CVE Vulnerability Database
Search and browse 420,610 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-15261 | MEDIUM | 5.3 | 0.1% | Oct 21, 2026 | The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not enforce the same owner-only access control on its RE... |
| CVE-2026-111957 | MEDIUM | 5.3 | 0.1% | Oct 21, 2026 | The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not bind the payment it confirms with the p... |
| CVE-2026-111956 | MEDIUM | 5.9 | 0.2% | Oct 21, 2026 | The WholesaleX WordPress plugin before 3.0.9 does not protect or remove the user-import file it keeps in a publicly acc... |
| CVE-2026-111955 | MEDIUM | 6.5 | 0.2% | Oct 21, 2026 | The WholesaleX WordPress plugin before 3.0.9 does not check that a stored account confirmation code is set before compa... |
| CVE-2026-111949 | HIGH | 7.5 | 0.1% | Oct 21, 2026 | The miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additiona... |
| CVE-2026-111948 | HIGH | 7.1 | 0.2% | Oct 21, 2026 | The User Profile Builder WordPress plugin before 4.0.1 does not escape the current page URL before outputting it in a J... |
| CVE-2026-111947 | MEDIUM | 5.5 | 0.1% | Oct 21, 2026 | The Pricing Table WordPress Plugin WordPress plugin before 4.1.3 does not perform authorisation checks when duplicating... |
| CVE-2026-111596 | MEDIUM | 5.3 | 0.1% | Oct 21, 2026 | The Kliken: Ads + Pixel for Meta WordPress plugin before 1.2.3 does not verify that a visitor holds an order's key befor... |
| CVE-2026-111574 | HIGH | 7.5 | 0.2% | Oct 21, 2026 | The Redirection for Contact Form 7 WordPress plugin before 3.2.12 does not sanitise or escape submitted form data stored... |
| CVE-2026-110982 | MEDIUM | 4.9 | 0.1% | Oct 21, 2026 | The AI Engine WordPress plugin before 3.8.6 does not check that the caller is allowed to edit the targeted object befor... |
| CVE-2026-110651 | MEDIUM | 6.8 | 0.2% | Oct 21, 2026 | The Swift Performance Lite WordPress plugin before 2.3.7.4 does not properly sanitize and escape a value before using it... |
| CVE-2026-110523 | HIGH | 8.1 | 0.2% | Oct 21, 2026 | The WP User Manager WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force... |
| CVE-2026-110514 | MEDIUM | 4.9 | 0.1% | Oct 21, 2026 | The WPZOOM Portfolio Lite WordPress plugin before 1.4.34 does not check that a user is allowed to edit a post before ch... |
| CVE-2026-109926 | MEDIUM | 4.3 | 0.1% | Oct 21, 2026 | The Productive Commerce WordPress plugin before 1.1.49 does not perform a capability check in one of its AJAX actions a... |
| CVE-2026-109147 | HIGH | 7.1 | 0.2% | Oct 21, 2026 | The WP Booking System WordPress plugin before 2.1.0.3 does not validate and escape one of its parameters before reflect... |
| CVE-2026-108073 | MEDIUM | 5.3 | 0.2% | Oct 21, 2026 | The SureCart WordPress plugin before 4.9.5 does not restrict which related objects an anonymous visitor may include whe... |
| CVE-2026-107790 | MEDIUM | 6.8 | 0.2% | Oct 21, 2026 | The HireZoot WordPress plugin before 4.1.1 does not sanitise and escape some of its stored data before outputting it in... |
| CVE-2026-107789 | MEDIUM | 5.3 | 0.2% | Oct 21, 2026 | The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downl... |
| CVE-2026-107788 | MEDIUM | 4.3 | 0.1% | Oct 21, 2026 | The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when deleting shipping label reco... |
| CVE-2026-107506 | HIGH | 7.5 | 0.1% | Oct 21, 2026 | The Simple Banner WordPress plugin before 3.3.3 does not correctly limit the capabilities it grants to the user roles a... |
| CVE-2026-107237 | HIGH | 8.2 | 0.1% | Oct 21, 2026 | The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.28 does not perform capability or nonce checks on... |
| CVE-2026-107128 | MEDIUM | 5 | 0.1% | Oct 21, 2026 | The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not verify that the acting user is permitted to man... |
| CVE-2026-107127 | HIGH | 7.5 | 0.1% | Oct 21, 2026 | The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not validate the origin of a password-reset request... |
| CVE-2026-106932 | MEDIUM | 6.5 | 0.1% | Oct 21, 2026 | The Moloni WordPress plugin before 5.0.14 does not perform capability or nonce checks on several of its authenticated AJ... |
| CVE-2026-105999 | MEDIUM | 5.3 | 0.2% | Oct 21, 2026 | The Booking Package WordPress plugin before 1.7.31 does not perform authorization checks before returning calendar-accou... |