CVE Vulnerability Database
Search and browse 425,069 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-84740 | MEDIUM | 6.5 | 0.2% | Oct 2, 2026 | The Events Calendar WordPress plugin before 6.17.5.1 does not validate or sanitise data submitted to an unauthenticated ... |
| CVE-2026-79618 | MEDIUM | 4.3 | 0.2% | Oct 2, 2026 | The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its... |
| CVE-2026-63569 | MEDIUM | 6.5 | 0.4% | Oct 2, 2026 | Improper input validation in DHAgreement.CalculateAgreement (MTI/A0 two-pass Diffie-Hellman) in Legion of the Bouncy Cas... |
| CVE-2026-63568 | HIGH | 7.5 | 0.3% | Oct 2, 2026 | Allocation of resources without limits or throttling in the CMP/CRMF password-based MAC verifier (PKMacBuilder) in Legio... |
| CVE-2026-63567 | HIGH | 7.5 | 0.5% | Oct 2, 2026 | Observable discrepancy in IesEngine.DecryptBlock in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a rem... |
| CVE-2026-63566 | HIGH | 7.5 | 0.4% | Oct 2, 2026 | Memory allocation with excessive size value in the DTLS handshake reassembly (DtlsReliableHandshake, DtlsReassembler) in... |
| CVE-2026-1661 | MEDIUM | 4.3 | 0.2% | Oct 2, 2026 | The WP Mail Logging WordPress plugin before 1.17.0 does not properly restrict the HTML and CSS of logged emails before r... |
| CVE-2026-16001 | HIGH | 7.5 | 0.2% | Oct 2, 2026 | Exposure of the message authentication key through the encryption keystream in the stream mode of IesEngine (an IesEngin... |
| CVE-2026-16000 | HIGH | 7.5 | 0.3% | Oct 2, 2026 | Missing cryptographic step in the DSTU 7624 CCM mode implementation (KCcmBlockCipher) in Legion of the Bouncy Castle Inc... |
| CVE-2026-15999 | HIGH | 7.5 | 0.3% | Oct 2, 2026 | Improper validation of integrity check value in the AES-CCM implementation (CcmParameters and CcmBlockCipher) in Legion ... |
| CVE-2026-13413 | MEDIUM | 5.3 | 0.2% | Oct 2, 2026 | The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.20 does not correctly restrict access to the site while ... |
| CVE-2026-102565 | HIGH | 7.2 | 0.3% | Oct 2, 2026 | The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'booking_service_qty' p... |
| CVE-2026-97318 | MEDIUM | 6.1 | 0.1% | Oct 2, 2026 | The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not properly validate a giveaway's paren... |
| CVE-2026-97317 | MEDIUM | 5.3 | 0.1% | Oct 2, 2026 | The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not remove the reCAPTCHA secret key from... |
| CVE-2026-94298 | MEDIUM | 6.2 | 0.2% | Oct 2, 2026 | The BuildKit WordPress plugin before 1.0.29 does not properly sanitise and escape data submitted by contributor-level u... |
| CVE-2026-92820 | HIGH | 8.1 | 0.5% | Oct 2, 2026 | The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file operations in all versions up to, an... |
| CVE-2026-92174 | HIGH | 7.5 | 0.6% | Oct 2, 2026 | The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and incl... |
| CVE-2026-91828 | HIGH | 7.5 | 0.2% | Oct 2, 2026 | The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin before 6.3.11 does not require authenticati... |
| CVE-2026-91023 | LOW | 3.1 | 0.1% | Oct 2, 2026 | The Motors WordPress plugin before 1.4.124 does not properly verify that a user is authorised to modify a listing befor... |
| CVE-2026-91022 | MEDIUM | 6.8 | 0.2% | Oct 2, 2026 | The Motors WordPress plugin before 1.4.124 does not sanitise and escape a listing badge setting before outputting it in... |
| CVE-2026-90988 | MEDIUM | 5.3 | 0.1% | Oct 2, 2026 | The Request a Quote WordPress plugin through 2.5.6 does not perform an authorization check on one of its unauthenticate... |
| CVE-2026-90438 | HIGH | 7.2 | 0.3% | Oct 2, 2026 | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site S... |
| CVE-2026-85016 | MEDIUM | 6.8 | 0.2% | Oct 2, 2026 | The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not escape an icon value before concatenating i... |
| CVE-2026-85004 | MEDIUM | 4.3 | 0.1% | Oct 2, 2026 | The Popup Maker WordPress plugin through 1.4.5 does not perform a capability check on one of its account-connection act... |
| CVE-2026-84925 | MEDIUM | 6.1 | 0.2% | Oct 2, 2026 | The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Reflected Cross-Site Script... |