6.4 | — | 2026-10-30 | The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPre | |
CVE-2026-119176 |
medium | 6.4 | — | 2026-10-30 | The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting | |
CVE-2026-9239 |
medium | 6.4 | — | 2026-10-30 | The Meow Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Attachment Al | |
CVE-2025-8444 |
medium | 6.4 | 0.0015 | 2026-06-10 | The Animation Addons for Elementor – GSAP Powered Elementor Addons & Website Templates plugin for Wo | |
CVE-2026-6179 |
medium | 6.3 | 0.0017 | 2026-04-13 | Stored Cross Site Scripting in NightWolf Penetration Testing Platform allows attack trigger and run | |
CVE-2026-9806 |
medium | 6.3 | 0.0026 | 2026-05-28 | A stored cross-site scripting (XSS) vulnerability exists in the notification panel of CTI Transmute | |
CVE-2026-39451 |
medium | 6.3 | 0.0018 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in WP Google Review Slider <= 18.0 versions. | |
CVE-2026-21768 |
medium | 6.3 | 0.0016 | 2026-06-19 | The compose-rich-editor library (v1.0.0-rc14) used in HCL Verse for Android's rich text email compos | |
CVE-2026-10585 |
medium | 6.3 | 0.0032 | 2026-06-30 | A stored cross-site scripting vulnerability was identified in GitHub Enterprise Server that allowed | |
CVE-2026-49978 |
medium | 6.3 | 0.0040 | 2026-07-14 | DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.7, DO | |
CVE-2026-14856 |
medium | 6.3 | 0.0039 | 2026-07-27 | A stored Cross-Site Scripting (XSS) vulnerability in the file upload functionality of the Media Mana | |
CVE-2026-66921 |
medium | 6.3 | 0.0044 | 2026-07-28 | Pivotick’s Markdown node-reference renderer failed to HTML-escape the attacker-controlled nodeName v | |
CVE-2026-66779 |
medium | 6.3 | 0.0035 | 2026-08-11 | Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP, an authe | |
CVE-2026-115513 |
medium | 6.3 | 0.0030 | 2026-10-22 | OpenCATS before 0.12.0 contains a stored cross-site scripting vulnerability that allows a low-privil | |
CVE-2026-61673 |
medium | 6.3 | 0.0033 | 2026-10-29 | WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored DOM cross-site scriptin |