CVE Vulnerability Database
Search and browse 420,405 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-109384 | HIGH | 8.8 | 0.7% | Oct 28, 2026 | The The Innovative Form Builder – IvyForms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions u... |
| CVE-2026-109381 | HIGH | 7.2 | 0.4% | Oct 28, 2026 | The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.8 T... |
| CVE-2026-109370 | MEDIUM | 6.4 | 0.2% | Oct 28, 2026 | The Document Embedder – let visitors read files without downloading plugin for WordPress is vulnerable to Stored DOM-Bas... |
| CVE-2026-109218 | CRITICAL | 9.8 | 0.6% | Oct 28, 2026 | The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 9.... |
| CVE-2026-108366 | MEDIUM | 6.4 | 0.2% | Oct 28, 2026 | The easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution plugin for WordPress is vu... |
| CVE-2026-107710 | MEDIUM | 6.4 | 0.2% | Oct 28, 2026 | The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Sc... |
| CVE-2026-104743 | MEDIUM | 4.9 | 0.8% | Oct 28, 2026 | The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via t... |
| CVE-2026-104740 | MEDIUM | 6.4 | 0.2% | Oct 28, 2026 | The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vulnerable to Stored C... |
| CVE-2026-104729 | MEDIUM | 6.4 | 0.2% | Oct 28, 2026 | The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tab_index, empty_n... |
| CVE-2026-103996 | MEDIUM | 6.4 | 0.2% | Oct 28, 2026 | The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vulnerable to Stored C... |
| CVE-2026-103370 | MEDIUM | 6.4 | 0.3% | Oct 28, 2026 | The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site Script... |
| CVE-2026-100175 | MEDIUM | 5.4 | 0.3% | Oct 28, 2026 | The Postie plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Email Body URL Autolink in all versions... |
| CVE-2026-15323 | HIGH | 7.5 | 0.9% | Oct 28, 2026 | The Product Designer for WooCommerce WordPress | Lumise plugin for WordPress is vulnerable to Directory Traversal in all... |
| CVE-2026-115281 | MEDIUM | 6.8 | 0.2% | Oct 28, 2026 | The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not sanitize and cast a block and shortcode attribute bef... |
| CVE-2026-115255 | MEDIUM | 5.3 | 0.2% | Oct 28, 2026 | The WP Roster WordPress plugin before 2.35 does not perform any capability or nonce checks on one of its AJAX actions, a... |
| CVE-2026-115225 | MEDIUM | 5.8 | 0.2% | Oct 28, 2026 | The Customer Engagement System WordPress plugin before 2.0.2 does not restrict access to its MailChimp interest-group l... |
| CVE-2026-115224 | MEDIUM | 4.1 | 0.2% | Oct 28, 2026 | The Customer Engagement System WordPress plugin before 2.0.2 does not safely build the SQL statements that store a popu... |
| CVE-2026-113813 | MEDIUM | 6.5 | 0.2% | Oct 28, 2026 | The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not perform any capability or ownership check ... |
| CVE-2026-113494 | LOW | 2.7 | 0.2% | Oct 28, 2026 | The GeoDirectory WordPress plugin before 2.8.195 does not perform any status or ownership check when rendering a listin... |
| CVE-2026-113488 | MEDIUM | 6.8 | 0.2% | Oct 28, 2026 | The GeoDirectory WordPress plugin before 2.8.196 does not properly escape a post badge shortcode attribute for a JavaSc... |
| CVE-2026-113487 | MEDIUM | 6.8 | 0.2% | Oct 28, 2026 | The GeoDirectory WordPress plugin before 2.8.196 does not properly sanitise or escape a post badge click-through link v... |
| CVE-2026-113486 | MEDIUM | 6.5 | 0.1% | Oct 28, 2026 | The Media Library Assistant WordPress plugin before 3.42 does not verify a CSRF nonce on its Empty Trash media action, s... |
| CVE-2026-113485 | MEDIUM | 6.5 | 0.1% | Oct 28, 2026 | The Media Library Assistant WordPress plugin before 3.42 does not consistently validate its CSRF nonce on the Media Libr... |
| CVE-2026-111967 | MEDIUM | 6.8 | 0.2% | Oct 28, 2026 | The MP3 Audio Player WordPress plugin before 5.16 does not escape one of its audio player shortcode attributes before o... |
| CVE-2026-111961 | LOW | 3.8 | 0.1% | Oct 28, 2026 | The Royal MCP WordPress plugin before 1.5.10 does not perform an object-level permission check before duplicating a req... |