CVE Vulnerability Database
Search and browse 380,679 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-16942 | MEDIUM | 5.4 | 0.2% | Aug 5, 2026 | The WP Custom HTML Page WordPress plugin through 0.6.2 does not sanitise HTML stored through one of its custom page hand... |
| CVE-2026-16940 | CRITICAL | 10 | 0.2% | Aug 5, 2026 | The Custom Fields WordPress plugin before 1.5.1 does not validate a user-supplied file path before deletion, allowing un... |
| CVE-2026-16746 | LOW | 2.7 | 0.1% | Aug 5, 2026 | The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in... |
| CVE-2026-16736 | HIGH | 7.5 | 0.1% | Aug 5, 2026 | The User Registration & Membership WordPress plugin before 5.2.6 does not enforce the site's registration-disabled sett... |
| CVE-2026-16613 | MEDIUM | 4.3 | 0.1% | Aug 5, 2026 | The GDPR Cookie Compliance WordPress plugin before 5.1.0 expires the visitor's cookies from an action that is reachable... |
| CVE-2026-16605 | HIGH | 7.2 | 0.1% | Aug 5, 2026 | The MultiVendorX WordPress plugin before 5.0.11 does not verify that the store targeted through its REST API belongs to... |
| CVE-2026-16604 | HIGH | 7.5 | 0.2% | Aug 5, 2026 | The Passster WordPress plugin before 4.3.6 outputs password-protected block content in the public page response before ... |
| CVE-2026-16603 | HIGH | 7.5 | 0.2% | Aug 5, 2026 | The Passster WordPress plugin before 4.3.6 does not enforce its category-based content protection on the WordPress REST... |
| CVE-2026-16602 | HIGH | 7.5 | 0.2% | Aug 5, 2026 | The Passster WordPress plugin before 4.3.6 does not perform a post-status check before returning post content from an u... |
| CVE-2026-16583 | MEDIUM | 6.1 | 0.2% | Aug 5, 2026 | The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.8... |
| CVE-2026-16573 | HIGH | 7.5 | 0.2% | Aug 5, 2026 | The Bit Form WordPress plugin before 3.2.0 does not sanitize an uploaded signature image before storing it, allowing un... |
| CVE-2026-16561 | HIGH | 7.5 | 0.1% | Aug 5, 2026 | The Sunshine Photo Cart WordPress plugin before 3.6.12 does not perform access control checks in one of its AJAX action... |
| CVE-2026-16055 | HIGH | 7.5 | 0.2% | Aug 5, 2026 | The Contest Gallery WordPress plugin before 30.0.7 does not route its front-end login through the standard WordPress au... |
| CVE-2026-16036 | HIGH | 7.5 | 0.1% | Aug 5, 2026 | The miniOrange 2FA WordPress plugin before 6.2.7 does not bind the second factor being configured during the pre-login ... |
| CVE-2026-15372 | HIGH | 7.5 | 0.2% | Aug 5, 2026 | The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported m... |
| CVE-2026-15360 | CRITICAL | 9.1 | 0.2% | Aug 5, 2026 | The Ajax Load More WordPress plugin before 8.0.1 does not properly sanitise and escape a parameter before using it in a... |
| CVE-2026-15230 | HIGH | 8.1 | 0.1% | Aug 5, 2026 | The YayPricing WordPress plugin before 3.5.7 does not perform capability checks on several of its REST API routes, rely... |
| CVE-2026-15210 | CRITICAL | 9.1 | 0.1% | Aug 5, 2026 | The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verifi... |
| CVE-2026-14553 | HIGH | 8.1 | 0.2% | Aug 5, 2026 | The zportals WordPress plugin before 6.3.4 does not properly validate uploaded files, trusting the client-supplied conte... |
| CVE-2025-15677 | LOW | 3.5 | 0.2% | Aug 5, 2026 | The GeoDirectory WordPress plugin before 2.8.110 does not sanitise and escape a place-category setting before outputtin... |
| CVE-2026-9273 | CRITICAL | 9.3 | 0.3% | Aug 5, 2026 | The Membership Plugin – Kadence Memberships plugin for WordPress (formerly Restrict Content) is vulnerable to password r... |
| CVE-2026-8790 | MEDIUM | 6.1 | 0.2% | Aug 5, 2026 | The Football Pool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `shouttext` POST paramete... |
| CVE-2026-8761 | HIGH | 8.8 | 0.4% | Aug 5, 2026 | The Dokan plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.0.1. This i... |
| CVE-2026-7753 | MEDIUM | 6.5 | 0.4% | Aug 5, 2026 | The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorized access of sensitive data due to a missing... |
| CVE-2026-71192 | MEDIUM | 6 | — | Aug 5, 2026 | In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers (X-Copy-From, X-C... |