CVE Vulnerability Database
Search and browse 425,091 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-6172 | MEDIUM | 6.4 | — | Sep 30, 2026 | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'caption' parameter of t... |
| CVE-2026-6171 | MEDIUM | 6.4 | — | Sep 30, 2026 | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' parameter of th... |
| CVE-2026-6170 | MEDIUM | 6.4 | — | Sep 30, 2026 | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'images' parameter of th... |
| CVE-2026-16596 | MEDIUM | 6.5 | — | Sep 30, 2026 | The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'data_fields_list' parameter in... |
| CVE-2026-14876 | MEDIUM | 6.4 | — | Sep 30, 2026 | The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-href' parameter in al... |
| CVE-2026-11895 | MEDIUM | 6.4 | — | Sep 30, 2026 | The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored Cro... |
| CVE-2026-102508 | CRITICAL | 9.2 | — | Sep 30, 2026 | Improper Verification of Cryptographic Signature and Improper Certificate Validation in the OPC UA driver of Apache PLC4... |
| CVE-2026-97196 | CRITICAL | 9.1 | — | Sep 30, 2026 | Improper Validation of Unsafe Equivalence in Input vulnerability in Liquid Web / StellarWP GiveWP allows Authentication ... |
| CVE-2026-89294 | HIGH | 7.5 | — | Sep 30, 2026 | The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and i... |
| CVE-2026-97316 | MEDIUM | 5.8 | — | Sep 30, 2026 | The Broken Link Notifier WordPress plugin before 2.0.0.1 does not re-validate the destination of redirects when checking... |
| CVE-2026-96886 | MEDIUM | 5.3 | — | Sep 30, 2026 | The Course Booking System WordPress plugin before 7.0.9 does not restrict access to its booking export, allowing unauthe... |
| CVE-2026-94297 | LOW | 2.7 | — | Sep 30, 2026 | The Media Library Organizer WordPress plugin before 2.1.4 does not verify that the requesting user holds the target tax... |
| CVE-2026-94274 | MEDIUM | 5.3 | — | Sep 30, 2026 | The YayReviews WordPress plugin before 1.4.1 does not restrict access to an API route that returns individual customer ... |
| CVE-2026-93580 | MEDIUM | 5.3 | — | Sep 30, 2026 | The InPost PL WordPress plugin before 1.9.8 does not verify the authenticity of incoming shipment webhook requests, rely... |
| CVE-2026-92994 | HIGH | 8.8 | — | Sep 30, 2026 | The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 does not validate the contents of files uploaded th... |
| CVE-2026-92424 | MEDIUM | 6.8 | — | Sep 30, 2026 | The Content Egg WordPress plugin before 11.9.0 does not verify that a user running its bulk content-import feature is a... |
| CVE-2026-91832 | HIGH | 7.1 | — | Sep 30, 2026 | The WP Mobile Menu WordPress plugin before 2.9 does not correctly verify the nonce on its settings import, so an attack... |
| CVE-2026-91072 | MEDIUM | 4.4 | — | Sep 30, 2026 | The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confine a WebP-derivative file migration routine to the ... |
| CVE-2026-91051 | MEDIUM | 6.6 | — | Sep 30, 2026 | The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permission... |
| CVE-2026-90953 | MEDIUM | 4.3 | — | Sep 30, 2026 | The Image Optimizer WordPress plugin before 1.7.7 does not enforce its intended capability check on several of its read... |
| CVE-2026-89193 | HIGH | 7.5 | — | Sep 30, 2026 | The Robin Image Optimizer WordPress plugin before 2.0.8 does not escape values that its bundled HTML parser re-emits in... |
| CVE-2026-89190 | MEDIUM | 4.3 | — | Sep 30, 2026 | The Robin Image Optimizer WordPress plugin before 2.0.8 does not check the user's capabilities before dispatching one o... |
| CVE-2026-88797 | HIGH | 7.1 | — | Sep 30, 2026 | The Vayu X WordPress theme before 1.0.6 does not perform any capability check on one of its AJAX actions and exposes the... |
| CVE-2026-88791 | LOW | 3.4 | — | Sep 30, 2026 | The Safe Redirect Manager WordPress plugin before 2.3.0 does not properly validate the redirect destination when a wildc... |
| CVE-2026-87777 | MEDIUM | 6.8 | — | Sep 30, 2026 | The Hostinger Reach WordPress plugin before 1.8.3 does not sanitize and escape a widget setting before outputting it in... |