CVE Vulnerability Database
Search and browse 420,244 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-107765 | MEDIUM | 6.4 | 0.2% | Oct 31, 2026 | The Discussion Board – WordPress Forum Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versi... |
| CVE-2026-107750 | HIGH | 7.2 | 0.3% | Oct 31, 2026 | The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via t... |
| CVE-2026-107653 | HIGH | 7.2 | 0.3% | Oct 31, 2026 | The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payment... |
| CVE-2026-94361 | MEDIUM | 5.3 | 0.2% | Oct 31, 2026 | The Payable Payment Gateway for WooCommerce WordPress plugin before 1.3.1 does not verify the authenticity of an incomin... |
| CVE-2026-92294 | MEDIUM | 6.5 | 0.4% | Oct 31, 2026 | The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to limited file d... |
| CVE-2026-82214 | MEDIUM | 5.3 | 0.3% | Oct 31, 2026 | The Quick Event Manager WordPress plugin before 9.19 does not verify the status or type of the requested post before ret... |
| CVE-2026-119977 | HIGH | 8.1 | 0.6% | Oct 31, 2026 | WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-acc... |
| CVE-2026-118638 | HIGH | 7.5 | 0.3% | Oct 31, 2026 | The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that writ... |
| CVE-2026-118629 | MEDIUM | 5.3 | 0.3% | Oct 31, 2026 | The All-in-One Video Gallery WordPress plugin before 5.0.0 does not check a video's publication status before rendering... |
| CVE-2026-118438 | MEDIUM | 6.8 | 0.3% | Oct 31, 2026 | The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before processing ... |
| CVE-2026-118437 | LOW | 3.7 | 0.2% | Oct 31, 2026 | The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before deleting guest-uploaded attachme... |
| CVE-2026-118185 | HIGH | 7.5 | 0.3% | Oct 31, 2026 | The Security Optimizer WordPress plugin before 1.6.9 does not limit the number of two-factor authentication codes that ... |
| CVE-2026-118184 | MEDIUM | 5.3 | 0.2% | Oct 31, 2026 | The Premium Packages WordPress plugin before 7.2.2 does not prevent unauthenticated visitors from overwriting the store... |
| CVE-2026-118043 | HIGH | 7.2 | 0.2% | Oct 31, 2026 | The Bulk Media Register WordPress plugin before 2.01 does not properly validate a user-supplied path before moving a fil... |
| CVE-2026-116563 | MEDIUM | 5.4 | 0.4% | Oct 31, 2026 | The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Stored DOM-Based... |
| CVE-2026-116520 | HIGH | 7.2 | 0.4% | Oct 31, 2026 | The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment / s... |
| CVE-2026-110808 | MEDIUM | 4.2 | 0.2% | Oct 31, 2026 | The Essential Addons for Elementor WordPress plugin before 6.8.8 does not correctly restrict who may set the role assig... |
| CVE-2026-110042 | MEDIUM | 4.9 | 0.3% | Oct 31, 2026 | The Payment Forms for Paystack WordPress plugin before 4.0.6 does not properly restrict access to a page that displays i... |
| CVE-2026-109997 | HIGH | 7.2 | 0.4% | Oct 31, 2026 | The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is v... |
| CVE-2026-109234 | HIGH | 7.2 | 0.4% | Oct 31, 2026 | The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (bbPress reply... |
| CVE-2026-101326 | MEDIUM | 5.4 | 0.4% | Oct 31, 2026 | The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress ... |
| CVE-2026-100155 | MEDIUM | 6.5 | 0.5% | Oct 31, 2026 | The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress ... |
| CVE-2026-116755 | HIGH | 7.4 | 0.9% | Oct 31, 2026 | Improper Neutralization of Special Elements used in a Command ('Command Injection') in the Orchestrator component of Sof... |
| CVE-2026-110176 | HIGH | 8.7 | 0.2% | Oct 31, 2026 | The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a f... |
| CVE-2026-77152 | MEDIUM | 5.3 | 0.2% | Oct 31, 2026 | Improper Authorization vulnerability in Drupal Field Collection for Drupal 7 allows a user with the "edit field collecti... |