CVE Vulnerability Database
Search and browse 420,214 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-115205 | MEDIUM | 6.5 | 0.1% | Nov 3, 2026 | The AZEXO Store Locator WordPress plugin through 1.4 does not have a capability check or any authorization control when ... |
| CVE-2026-106004 | MEDIUM | 5.3 | 0.1% | Nov 3, 2026 | The DT LMS WordPress plugin through 1.2 does not perform capability or nonce checks on one of its AJAX actions, allowin... |
| CVE-2026-105993 | MEDIUM | 5.3 | 0.1% | Nov 3, 2026 | The DT Directory Lite Addon WordPress plugin through 1.1 does not perform nonce or capability checks on its settings han... |
| CVE-2026-105967 | MEDIUM | 5.8 | 0.1% | Nov 3, 2026 | The Gallery for Social Photo WordPress plugin through 1.0.0.41 does not validate a user-supplied URL before using it to ... |
| CVE-2026-104648 | MEDIUM | 4.9 | 0.1% | Nov 3, 2026 | The weMail WordPress plugin through 2.1.6 does not restrict a site-wide third-party email-service API key to administra... |
| CVE-2026-104647 | LOW | 3.8 | 0.1% | Nov 3, 2026 | The weMail WordPress plugin through 2.1.6 does not correctly verify user capabilities in its REST API permission checks... |
| CVE-2026-103379 | MEDIUM | 5.3 | 0.1% | Nov 3, 2026 | The WATI Chat and Notification WordPress plugin through 1.1.8 does not require a valid, non-empty secret on a public end... |
| CVE-2026-77800 | HIGH | 7.7 | 1.0% | Nov 3, 2026 | ManageEngine Key Manager Plus versions before 7151 are vulnerable to a SAML authentication bypass that allows attackers ... |
| CVE-2026-77799 | HIGH | 7.4 | 1.2% | Nov 3, 2026 | ManageEngine Key Manager Plus versions before 7150 are vulnerable to a Two-Factor Authentication bypass that allows atta... |
| CVE-2026-120971 | MEDIUM | 5.3 | 0.3% | Nov 3, 2026 | A flaw was found in RESTEasy's default exception mapper. When an unhandled exception other than a WebApplicationExceptio... |
| CVE-2026-120578 | MEDIUM | 5.3 | — | Nov 3, 2026 | The AI Alt Text Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and includin... |
| CVE-2026-120577 | HIGH | 8.1 | — | Nov 3, 2026 | The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to arbitrary fil... |
| CVE-2026-120575 | MEDIUM | 6.4 | 0.2% | Nov 3, 2026 | The Photo Engine (Media Organizer & Lightroom) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the... |
| CVE-2026-120574 | HIGH | 8.1 | 0.3% | Nov 3, 2026 | The SureCart plugin for WordPress is vulnerable to unauthenticated account takeover in all versions up to, and including... |
| CVE-2026-120563 | MEDIUM | 4.9 | 0.3% | Nov 3, 2026 | The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress is vulnerable to SQL Injection in all versio... |
| CVE-2026-120561 | MEDIUM | 5.3 | — | Nov 3, 2026 | The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to unauthorized modification of data... |
| CVE-2026-120559 | HIGH | 7.5 | — | Nov 3, 2026 | The Contact Form Extender for Divi Builder plugin for WordPress is vulnerable to Arbitrary File Deletion due to insuffic... |
| CVE-2026-120558 | HIGH | 7.2 | 0.3% | Nov 3, 2026 | The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the `tracking_pro... |
| CVE-2026-120552 | MEDIUM | 6.4 | 0.2% | Nov 3, 2026 | The SEO Engine – Smart SEO with AI, Schema & Redirection for WordPress plugin for WordPress is vulnerable to Stored Cros... |
| CVE-2026-120551 | MEDIUM | 5.3 | 0.2% | Nov 3, 2026 | The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to authorization bypass in... |
| CVE-2026-120544 | MEDIUM | 4.3 | — | Nov 3, 2026 | The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to Directory T... |
| CVE-2026-120538 | HIGH | 8.1 | — | Nov 3, 2026 | The Easy Digital Downloads plugin for WordPress is vulnerable to authentication bypass leading to administrator account ... |
| CVE-2026-120534 | CRITICAL | 9.8 | 0.3% | Nov 3, 2026 | The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up... |
| CVE-2026-120524 | MEDIUM | 6.4 | 0.2% | Nov 3, 2026 | The News Kit Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formData' p... |
| CVE-2026-120518 | CRITICAL | 9.1 | 0.8% | Nov 3, 2026 | The BuddyPress XProfile Image Field plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to,... |