CVE Vulnerability Database
Search and browse 420,405 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-111960 | MEDIUM | 4.3 | 0.1% | Oct 28, 2026 | The Royal MCP WordPress plugin before 1.5.10 does not perform object-level or post-type authorisation checks in one of ... |
| CVE-2026-111577 | HIGH | 7.2 | 0.1% | Oct 28, 2026 | The GoSMTP WordPress plugin before 1.2.5 does not perform a settings-management authorization check on its SMTP configu... |
| CVE-2026-111032 | LOW | 3.8 | 0.1% | Oct 28, 2026 | The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly verify authorization against the targeted produc... |
| CVE-2026-111031 | MEDIUM | 4.7 | 0.2% | Oct 28, 2026 | The Welcart e-Commerce WordPress plugin before 2.12.6 does not validate a user-supplied URL before using it in a redirec... |
| CVE-2026-111027 | MEDIUM | 6.8 | 0.2% | Oct 28, 2026 | The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly sanitise and escape a parameter before using it ... |
| CVE-2026-111021 | HIGH | 7.1 | 0.2% | Oct 28, 2026 | The افزونه پیامک ووکامرس | Persian WooCommerce SMS WordPress plugin before 7.3.2 does not sanitise and escape a paramete... |
| CVE-2026-110691 | MEDIUM | 6.5 | 0.2% | Oct 28, 2026 | The WPOrLogin WordPress plugin before 3.1.0 does not perform a capability check or validate a nonce before updating its... |
| CVE-2026-110524 | MEDIUM | 6.8 | 0.2% | Oct 28, 2026 | The Copy Anything to Clipboard for WordPress WordPress plugin before 5.5.5 does not sanitize and escape a shortcode att... |
| CVE-2026-110509 | MEDIUM | 5.3 | 0.2% | Oct 28, 2026 | The Essential Addons for Elementor WordPress plugin before 6.8.7 does not restrict the post type or meta query an unaut... |
| CVE-2026-110507 | LOW | 2.7 | 0.2% | Oct 28, 2026 | The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not restrict the query arguments users can add to its... |
| CVE-2026-110506 | MEDIUM | 6.8 | 0.2% | Oct 28, 2026 | The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not sanitize or escape a widget property before stori... |
| CVE-2026-110292 | MEDIUM | 6.5 | 0.2% | Oct 28, 2026 | The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not verify that the requester owns the WooComm... |
| CVE-2026-109236 | MEDIUM | 4.8 | 0.3% | Oct 28, 2026 | The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via a Predic... |
| CVE-2026-107100 | MEDIUM | 5.3 | 0.2% | Oct 28, 2026 | The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not verify that a requested post is publicly viewa... |
| CVE-2026-107098 | MEDIUM | 6.8 | 0.2% | Oct 28, 2026 | The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not sanitise and escape one of its map widget's si... |
| CVE-2026-107097 | MEDIUM | 5.3 | 0.2% | Oct 28, 2026 | The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not perform any authorization check before using t... |
| CVE-2026-106647 | LOW | 3.8 | 0.1% | Oct 28, 2026 | The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not scope a contact form's email delivery configur... |
| CVE-2026-106003 | MEDIUM | 5.3 | 0.2% | Oct 28, 2026 | The Court Reservation WordPress plugin before 1.12.4 does not perform any authorization, authentication or nonce valida... |
| CVE-2026-106002 | MEDIUM | 5.3 | 0.2% | Oct 28, 2026 | The Court Reservation WordPress plugin before 1.12.4 does not perform any authorisation or nonce verification on one of... |
| CVE-2026-105997 | MEDIUM | 5.3 | 0.2% | Oct 28, 2026 | The Booking Package WordPress plugin before 1.7.33 does not restrict who can trigger its booking verification-code email... |
| CVE-2026-105972 | HIGH | 7.5 | 0.2% | Oct 28, 2026 | The Menu Cart for WooCommerce WordPress plugin before 3.2.1 does not sanitise and escape cart item variation data before... |
| CVE-2026-104694 | MEDIUM | 6.8 | 0.2% | Oct 28, 2026 | The Thrive Automator WordPress plugin before 11.2 does not properly sanitize and escape a parameter's array key before u... |
| CVE-2026-103688 | CRITICAL | 9.8 | 0.2% | Oct 28, 2026 | The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does not validate uploaded file types when its a... |
| CVE-2026-103382 | MEDIUM | 5.3 | 0.2% | Oct 28, 2026 | The Casso Flow WordPress plugin before 4.2.0 does not properly authenticate incoming bank-transfer payment notification... |
| CVE-2026-103372 | MEDIUM | 5.3 | 0.2% | Oct 28, 2026 | The Payconiq WordPress plugin through 1.0.4 does not check that a visitor is allowed to see an order before returning it... |