CVE Vulnerability Database
Search and browse 383,865 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-6251 | MEDIUM | 6.5 | 0.2% | Jul 28, 2026 | The Chaty Pro plugin for WordPress is vulnerable to Authenticated Time-Based Blind SQL Injection in versions up to and i... |
| CVE-2026-16811 | MEDIUM | 4.9 | 0.3% | Jul 28, 2026 | The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to time-bas... |
| CVE-2026-16797 | MEDIUM | 4.3 | 0.2% | Jul 28, 2026 | The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Insecure... |
| CVE-2026-16587 | MEDIUM | 4.3 | 0.2% | Jul 28, 2026 | The Advanced Form Integration — Connect Forms to 200+ Apps plugin for WordPress is vulnerable to authorization bypass in... |
| CVE-2026-16585 | HIGH | 7.2 | 0.7% | Jul 28, 2026 | The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to arbi... |
| CVE-2026-15136 | MEDIUM | 4.3 | 0.1% | Jul 28, 2026 | The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Cross-Site Request Forgery... |
| CVE-2026-15012 | MEDIUM | 5.3 | 0.3% | Jul 28, 2026 | The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory C... |
| CVE-2026-14926 | MEDIUM | 4.2 | 0.1% | Jul 28, 2026 | The FluentCart A New Era of eCommerce WordPress plugin before 1.4.0 does not verify that a subscription belongs to the ... |
| CVE-2026-14924 | HIGH | 7.5 | 0.2% | Jul 28, 2026 | The Tablesome Table WordPress plugin before 1.1.31 does not perform any authentication, capability, or nonce checks in ... |
| CVE-2026-14870 | HIGH | 7.1 | 0.2% | Jul 28, 2026 | The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and e... |
| CVE-2026-14821 | LOW | 2.7 | 0.1% | Jul 28, 2026 | The Quiz and Survey Master (QSM) WordPress plugin before 11.1.5 does not perform a capability check before deleting out... |
| CVE-2026-14819 | LOW | 3.5 | 0.2% | Jul 28, 2026 | The Event Tickets and Registration WordPress plugin before 5.28.4 does not properly escape event titles before outputtin... |
| CVE-2026-14545 | CRITICAL | 9.8 | 0.1% | Jul 28, 2026 | The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password throu... |
| CVE-2026-14490 | HIGH | 7.5 | 0.5% | Jul 28, 2026 | The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory D... |
| CVE-2026-12124 | MEDIUM | 5.3 | 0.2% | Jul 28, 2026 | The PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin for Word... |
| CVE-2026-17528 | MEDIUM | 6.1 | 0.2% | Jul 28, 2026 | Versions of the package nice-select2 before 2.4.1 are vulnerable to Cross-site Scripting (XSS) via the <select> element.... |
| CVE-2026-17524 | HIGH | 8.7 | 0.8% | Jul 28, 2026 | Versions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal via the caching mechanism for path va... |
| CVE-2026-66473 | HIGH | 7.5 | 0.2% | Jul 27, 2026 | Unauthenticated Broken Access Control in Xendit Payment <= 7.1.0 versions. |
| CVE-2026-65448 | MEDIUM | 6.5 | 0.1% | Jul 27, 2026 | Unauthenticated Cross Site Scripting (XSS) in Anti Spam and list cleaner – AcyChecker <= 1.8.1 versions. |
| CVE-2026-65447 | HIGH | 7.1 | 0.1% | Jul 27, 2026 | Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.6 versions. |
| CVE-2026-65446 | HIGH | 7.1 | 0.1% | Jul 27, 2026 | Unauthenticated Cross Site Scripting (XSS) in Kali Forms <= 2.4.18 versions. |
| CVE-2026-65445 | MEDIUM | 6.5 | 0.2% | Jul 27, 2026 | Unauthenticated Broken Access Control in Ad Invalid Click Protector (AICP) <= 1.3.0 versions. |
| CVE-2026-65443 | HIGH | 7.1 | 0.1% | Jul 27, 2026 | Unauthenticated Cross Site Scripting (XSS) in BackWPup <= 5.7.4 versions. |
| CVE-2026-65442 | HIGH | 7.2 | 0.2% | Jul 27, 2026 | Unauthenticated Server Side Request Forgery (SSRF) in FormCraft <= 3.9.15 versions. |
| CVE-2026-65441 | HIGH | 7.1 | 0.1% | Jul 27, 2026 | Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.3 versions. |