CVE Vulnerability Database
Search and browse 394,243 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-13295 | MEDIUM | 6.4 | 0.2% | Jun 27, 2026 | The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via panels_data Paramet... |
| CVE-2026-12471 | MEDIUM | 4.3 | 0.2% | Jun 27, 2026 | The Spexo theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the activate_plu... |
| CVE-2026-12432 | MEDIUM | 5.3 | 0.3% | Jun 27, 2026 | The WP Full Stripe Free plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.... |
| CVE-2026-12399 | MEDIUM | 4.4 | 0.2% | Jun 27, 2026 | The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Sc... |
| CVE-2026-11987 | MEDIUM | 4.3 | 0.3% | Jun 27, 2026 | The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPr... |
| CVE-2026-11783 | MEDIUM | 6.4 | 0.2% | Jun 27, 2026 | The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPr... |
| CVE-2026-11773 | MEDIUM | 4.3 | 0.1% | Jun 27, 2026 | The Masteriyo LMS – LMS Course Builder, Quizzes & Certificates plugin for WordPress is vulnerable to authorization bypas... |
| CVE-2026-11597 | MEDIUM | 6.4 | 0.2% | Jun 27, 2026 | The Surbma | Infusionsoft Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'infusions... |
| CVE-2026-11364 | MEDIUM | 4.3 | 0.2% | Jun 27, 2026 | The Product Specifications for WooCommerce plugin for WordPress is vulnerable to unauthorized modification, creation, an... |
| CVE-2026-9677 | MEDIUM | 4.8 | 0.2% | Jun 27, 2026 | The Shariff for WordPress Shariff for WordPress plugin through 1.0.11 does not sanitize or escape the shariff_infourl se... |
| CVE-2026-13245 | MEDIUM | 6.1 | 0.2% | Jun 27, 2026 | The MaxButtons – Create buttons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'view' para... |
| CVE-2026-12404 | MEDIUM | 5.3 | 0.3% | Jun 27, 2026 | The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to authorization bypass in all ve... |
| CVE-2026-10820 | HIGH | 8.1 | 0.1% | Jun 27, 2026 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress pl... |
| CVE-2026-12415 | CRITICAL | 9.8 | 0.7% | Jun 27, 2026 | The Invoice Generator plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on th... |
| CVE-2026-13422 | MEDIUM | 4.3 | 0.2% | Jun 27, 2026 | The HD Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 2.2.0 to 2.2.1. This is due to ... |
| CVE-2026-13335 | MEDIUM | 6.4 | 0.2% | Jun 27, 2026 | The CodePeople Post Map for Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cpm_point... |
| CVE-2026-13333 | MEDIUM | 6.5 | 0.3% | Jun 27, 2026 | The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection ... |
| CVE-2026-13331 | MEDIUM | 6.5 | 0.3% | Jun 27, 2026 | The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection ... |
| CVE-2026-11356 | MEDIUM | 4.4 | 0.3% | Jun 27, 2026 | The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'menu_t... |
| CVE-2025-59868 | MEDIUM | 5.5 | 0.1% | Jun 27, 2026 | HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a sensitive data exposure vulnerability which could allow an... |
| CVE-2023-37524 | HIGH | 7.8 | 0.1% | Jun 27, 2026 | HCL Traveler for Microsoft Outlook (HTMO) is susceptible to vulnerabilities due to .NET Framework 4.5 being out of servi... |
| CVE-2026-56414 | HIGH | 8.6 | 0.4% | Jun 26, 2026 | A vulnerability exists in H.View IP cameras certificate-related upload interfaces allow authenticated users to store arb... |
| CVE-2026-55975 | HIGH | 8.6 | 0.7% | Jun 26, 2026 | A vulnerability exists in H.View IP cameras that could allow an authenticated user to supply unsanitized XML fields to t... |
| CVE-2026-33560 | HIGH | 8.8 | 0.3% | Jun 26, 2026 | The DMP-5000 file service exposes authenticated arbitrary file upload functionality. There are exposed endpoints which a... |
| CVE-2026-31928 | CRITICAL | 9.8 | 0.4% | Jun 26, 2026 | The DMP-5000 devices are shipped with a default administrative web account with weak authentication controls, which are ... |