CVE Vulnerability Database
Search and browse 423,806 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-100316 | HIGH | 7.2 | 0.3% | Oct 17, 2026 | The European VAT Compliance Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting ... |
| CVE-2026-110384 | HIGH | 7.1 | 0.2% | Oct 17, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Heateor Support Fa... |
| CVE-2026-97314 | MEDIUM | 6.5 | 0.2% | Oct 17, 2026 | The ThirstyAffiliates WordPress plugin before 3.12.1 does not check the status or type of the object requested by its l... |
| CVE-2026-92433 | MEDIUM | 6.5 | 0.1% | Oct 17, 2026 | The Patreon WordPress plugin before 1.10.0 does not verify a nonce when connecting the site to a Patreon account, allowi... |
| CVE-2026-92432 | MEDIUM | 4.3 | 0.2% | Oct 17, 2026 | The Patreon WordPress plugin before 1.10.0 does not validate a user-supplied redirect destination before redirecting, al... |
| CVE-2026-92431 | LOW | 3.7 | 0.2% | Oct 17, 2026 | The Patreon WordPress plugin before 1.10.0 does not perform an authorization check on some of its functionality, allowin... |
| CVE-2026-91074 | MEDIUM | 6.8 | 0.2% | Oct 17, 2026 | The BSK PDF Manager WordPress plugin through 3.8.1 does not properly sanitise and escape a parameter before using it in ... |
| CVE-2026-81344 | MEDIUM | 6.6 | 0.4% | Oct 17, 2026 | The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not restrict which PHP classes may be instant... |
| CVE-2026-81343 | MEDIUM | 5.3 | 0.2% | Oct 17, 2026 | The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not perform a capability check on one of its ... |
| CVE-2026-110527 | MEDIUM | 5.3 | 0.2% | Oct 17, 2026 | The WP User Manager WordPress plugin before 2.9.20 does not roll back the WordPress account it creates during payment-g... |
| CVE-2026-106470 | MEDIUM | 5 | 0.1% | Oct 17, 2026 | The WP Data Access WordPress plugin before 5.5.88 does not have authorisation and CSRF checks in one of its actions, al... |
| CVE-2026-104246 | MEDIUM | 5.9 | 0.3% | Oct 17, 2026 | The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value before build... |
| CVE-2026-104122 | MEDIUM | 6.8 | 0.2% | Oct 17, 2026 | The Ukr-To-Lat WordPress plugin through 1.3.5 does not sanitize and escape a term name before using it in a SQL query, a... |
| CVE-2026-103376 | MEDIUM | 5.3 | 0.2% | Oct 17, 2026 | The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) WordPre... |
| CVE-2026-96660 | HIGH | 7.2 | 0.2% | Oct 17, 2026 | The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom U... |
| CVE-2026-92978 | MEDIUM | 4.3 | 0.2% | Oct 17, 2026 | The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom U... |
| CVE-2026-92798 | HIGH | 8.1 | 0.4% | Oct 17, 2026 | The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to... |
| CVE-2026-92715 | MEDIUM | 4.3 | 0.2% | Oct 17, 2026 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Refere... |
| CVE-2026-111726 | MEDIUM | 6.4 | 0.2% | Oct 17, 2026 | The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'visible' Shortcode Attribute ... |
| CVE-2026-110268 | MEDIUM | 4.9 | 0.8% | Oct 17, 2026 | The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and i... |
| CVE-2026-109989 | MEDIUM | 6.4 | 0.2% | Oct 17, 2026 | The Themify Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'popup_width_unit' parameter... |
| CVE-2026-109985 | MEDIUM | 6.4 | 0.2% | Oct 17, 2026 | The xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN plugin for WordPress is vulnerable to Stored Cross-... |
| CVE-2026-109369 | MEDIUM | 6.8 | 0.3% | Oct 17, 2026 | The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up t... |
| CVE-2026-109368 | MEDIUM | 6.5 | 0.3% | Oct 17, 2026 | The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all ver... |
| CVE-2026-108123 | HIGH | 7.5 | 0.3% | Oct 17, 2026 | The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up t... |