2026 CVE Vulnerabilities
85,245 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-1400 | HIGH | 7.2 | 0.7% | Jan 28, 2026 | The AI Engine – The Chatbot and AI Framework for WordPress plugin for WordPress is vulnerable to arbitrary file uploads ... |
| CVE-2026-1381 | MEDIUM | 4.4 | 0.3% | Jan 28, 2026 | The Order Minimum/Maximum Amount Limits for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scriptin... |
| CVE-2026-1053 | MEDIUM | 4.4 | 0.3% | Jan 28, 2026 | The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin s... |
| CVE-2026-0702 | HIGH | 7.5 | 0.4% | Jan 28, 2026 | The VidShop – Shoppable Videos for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the 'f... |
| CVE-2026-1389 | MEDIUM | 4.3 | 0.2% | Jan 28, 2026 | The Document Embedder – Embed PDFs, Word, Excel, and Other Files plugin for WordPress is vulnerable to Insecure Direct O... |
| CVE-2026-1054 | MEDIUM | 5.3 | 0.2% | Jan 28, 2026 | The RegistrationMagic plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.0.... |
| CVE-2026-0818 | MEDIUM | 4.3 | 0.2% | Jan 28, 2026 | When a user explicitly requested Thunderbird to decrypt an inline OpenPGP message that was embedded in a text section of... |
| CVE-2026-1466 | MEDIUM | 6.1 | 0.3% | Jan 28, 2026 | Jirafeau normally prevents browser preview for text files due to the possibility that for example SVG and HTML documents... |
| CVE-2026-1310 | MEDIUM | 5.3 | 0.3% | Jan 28, 2026 | The Simple calendar for Elementor plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and... |
| CVE-2026-1295 | MEDIUM | 6.4 | 0.3% | Jan 28, 2026 | The Buy Now Plus – Buy Now buttons for Stripe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ... |
| CVE-2026-1244 | MEDIUM | 6.4 | 0.3% | Jan 28, 2026 | The Forms Bridge – Infinite integrations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' ... |
| CVE-2026-0832 | HIGH | 7.3 | 0.3% | Jan 28, 2026 | The New User Approve plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a... |
| CVE-2026-0825 | MEDIUM | 5.3 | 0.4% | Jan 28, 2026 | The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to authorization bypass due... |
| CVE-2026-1298 | MEDIUM | 4.3 | 0.3% | Jan 28, 2026 | The Easy Replace Image plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including,... |
| CVE-2026-1083 | MEDIUM | 4.4 | 0.3% | Jan 28, 2026 | The Appointment Hour Booking – Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via fo... |
| CVE-2026-24867 | — | — | — | Jan 28, 2026 | Rejected reason: Not used |
| CVE-2026-24866 | — | — | — | Jan 28, 2026 | Rejected reason: Not used |
| CVE-2026-24865 | — | — | — | Jan 28, 2026 | Rejected reason: Not used |
| CVE-2026-24864 | — | — | — | Jan 28, 2026 | Rejected reason: Not used |
| CVE-2026-24863 | — | — | — | Jan 28, 2026 | Rejected reason: Not used |
| CVE-2026-24862 | — | — | — | Jan 28, 2026 | Rejected reason: Not used |
| CVE-2026-24861 | — | — | — | Jan 28, 2026 | Rejected reason: Not used |
| CVE-2026-24860 | — | — | — | Jan 28, 2026 | Rejected reason: Not used |
| CVE-2026-24859 | — | — | — | Jan 28, 2026 | Rejected reason: Not used |
| CVE-2026-1514 | HIGH | 7.1 | 0.3% | Jan 28, 2026 | Official Document Management System developed by 2100 Technology has a Incorrect Authorization vulnerability, allowing a... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now