CVE Vulnerability Database
Search and browse 425,079 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-97248 | CRITICAL | 9.8 | — | Sep 30, 2026 | Unauthenticated PHP Object Injection in Booking Activities <= 1.18.7.1 versions. |
| CVE-2026-97247 | MEDIUM | 6.5 | — | Sep 30, 2026 | Unauthenticated Broken Access Control in Blocksy Companion <= 2.1.55 versions. |
| CVE-2026-97246 | MEDIUM | 4.9 | 0.2% | Sep 30, 2026 | Deserialization of Untrusted Data vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allo... |
| CVE-2026-97245 | HIGH | 7.2 | — | Sep 30, 2026 | Shop Worker Privilege Escalation in SureCart <= 4.7.2 versions. |
| CVE-2026-97244 | HIGH | 7.5 | — | Sep 30, 2026 | Contributor Path Traversal in Creator LMS <= 1.2.19 versions. |
| CVE-2026-97243 | MEDIUM | 5.4 | — | Sep 30, 2026 | Subscriber Broken Access Control in AllAble Connector <= 0.13.4 versions. |
| CVE-2026-97242 | MEDIUM | 6.8 | — | Sep 30, 2026 | Author Arbitrary File Deletion in WEBO MCP <= 3.0.18 versions. |
| CVE-2026-97241 | HIGH | 7.5 | — | Sep 30, 2026 | Unauthenticated Sensitive Data Exposure in BackupEase <= 2.2.2 versions. |
| CVE-2026-97240 | HIGH | 7.5 | — | Sep 30, 2026 | Unauthenticated Sensitive Data Exposure in StifLi Backup Tools <= 2.2.7 versions. |
| CVE-2026-97239 | MEDIUM | 6.5 | — | Sep 30, 2026 | Subscriber Broken Access Control in MCP Content Manager Lite <= 1.1.0 versions. |
| CVE-2026-97238 | MEDIUM | 5.5 | — | Sep 30, 2026 | Subscriber Cross Site Scripting (XSS) in JetEngine <= 3.8.14.3 versions. |
| CVE-2026-97237 | HIGH | 7.1 | 0.2% | Sep 30, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngi... |
| CVE-2026-97236 | MEDIUM | 6.5 | — | Sep 30, 2026 | Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions. |
| CVE-2026-97235 | HIGH | 7.1 | — | Sep 30, 2026 | Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions. |
| CVE-2026-97197 | HIGH | 7.5 | — | Sep 30, 2026 | Unauthenticated Broken Access Control in WordPress Backup & Migration <= 1.6.0 versions. |
| CVE-2026-97079 | MEDIUM | 4.3 | — | Sep 30, 2026 | Subscriber Insecure Direct Object References (IDOR) in Webba Booking <= 6.5.0 versions. |
| CVE-2026-97078 | MEDIUM | 5.3 | — | Sep 30, 2026 | Unauthenticated Insecure Direct Object References (IDOR) in Client Invoicing by Sprout Invoices <= 20.8.17 versions. |
| CVE-2026-97077 | HIGH | 7.1 | — | Sep 30, 2026 | Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.18 versions. |
| CVE-2026-97074 | MEDIUM | 4.3 | — | Sep 30, 2026 | Subscriber Insecure Direct Object References (IDOR) in Newsletters, Email Marketing, SMS and Popups by Omnisend <= 1.9.0... |
| CVE-2026-97067 | MEDIUM | 6.5 | — | Sep 30, 2026 | Contributor Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.7 versions. |
| CVE-2026-97066 | MEDIUM | 5.3 | — | Sep 30, 2026 | Unauthenticated Insecure Direct Object References (IDOR) in GiveWP <= 4.16.9 versions. |
| CVE-2026-97065 | HIGH | 7.1 | — | Sep 30, 2026 | Unauthenticated Cross Site Scripting (XSS) in Happyforms <= 1.26.15 versions. |
| CVE-2026-96838 | HIGH | 8.8 | — | Sep 30, 2026 | Unauthenticated Cross Site Request Forgery (CSRF) in Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & C... |
| CVE-2026-96837 | HIGH | 8.8 | — | Sep 30, 2026 | Contributor Remote Code Execution (RCE) in CartFlows <= 3.2.0 versions. |
| CVE-2026-96836 | HIGH | 7.1 | — | Sep 30, 2026 | Unauthenticated Cross Site Scripting (XSS) in Parsi Date <= 6.3 versions. |