CVE Vulnerability Database
Search and browse 420,251 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-118086 | HIGH | 8.8 | — | Oct 30, 2026 | Subscriber Privilege Escalation in WP BASE Booking <= 6.5.2 versions. |
| CVE-2026-116862 | HIGH | 7.5 | — | Oct 30, 2026 | Unauthenticated Broken Access Control in WP REST Cache <= 2026.3.1 versions. |
| CVE-2026-116861 | HIGH | 7.5 | — | Oct 30, 2026 | Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 versions. |
| CVE-2026-116854 | MEDIUM | 6.5 | — | Oct 30, 2026 | Subscriber Cross Site Scripting (XSS) in WP Customer Area <= 8.4.0 versions. |
| CVE-2026-116853 | MEDIUM | 6.5 | — | Oct 30, 2026 | Unauthenticated Broken Access Control in GiveWP <= 4.19.0.1 versions. |
| CVE-2026-116852 | CRITICAL | 9.1 | — | Oct 30, 2026 | Author Remote Code Execution (RCE) in Widget Options <= 4.2.5 versions. |
| CVE-2026-116851 | HIGH | 7.1 | — | Oct 30, 2026 | Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.6.5 versions. |
| CVE-2026-116847 | HIGH | 7.1 | — | Oct 30, 2026 | Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.6 versions. |
| CVE-2026-116410 | MEDIUM | 6.5 | — | Oct 30, 2026 | Unauthenticated Arbitrary Content Deletion in Masteriyo - LMS <= 3.4.3 versions. |
| CVE-2026-116405 | HIGH | 7.1 | — | Oct 30, 2026 | Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.9 versions. |
| CVE-2026-116401 | HIGH | 7.5 | — | Oct 30, 2026 | Unauthenticated Broken Access Control in HUSKY <= 1.4.6 versions. |
| CVE-2026-116386 | CRITICAL | 9.8 | — | Oct 30, 2026 | Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 versions. |
| CVE-2026-115947 | MEDIUM | 6.5 | — | Oct 30, 2026 | Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions. |
| CVE-2026-115604 | MEDIUM | 5 | — | Oct 30, 2026 | Subscriber Arbitrary File Deletion in SureDash <= 1.12.3 versions. |
| CVE-2026-114711 | MEDIUM | 6.5 | — | Oct 30, 2026 | Subscriber Cross Site Scripting (XSS) in MultiVendorX <= 5.0.20 versions. |
| CVE-2026-109213 | — | — | — | Oct 30, 2026 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-113499. Reason: This candidate is a... |
| CVE-2026-107868 | MEDIUM | 5.3 | — | Oct 30, 2026 | Unauthenticated Bypass Vulnerability in YITH WooCommerce Product Add-Ons <= 4.34.0 versions. |
| CVE-2026-105077 | HIGH | 7.1 | — | Oct 30, 2026 | Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.19 versions. |
| CVE-2026-104674 | MEDIUM | 4.3 | — | Oct 30, 2026 | Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Contr... |
| CVE-2026-9239 | MEDIUM | 6.4 | — | Oct 30, 2026 | The Meow Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Attachment Alt Text (aria-label a... |
| CVE-2026-97638 | HIGH | 7.5 | — | Oct 30, 2026 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure D... |
| CVE-2026-96894 | HIGH | 7.2 | — | Oct 30, 2026 | The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Si... |
| CVE-2026-84243 | HIGH | 7 | — | Oct 30, 2026 | The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries ... |
| CVE-2026-76012 | HIGH | 7.5 | — | Oct 30, 2026 | The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Exec... |
| CVE-2026-69446 | MEDIUM | 4.4 | 0.3% | Oct 30, 2026 | Incorrect authorization in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally. |