CVE Vulnerability Database
Search and browse 425,079 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-96173 | MEDIUM | 5.3 | — | Oct 1, 2026 | The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order ... |
| CVE-2026-92412 | HIGH | 7.1 | — | Oct 1, 2026 | The Five Star Restaurant Reviews WordPress plugin before 2.3.14 does not properly escape a user-supplied value before ou... |
| CVE-2026-90974 | MEDIUM | 6.5 | — | Oct 1, 2026 | The WP Fusion Lite WordPress plugin before 3.48.0 does not require authentication on a settings handler that runs durin... |
| CVE-2026-90972 | MEDIUM | 5.4 | — | Oct 1, 2026 | The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers... |
| CVE-2026-89296 | HIGH | 8.6 | — | Oct 1, 2026 | The Pro Like Button WordPress plugin before 2.0 does not properly sanitize and escape a parameter before using it in a S... |
| CVE-2026-88999 | MEDIUM | 4.3 | 0.3% | Oct 1, 2026 | The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5... |
| CVE-2026-87973 | LOW | 3.1 | — | Oct 1, 2026 | The If-So Dynamic Content WordPress plugin before 1.10.2 does not sanitize a conversion name before storing it, nor esc... |
| CVE-2026-87970 | MEDIUM | 4.7 | — | Oct 1, 2026 | The If-So Dynamic Content WordPress plugin before 1.10.2 does not escape a request-supplied value before reflecting it ... |
| CVE-2026-86610 | MEDIUM | 6.4 | — | Oct 1, 2026 | The Download Manager WordPress plugin before 3.3.71 does not sufficiently sanitise and escape a package setting before o... |
| CVE-2026-85679 | HIGH | 7.2 | 0.3% | Oct 1, 2026 | The Extendify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'styles.blocks' Block Type Key in al... |
| CVE-2026-81809 | HIGH | 7.5 | — | Oct 1, 2026 | The Paytm Payment Gateway WordPress plugin before 2.8.9 does not properly escape data taken from payment callbacks befor... |
| CVE-2026-81739 | HIGH | 7.5 | — | Oct 1, 2026 | The Paytm Payment Gateway WordPress plugin before 2.8.9 does not sanitize and escape data it stores from payment callbac... |
| CVE-2026-80276 | HIGH | 7.5 | 0.4% | Oct 1, 2026 | Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 expose a network-accessible m... |
| CVE-2026-80275 | HIGH | 8.8 | 0.2% | Oct 1, 2026 | Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 fail to enforce server-side a... |
| CVE-2026-67075 | MEDIUM | 6.5 | — | Oct 1, 2026 | HCL Digital Experience is affected by improper input sanitation. This can result in HTML injection which could be lever... |
| CVE-2026-19253 | HIGH | 8.7 | — | Oct 1, 2026 | The Cache Enabler WordPress plugin before 1.8.17 does not validate a URL before using it to build a filesystem path in i... |
| CVE-2026-103543 | MEDIUM | 6.3 | — | Oct 1, 2026 | A vulnerability has been found in itsourcecode Leave Management System 1.0. The affected element is an unknown function ... |
| CVE-2026-103542 | MEDIUM | 4.3 | 0.2% | Oct 1, 2026 | A flaw has been found in formtools.org Form Tools up to 3.1.1. Impacted is the function smart_fill of the file /global/c... |
| CVE-2026-103541 | MEDIUM | 6.3 | — | Oct 1, 2026 | A vulnerability was detected in formtools.org Form Tools up to 3.1.1. This issue affects the function Files::uploadFile ... |
| CVE-2026-103540 | MEDIUM | 6.3 | — | Oct 1, 2026 | A security vulnerability has been detected in formtools.org Form Tools up to 3.1.1. This vulnerability affects the funct... |
| CVE-2026-101148 | CRITICAL | 10 | — | Oct 1, 2026 | The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 does not properly validate its integration key, tre... |
| CVE-2026-101147 | HIGH | 8.8 | — | Oct 1, 2026 | The Featured Image from URL (FIFU) WordPress plugin before 6.0.8, Featured Image from URL (FIFU) Premium WordPress plugi... |
| CVE-2026-92966 | CRITICAL | 9.1 | — | Oct 1, 2026 | The The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable ... |
| CVE-2026-92548 | MEDIUM | 5.3 | 0.3% | Oct 1, 2026 | The WP Popular Posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and inc... |
| CVE-2026-82829 | CRITICAL | 9.8 | — | Oct 1, 2026 | Hitachi Coding Software Suite contains a vulnerability related to Hidden Functionality vulnerability which allows an att... |