CVE Vulnerability Database
Search and browse 423,865 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-91833 | MEDIUM | 6.8 | 0.2% | Oct 16, 2026 | The WX Subscribe 微信支付付费订阅 WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a ... |
| CVE-2026-91830 | MEDIUM | 6.5 | 0.1% | Oct 16, 2026 | The Subscribe to Comments WordPress plugin before 2.3.3 does not sign or validate a cookie it trusts to identify a comme... |
| CVE-2026-74923 | MEDIUM | 5.3 | 0.1% | Oct 16, 2026 | The Document Gallery WordPress plugin through 5.1.1 does not perform any capability or ownership check when generating a... |
| CVE-2026-19867 | MEDIUM | 4.3 | 0.2% | Oct 16, 2026 | Mattermost versions 11.10.x <= 11.10.0, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to cap the number and... |
| CVE-2026-19798 | MEDIUM | 4.3 | 0.2% | Oct 16, 2026 | The Wp Map Block plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability che... |
| CVE-2026-19603 | MEDIUM | 4.3 | 0.2% | Oct 16, 2026 | Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize the activ... |
| CVE-2026-19601 | MEDIUM | 4.9 | 0.2% | Oct 16, 2026 | Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to invalidate the sto... |
| CVE-2026-19541 | MEDIUM | 6.5 | 0.2% | Oct 16, 2026 | Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to require re-entry o... |
| CVE-2026-18795 | MEDIUM | 6.4 | 0.1% | Oct 16, 2026 | Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to enforce DM/GM check... |
| CVE-2026-18551 | MEDIUM | 6.5 | 0.2% | Oct 16, 2026 | Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the combin... |
| CVE-2026-15222 | MEDIUM | 5.4 | 0.2% | Oct 16, 2026 | The The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Cust... |
| CVE-2026-111178 | MEDIUM | 4.9 | 0.3% | Oct 16, 2026 | The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to generic SQL Injection via the 'data[order... |
| CVE-2026-111069 | MEDIUM | 6.4 | 0.2% | Oct 16, 2026 | The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to ... |
| CVE-2026-110701 | HIGH | 7.2 | 0.2% | Oct 16, 2026 | The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'CalendarTit... |
| CVE-2026-110664 | MEDIUM | 6.4 | 0.2% | Oct 16, 2026 | The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting ... |
| CVE-2026-110366 | MEDIUM | 5.3 | 0.2% | Oct 16, 2026 | Missing Authorization vulnerability in Gemini Labs Site Reviews site-reviews allows Exploiting Incorrectly Configured Ac... |
| CVE-2026-110290 | MEDIUM | 6.4 | 0.2% | Oct 16, 2026 | The WebberZone Top 10 — Popular Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'other_a... |
| CVE-2026-110252 | MEDIUM | 5.4 | 0.3% | Oct 16, 2026 | The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and ... |
| CVE-2026-110191 | LOW | 2.7 | 0.1% | Oct 16, 2026 | The Product Delivery Date for WooCommerce WordPress plugin before 3.3.2 does not perform a capability check before disc... |
| CVE-2026-110179 | MEDIUM | 6.8 | 0.2% | Oct 16, 2026 | The affiliate-toolkit WordPress plugin before 3.8.9 does not validate a user-supplied sort value against an allowlist b... |
| CVE-2026-110135 | HIGH | 7.4 | 0.2% | Oct 16, 2026 | The OTP Login & Register Woocommerce WordPress plugin before 2.7.3 does not adequately limit one-time-password verificat... |
| CVE-2026-110039 | LOW | 2.7 | 0.1% | Oct 16, 2026 | The Smush WordPress plugin before 4.3.4 does not restrict changes to a network-wide access setting to network administr... |
| CVE-2026-110015 | HIGH | 8.8 | 0.1% | Oct 16, 2026 | The Salon Booking System WordPress plugin before 10.31.9 does not correctly verify the authenticity of REST API request... |
| CVE-2026-110014 | MEDIUM | 5.3 | 0.1% | Oct 16, 2026 | The Salon Booking System WordPress plugin before 10.31.9 does not properly check authorization before creating a bookin... |
| CVE-2026-110013 | MEDIUM | 4.8 | 0.1% | Oct 16, 2026 | The Salon Booking System WordPress plugin before 10.31.9 does not generate its booking-API access tokens from a secure ... |